This is the news for me!

You can already do that without being a trusted device.

Here's an article saying that: https://aboutsignal.com/news/signal-allows-android-phones-to...

Thanks for pointing this out. I've been waiting for this for years and was not aware!

Signal is there for power and control, not for its users, otherwise they would welcome the usage of third party clients, and generally, encourage decentralisation measures like self hosting, federation and account portability. Yep, they have nice engineering blog posts, they are also US-incorporated, extensively centralised in AWS and subject to the cloud act, which together negates, or largely diminishes claims about being privacy conscious.

I’m not sure their tax status is the justification your argument needs.

Not only that. I also question how they pick new features to implement. For example usernames - I am not going to trust another "private" IM app username feature same as what Telegram and WhatsApp questionably chose. Compromise on this? Well, then even WhatsApp and Telegram are good enough with compromises.

Separate usernames completely from phone numbers. Period.

There's a reason Signal is still "US based". No, I am not talking about some CIA/NSA/DoD/tom/jerry funding conspiracy, just good old human obstinacy and hubris. They don't give a f about who uses it, it's about who makes and maintains it all.

OpenAI is 501c3, should they also be required to release everything?

It says something about Play Billing being used specifically to mitigate spam?

I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

Ugh wtf so I need a Google account on Android? That's not going to happen.

For an org that pretends to care about privacy you'd imagine there'd be a way to avoid, you know, the biggest privacy invader on the planet.

Just allow monero payments or something. Alongside Google play for the sheep that want to use that.

What about their built-in cryptocurrency? It's a perfect use for it. They could require payment post-install yet before message can be sent.

By the end of the year (tm)

Likely soon.

usually, the implication of ZKP is that you buy coupons and claim them without attribution. in this coupon scenario the ZKP can just be a blind signature scheme.

however signal has an obscene fondness for TEEs (secure enclaves) so they may actually be doing something stupid here which will require trust beyond the ZKP.

Here's a site with a few (three) introductory articles on ZKPs: https://zkintro.com

One in particular on pratical implementation of ZKPs was popular on HN back in 2024: https://zkintro.com/articles/programming-zkps-from-zero-to-h... (discussion at https://news.ycombinator.com/item?id=41398092)

I liked this: "I can prove I’ve solved this Sudoku without revealing it" https://youtu.be/Otvcbw6k4eo

nym.com might have some. They use stuff like that heavily and there's a bunch of academics involved.

Also ZCash.

It's standard cryptography, not some new-fangled tech! Wikipedia even has some easy examples:

https://en.wikipedia.org/wiki/Zero-knowledge_proof

Main caveat is that ZKPs are probabilistic. The protocol (number of rounds etc) determines how sure, e.g. 99.9%. But never 100%.

Second caveat: tech- and crypto-bros play fast and loose with the term "ZKP", either because they don't know any better (marketing) or they straight up lie. Whether any application you run actually uses ZKP (or any other cryptography scheme) is unknown unless you have the source code.

Yes that's bad but that's an Indian government problem, not a signal or other messenger app problem. And really, it sounds like there was a lot more going on with these people than just using a particular app. Discord and WhatsApp are mentioned too.

India also bans most satellite phones by the way. I have one so I looked into that as to not get caught out travelling.

> And yes, using a VPN will get you knocked up as well.

Well, damn.

And WhatsApp is E2EE with the same protocol so I don't see the big deal.

Viewing any security thing as a binary is the wrong way to look at it. Figure out your adversaries, how much power they have and what they are willing to spend. Make your decisions from there.

I personally think signal is sufficient for the threats the average person is concerned about, but that is a decision each individual has to make for themselves.

Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not?

I concede that if you can't trust the device itself you can't trust anything running on it, but why have you resigned yourself to that? And how does that reflect on signal at all?

Molly is a security-hardened Signal client only on Android for people unfamiliar. They went through a period of not updating (there were no security updates during that time afaict), but now releases should happen faster on top of Signal.

In Molly there's three options. Google Play Services, WebSocket, and UnifiedPush.

I use the WebSocket and Molly has used >1% of battery since the last full charge so it doesn't seem like play services would improve battery but maybe if I had more apps depending on it..

Google and Apple can't see the notification content but they can see metadata. If you want metadata privacy you should use SimpleX instead anyway.

Can you point where Signal uses proprietary blobs? Also, I'm using Signal without the play services notifications just fine. Notifications that don't contain any message content while transiting anyway. The display of the notification was the issue with iOS bug and that would have affected molly as well (if it was on iOS).

The native Signal android app delivers notifications just fine without Google play services on my degoogled android.

I was using Silence from F-Droid for a while back in the day because of these issues, but the lack of interop and needing to make everyone move again soured me on the whole thing. I would rather just get people on XMPP or Matrix and not use some sketchy phone-first app at all. For SMS I use Fossify Messages, which I think was a fork of QKSMS. I don't use SMS as primary or sensitive comms, only as needed. Same as email, basically, but less useful.

I tried it and it was fine while it worked, but eventually I had to go back to regular Signal because Molly's updates did not follow Signal's closely enough, and at some point the server code changed enough to where I was unable to use it for an unacceptable amount of time (after checking, it took them weeks to update). Something to keep in mind if you're not using a custom server.