Doing end-to-end cryptography is hard enough to get right. Adding multiple devices to the mix makes it even harder.

So it's an explicit trade-off, made to keep your communication safer. Signal, in general, is uncompromising about privacy and about keeping metadata out of their hands.

You can use matrix and gate everything else into it on your rpi

If you think a device with storage mechanism that can simply connect to another computer and view all your keys is safe enough for your communication needs, then it is fine, you don't need to use Signal.

People use Signal because they don't want to be compromised when they just leave their phone / laptop unattended for a couple minutes on a bus or a train. They don't want to be in a situation if one day their laptop gets computer virus and they have to assume all these accounts are compromised and have to restart their digital identity all over again.

I believe Signal last year started allowing you to backup your primary account and transfer it to a new device?

Android 15+ has Private Space which is basically an additional work profile but managed by the system and not a third party app.

https://support.google.com/android/answer/15341885?hl=en

Android work profiles allow you to run multiple isolated copies in parallel - with separate address book and all. Works very well for Signal. I wish there was something similar for iOS.

There are some tools available to make management even more straightforward, like Insular, a fork of Island: https://f-droid.org/packages/com.oasisfeng.island.fdroid/

Beeper allows multiple accounts from various apps in one chat app FYI

I believe you can use Samsung secure folder to do something like this, I haven’t quite tried it yet though.

This is not true. Signal added support for linking secondary Android phone or tablet in August

Or have a tablet. That was my main reason for using Molly.

If using GrapheneOS, you need to give permission to write/install packages.

Using the preinstalled Google services effectively turns your smartphone into spyware. In the standard Android that comes preinstalled on most smartphones, Google services run with system privileges and can collect all kinds of data including location data. If Signal exclusively supports this, it reinforces dependence on Google and discourages people from using versions of Android that don’t include Google’s spyware.

This argument doesn't make sense, Signal is fundamentally not an anonymity tool. It's a privacy tool.

They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.

"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.

> When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.

You're also hedging against mandated government backdoors.

A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.

The reverse is true, if more app support unified push then those using it will stand out less.

There just is a contention between software freedom and privacy that people don't want to acknowledge sometimes. Signal is firmly on one side of the divide, and their software is open source because it is the convention to have the source public and auditable, not because they are interested in user freedom and respect.

Stand out from what? Are you seriously arguing that the only things keeping Signal from being banned are that it somehow camouflages itself?

Not sure I follow or understand your argument. There's so many things with which eg Telegram stands out, but it still appeals to normies.

They could still implement these things in the app and put them behind a switch for users who care about independence more than one specific type of anonymity. Explain the tradeoffs on the settings screen.

The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.

Anyone who has worked with SQL databases and graph databases can't buy this goofy "camouflage" idea.

If you don't know how computers work, yeah it sounds great. But those who do know how computers work see it for what it really is: a bucket of shit.

[dead]

[dead]

It's just two compilation profiles, at least thousands of minuscule open source projects do it

Hates users who are not total normies and designed explicitly for normies are not opposite. In fact an app that hates not normies would be designed for explicitly for normies.

> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.

It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.

Yeah this resulted in a mass exodus of my contacts from Signal. The worst part is some of them never deactivated their Signal accounts, they simply uninstalled it from their devices. For a good while, I was sending messages to the void because Signal thought they were still active users.

I only have 2 people in my contacts that use it now. Every now and then somebody will install it for a couple weeks and ditch it again.

Where once it was a messaging app for everybody, now it is a mailbox they forget to check.

To put it simply, I need a messenger app to talk to other people. Most people I talk to are not programmers or very tech savvy.

Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.

Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.

Do you support what the above user contests?

> It won't allow you. You must give it SMS access to read the code

Just tested with latest version of Signal. Can't reproduce. You can just tap away all the prompts, and paste the code.

[dead]

Hate to say it, but if you don’t trust Signal to read your texts… you’ve already lost - stick with Facebook Messenger.

I’m pretty sure it’s for security reasons, it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor. It’s hand holding yes but it’s a trade off in favor of non-technical users.

Signal developer here: we should retry with reasonable backoff for 24 hours before showing a delivery failure. If that's not your experience, please file a bug if you get the time!

I spend about half of every year traveling the mountains and deserts of the world, often ones with poor infrastructure. I use Signal more than any other messenger app, and I have never had the deliverability issues you complain about; messages do all get through eventually.

> Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.

This is not something exclusive to iOS; Android does the same thing.

I'm not sure about Signal, but I had a similar issue with another app, a SQLite db inaccessible. I found that you could take a computer-based full backup and then there are various 3rd party tools that will poke through that backup for whatever "hidden" app data you need. One I previously used is iMazing, but I'm sure there are free open source ones as well.

Best of luck!

No. Turn on backups. Write the encryption key somewhere safe.

Copy the backup off your phone and use https://github.com/bepaald/signalbackup-tools to extract everything.

Something doesn't connect here. I have a workout tracker app I use, and while I can't access the sandbox from the outside, the app has a feature to import/export workout history and it lets me dump a sqlite db copy via iOS share sheets just fine.

> Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.

It seems to me like the app itself should be able to perform this operation and restore data? Why is this not just fixed in the app?

To be sure this would mean Apple has to allow for 3p installs that have self signing keys that can let one gain visibility into the data of the app(in this case its in the sandboxes), yeah?

The whole point of signal is that they cannot provide you with your data - they do not store it.

Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.

Yes it's tiny but it's the kind of people that tend to influence others. Not in using F-Droid, but using signal yes. It could help adoption overall.

Having signal on fdroid and having it build reproducibly would make me trust it.

As it stands it's a proprietary app with a lot o marketing to convince me otherwise.

I've used F-Droid for years. It's simple, has good apps that aren't full of ads, just works. PGP... sucks a lot, I never really got along with it. Maybe an age thing, but hardly anyone I've met uses PGP/GPG. Yet I have many friends/family on Matrix.

You need to fix your shill propaganda. It's 4 months i.e. 120 days, not 4 weeks, before they delete your account https://github.com/signalapp/Signal-Server/blob/7f5097bd3317...

Under Signal's original leadership, there was definitely a hard stance against third party clients connecting to the network. I think they've been quiet on third party clients since Moxie left.

Software license ≠ terms of service.

They can give you the right to reuse their source code for building your own service using your own network (an aspire to give you this right), but still forbid you to connect to their service on their network with third party clients.

In practice, they don't seem to enforce that a lot (anymore).

You can totally fork their projects! You just can't call yours "Signal" (trademark I guess?) and you can't connect to their servers. Molly seems to be tolerated, somehow? Maybe because it is niche.

But clearly connecting to the Signal servers with an outdated, modified fork is against Signal's goal.

Sure, it doesn't contradict what I said. The number of Signal users connecting through Corvus is probably a rounding error for Signal, it's not worth doing anything against it.

Signal is a non-profit. They won't shut you down because they want to make profit. They may shut you down if they think you lower the quality of their service. I'm pretty sure that with Corvus you're not on their radar because probably almost nobody is using Corvus, right? Or do you have tens of thousands of users?

As someone that follows This Week In Matrix, is there likely to be a major shuffle in the next few weeks regarding calling configuration for self-hosting? I see that there is work being done, thoug I'm not sure how much that will affect server operators

It's not great. But I prefer it over the risk of downloading an APK from signal's website that I don't know how to properly verify the integrity of (there's a key listed on the website, but who knows if it's correct?). (I don't use Google play)

Signal markets themselves as really secure. It's on them to prove that they are.

No reproducible builds from them when they are now very common is really suspicious.

[dead]

>> I don't think this is what Moxie wanted.

> I think this is exactly what he wanted

You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted?

A self-described anarchist who described the original cypherpunks as his teenage heroes?

When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk?

That is just crazy, man.

In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends and colleagues already on top of pure Internet Protocol, is on its face absurd.

_

> Spam is not a plague because registration remains expensive

The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this.

The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace.

Very simple concept.

Simple enough for a mediocre dev to implement without an LLM.

The spectre of spam does not justify the demand for "checking in" with your local PSTN tower, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved.

The spectre of spam does not justify any of this horse shit.

"Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal.

The new, grossly degenerated Scope of Choice.

Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them.

Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible.

An invite token personally sent by Alice or read aloud by Alice to Bob, is not.

But if somebody wants to harass a specific user on Signal, that's relatively cheap to do.

_

> Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting

Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server.

On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not.

Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users.

_

> Alternative servers are not sapping user metrics.

This imperative is not the users' problem and runs counter to the best interests of the users.

_

> Its tradeoffs all the way down.

Right. In Matthew's view, the horse shit is a tradeoff.

I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.

You should definitely avoid Session. While its decentralized nature is a positive, the developers have implemented many features insecurely and have also removed forward secrecy. There are blog posts by a cryptography expert on this topic: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/

Oh look it's me.

I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.

That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.

What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.

[flagged]