> It's not a technical issue - they just think you're wrong when you want to keep your conversations.
as much.
When you are treating security as a number one priority I think there are a lot of things that become technical issues which aren't typically. Transferring or backing up history between disparate devices, which become trusted at different times, is one of those things that I think _is_ difficult to do without sacrificing security.
For example, in the classic case when a user adds a new device and wants history to be available on both you can't let the devices controlled by one person simply sync with one another. To do so would be making a security concession to the other members of the chat in that they no longer verify every destination of their message. If you are unwilling to make a security concession everything in this area becomes magnitudes more difficult. I wouldn't say it is impossible, but it's definitely not trivial.
My gut reaction is also that it is difficult to _guarantee_ history in this type of security first mindset. If you add a new device and someone doesn't approve/verify/trade encryption keys with the additional client then there isn't much you can do besides not make that data available no? So I don't think it unreasonable for developers to hold the mindset that history is not a priority for a security first application.
I mean what is the point of obsessing about the security of the messages if you don't value the messages themselves?
Some people[1] clearly value message history far beyond the transfer point to chat itself, and making people choose between being spied upon and not having message history, I think many people will choose trusting that they won't lose their messages.
[1] Myself included. I check with Signal[2] every six months to see if they have a backup option, then switch back to WhatsApp when I see they don't. Phones die. My messages are more important than my phone.
[2] https://support.signal.org/hc/en-us/articles/360007059752-Ba...
https://news.ycombinator.com/item?id=22371316
He actually seemed annoyed that everyone insisted on using it for everything :-)
If you need bulletproof cryptographically verifiable encryption - use Signal.
If one wants to plan dinner, use whatever fits your bill.
(And if in addition to the same supposedly bulletproof encryption as Signal you also want NSA^HGoogle to back up your messages and Facebook to know who you talk to and when so they might better customize their ads^H^H^H your experience you can also use WhatsApp :-)
- exchanging passwords? encrypted mail, Signal or something else E2E-encrypted
- work: whatever work says. Mostly slack.
- discussions with friends and family: Telegram
- online shouting competitions: twitter
- showing off: Instagram
- telling Facebook who my friends are and how often I talk to them: WhatsApp ;-)
- work: Matrix
- discussions with friends and family: Matrix
- online shouting competitions: twitter
- showing off: Instagram
I don't get why I or anybody should switch to Signal. It's not a good app.
But the general population seems to think they are losing features, instead of gaining, that's why they don't migrate/are upset and surprised when they lose history
Anyone who is security/privacy conscious to use Signal is also using a solid password manager and not reusing passwords as well as following good secure data backup practice, I hope.
> To do so would be making a security concession to the other members of the chat in that they no longer verify every destination of their message.
You can't "verify every destination" with Signal anyway. Maybe the message is going to my phone, maybe it's going to my phone and my desktop - the sender can't tell.
Sure, if you are trying to add an entirely new recipient to a conversation, then of course you can't send them the entire conversation history - but nobody is asking for that.
What people want is the ability to add a new device for an existing recipient, and have the history sync across.
With Signal I can already add a new device and continue existing conversations without the other participants being notified that I've added a new device. Adding conversation history doesn't diminish anything from a security perspective.
> With Signal I can already add a new device and continue existing conversations without the other participants being notified that I've added a new device.
Just today I had a group chat notification that said:
"More than one member of this group is no longer marked as verified. Tap for options"
Tapping brought me to a menu that said:
"Safety Number Changes -- The following people many have reinstalled or changed devices. Verify your safety number with them to ensure privacy"
At which point I was given the option to re-verify (e.g. via a provided QR code), but also the option to manually mark "verified". That is to say something does notify participants of changes to recipient devices.
Linked devices are different. There is no notification when someone adds a new linked device. That's because the only way to add a linked device is to scan a QR code on the device with your phone, then confirm you want to add the device. The device is implicitly trusted, because only a trusted device can add it. (It is also possible to trigger the re-verification from the desktop manually by clicking "reset secure season" in the conversation menu, but that's separate from adding a device.)
Aside: Implicit trust like this is a great trade-off, because otherwise you'd have to verify each of their devices from each of your devices, which means approximately nobody will ever do it. Ask anybody who used Matrix/Element E2EE prior to a couple months ago ;D.
This is the core problem as why many projects don't get mainstream. They have 2 options: they can focus on what they think is a priority, or on what the public thinks is a priority.
I'm not saying Signal is wrong on doing what they are doing, as they are being successful among some niches (i.e: tech). But to grab Whatsapp users, they need feature and UX parity, at least to some level
They're singularly focused on the user experience and what users want.
Uninstall / reinstall / multiple-devices works flawlessly.
So you can use regular texting for everything you don't care much about, like sending youtube videos and memes to your friends, and use the secret chat to things that re more sensitive. That's great for most people that currently use Whatsapp
* Whatsapp is closed source, so you can't tell if the encryption is true anyway (what if they are transmitting your private key?). Telegram has open source implementation and API.
* Facebook will not have your metadata. The subject of these events is basically FB having too much of data about you.
I would expect a Signal implementation of this to allow recovering chat history if you restore a backup onto the new device and if you re-enter your PIN.
(Also, your Signal PIN can be an alphanumeric passphrase.)
I don't either, but a chat app is useless if I can't use it to chat with people and almost nobody I know will consider Signal. It's either WhatsApp, Telegram, or SMS (horrible).
But you're right, Signal is designed for secure communication between parties. Allowing messages to be exported or archived should at worst leave only your own messages (and remove all others including media) and at best not exist at all.
Sure, let me just single handedly backup our conversation and send it to the HK police...
I doubt my mom will send my 'good morning', 'good night' and 'love you' to the HK police.
If you are communicating with people you don't know/trust, then yeah, you want expiring messages that are not exportable
Keeping around old messages more or less negates the value of forward secrecy. The Signal Protocol is obsessively forward secret. So it would be reasonable for those that have put so much work into getting rid of old messages for good would not value them.
If I want a conversation to be private, I set expiring messages, for the rest of it, I want to be able to go back and reference things all the time. Whether it be digging up a song link I sent a buddy, or looking up the address someone sent me a week in advance.
If they can't operate or are unwilling to operate under those guidelines then they just aren't ever going to replace whatsapp with the general populace and the community should start work on something else or agree that telegram is "good enough" (I don't think it is).
But it really isn't available to the software author to know how long we want to keep a message for. If I want I can set a disappearing message timer.
> I don't understand why people want to save their whole chat history
Valuable messages and conversations can happen too often that it's a hassle to save them manually. This is probably more common in group chats where lots of people occasionally share valuable stuff.
I don't know much about WhatsApp, and I've never lost any message in Signal, so I am not sure I am well equipped to discuss whether it's fit for that purpose. But I would certainly love to save individual messages in some sort of vault, as well.
Why? Can you please explain as my understanding of perfect forward secrecy is that should not matter. I'm not a crypto expert so perhaps I've overlooked something?
Think of it like this: if I'm an attacker that breaks into the forward-secret chat app on your device, and you have kept a perfect record of every conversation you've ever had using that crypto system in _the same place you keep your identity keys_, then does it really matter whether the messaging system was "protected" by a forward-secret system? You might as well just have scrapped all that complexity and had non-forward-secure messages if you want to keep a perfect, eternal record of your conversations.
I actually think the Keybase guys did a great job at this. They have non-forward-secure chats by default (so that you never lose chat history), but exploding messages (which delete themselves after a short time by design) are forward-secret, since then it actually makes a difference.
I suppose it depends on your "threat model..." How do you want to use your chat system?
Chat history means giving up some measure of at-rest security, but it has no impact on the in transit part. Personally I also think some compromise of at-rest is a reasonable trade-off for a lot of consumer contexts because physical capture of your device already is basically game over.
I'm no expert, but if all you care about is transit security, I don't think you need PFS (in E2EE messaging! TLS is a different story, because you have to trust the server). Just protect your private key. But if you're carrying multiple device's worth of accumulated messages _right alongside_ your private key, then what's the point of rotating ephemeral keys after each message?
EDIT: I agree about a compromise on PFS/chat history being reasonable in most scenarios. But I also think that defaults are really important, especially as the contents of chat history can be leaked by other participants, whose chat backups you can't really control. It's a tough problem to solve for everyone.
I'm no crypto expert but that "later date" when talking about PFS is to avoid an external dragnet recording all your ciphered streams and then deciphering them once they have your non-PFS secret key.
I mean, in your definition basically all the messages should be ephemeral on your device and on each recipient device to have PFS.
In the first, a global adversary (say, NSA) records all your interactions via a chat service. This chat service does not use PFS. At a certain point, they capture the private key from one of your devices that uses the service, and is able to decrypt all your messages.
In the second, the same global adversary records all your messages, but this time from an otherwise identical service that DOES use PFS. The adversary captures your private key but can only use it to MitM attack you going forward. However, before discarding your device, they check your conversation history -- because your diligent backup and transfer of all your conversations since you signed up for the chat service, they now have all your messages. PFS did not help.
Now, you could change scenario #2 to where you don't have an option to back up and transfer message history (or simply choose not to), and that's essentially Signal. In that case, the adversary is pretty much hosed except for the messages your device just happened to have on it. Adversary steals message backup == adversary steals private key w/o PFS
This is what PFS is all about: it is about noticing that keeping your private key secret is really hard and admitting you're probably not going to be able to do it.
But even so, when it leaks, the attacker won't be able to use it to unlock the ciphertexts of all your previous conversations that he meticulously recorded. This property is PFS.
There is no need for the attacker to have access to your device in order to execute this attack against systems which don't have PFS.
The attacker who has all your ciphertexts needs the decryption key to get the plaintext (which she wants). Now, with a PFS scheme the key gets deleted as soon as I receive and decrypt the message, so the attacker is out of luck, basically (even if she gets my long-term key). However, PFS only moves the target to my plaintext message database...which is stored the same way my key is (as I understand it). So really, unless I purge my message history with some regularity (I do), then the stakes are the same -- don't let the attacker get access to the device.
But most people prefer to have all their chat history available and searchable, at which point individual decryption keys don't matter and therefore PFS doesn't, in my opinion, help much.
The other side of this coin is deniability. If you break into my secure location and steal my chat logs, but you can't tell which are real and which are fake, you've still got work to do.
The Signal protocol has you covered, here. After the fact (ie, as long as you don't watch me receive the message), there is no way to cryptographically prove which of the two participants wrote the message[0]. Thus, it is technically possible to forge a bunch of chat history, or claim that someone else's is forged. Cryptographically, the "spirit of forward secrecy" is secure.
That said, this is far out of the reach of the average person. Even if the only evidence is a screenshot, that conversation probably happened. So in practice yes, you've got a point. That's why I think it would really behoove Signal to add a "forge a conversation" feature. Make it trivial for either person to add a message to their local history that looks like it came from any of the participants, at a specific date/time. Now you've got practical deniability, too.
[0] https://signal.org/docs/specifications/x3dh/#deniability
If you had a way to keep your old messages safe then you could of just used that method to protect your private key.
Such thinking defeats the actual purpose of the program: to serve users. I don’t want to delete at least some of my history. It’s like Windows, which know better than the users what they want.
Make a setting for those that care. Make it the responsibility of users to make sure all their devices agree on that setting. See? problem solved.
Not being able to back some conversations up is not an option. It would be very ironic if the answer to this was "well, then don't use Signal, because we don't care", and people who cared about the WhatsApp stuff ended up being pushed into Telegram (which seems to be the only other popular alternative, by a wide margin).
In my opinion, Signal is not a "niche curiosity", and mass public is rarely right.
It would be perfectly fine if exporting/importing chat history would be a manual process via encrypted files and if it was disable by default. But not having it at all is an issue for me.
That said: It isn't exactly easy with other messengers. WhatsApp does have some backup/restore. But afaik it is limited to the platform you are using (Android or iPhone). The export is limited and cannot be imported again. Telegram has all the messages on their servers... which... ah well, let's just leave it at that.
Makes me think that I need some private third party database that just ingests and consolidates all my chat data for me. With something like that it might be okay just having a few days worth of chat history on the phone.
If you want to make a nerdy niche chat client that's probably a good mindset, but if you hope to appeal to the masses you'll have to put some water in your wine eventually. I managed to convince a couple of my groups to migrate away from WhatsApp lately, but unfortunately always towards Telegram. Signal is just not there yet if you want a drop-in replacement.
You already have that. Signal-cli is based on a standalone Java library distributed as part of the Signal codebase. Of course it is an unofficial client and the Signal team would really prefer you not use it, but if the Signal-cli team can develop something from that library, you probably could too.
I mean, in a sense, all software is just a vehicle for the data it processes, and the actual value lies in the data - not the software.
That data is chats for Signal. If they think that's worthless, even just the history of it, it means they don't really value their own application.
They are wrong.
You don't want someone getting access to your account two years from now to be able to access every old message. Consider every message a separate object that gets encrypted. The keys are changed/updated each time a new device is added to an account. That new device only knows the new key(s), and thus can only decrypt new messages.
The messages I don't want people getting ahold of are either created with expirations or I manually delete them. I couldn't care less if someone 2 years from now can read a chat log between me and my mom if it means that I can actually read them 2 years and multiple devices away from now as well.
What I don't want is to be forced to message with one app for secure chat and something completely different for daily driving. It's a pain, and nobody in my circle is willing to do it (and I don't blame them).
This whole 'I don't care about history' discourse can change greatly for some people after a loved one dies, for example.
I don't want that kind of history on my phone. Messages are temporary to me. But, maybe I'm special.
https://www.reddit.com/r/technology/comments/kt91qk/signal_p...
I've tried to report bugs and talk to developers about this but there's one fundamental problem here - the Signal team fundamentally does not value chat history the same way a lot of people do. They think that destroying all chats is a reasonable thing to do when things get hard - which is the exact opposite to many WhatsApp users, which deeply value images and texts sent to them on that platform.
As such, they've been very very resistant at making the backup process for Signal easy for people. This is also why deskop app regularly happily just trashes all its state and fails to resync. This is why they will never let you make the backup process easy and portable.
It's not a technical issue - they just think you're wrong when you want to keep your conversations.
Unfortunately that's can also be a significantly bigger issue than privacy for a lot of people.