For some people (e.g. journalists) this is exactly what they need, because forgetting to set disappearing before sending a message could be problematic, and I'm glad they added this feature for that use case.
It is also still missing a key point we've been asking for for awhile, message archival. That's the big thing keeping me from using disappearing messages, because I don't want to take a screenshot anytime anything important is said. That's a terrible way to search for messages. With an arbitrary delete function (only limit I see is Signal's servers don't accept delete commands after 24hrs) you can have consent from the other party about archiving messages while disappearing messages is on. This provides a tremendous amount of utility.
I used to defend Signal a lot here. But with a lot of decisions they've made in the last year they seem to be just another company that "knows better" than the user. We don't need another tech company that's disconnected from users and makes changes just to make them[0]. (Beyond that, Signal isn't large enough to make people stick around when dumb decisions are made) I think this is a fine stance to take when it comes to the security portion --there are fairly objective "best practices" here-- but not for UI/UX and privacy functions. But with the latter there's a lot of subjective preferences and needs by different people and groups. Signal, you do not need to be and look like WhatsApp. Just be Signal. The progress has been very slow, new features come with footguns, and there is a lack of communication. They only seem to take communication from their community forums which has an extreme echo chamber and is the textbook example of "we know better than you" mentality. It's very frustrating and it's caused me to stop recommending Signal to people (my friends did the same for similar reasons). I just will not understand why when given the chance to continue to grow Signal decided to shoot themselves in the foot.
Boy does this hit close to home, whenever I think of Firefox and its accelerating decline.
Yeah, that's my read too.
The article's title is confusing and should be changed. I was worried they were going to change the defaults on me, and I was going to have to rush in and reset things.
But that is exactly what the default should be and what's needed to thwart large-scale blanket surveillance of the whole population.
If the mere fact that ephemeral messages are enabled raises a flag, that kind of defeats (part of) the purpose.
Yes, the messages are only on your phone; Signal doesn't have them.
While I haven't had my devices seized, two acquaintances had their device seized for an investigation. They were just on the wrong place at the wrong time.
This meant that months and months of our chats were potentially read by a third party.
Phones are compromised by default. E2EE doesn't matter if someone else owns both ends.
The issue is a matter of degree. Everything and everyone are compromised to some degree; perfection is not the standard.
They will, just now it's the supposed "good actors" that are doing it. See Apple's recent photo scanning announcement. I have no doubt governments will start "encouraging" even more phone monitoring software.
Police and authorities can have logs (either of everyone or high value targets) and those people won't have access to their own messages to defend themselves.
It even means chat conversations can be entirely fabricated by one side, and the other has no way to refute it.
Someone gets hit by a hack like Pegasas and it is only able to scrape a small history of messages.
At the end of the day this is going to be a per user decision. Security and privacy are different things. What's the correct privacy options for you is going to be different from another person, while we are likely to share the same optimal security strategy.
> Police and authorities can have logs (either of everyone or high value targets) and those people won't have access to their own messages to defend themselves.
> It even means chat conversations can be entirely fabricated by one side, and the other has no way to refute it.
I don't think that's a realistic threat, and if it was, the defense you propose wouldn't work.
Given that Signal is E2E encrypted, I don't see the mechanism where the police and authorities could even have logs without compromising the endpoints. Furthermore, even if they did fabricate a message, it's not like your phone is some inviolable log of what you actually sent. Even with Signal today, you can delete messages on an ah-hoc basis, so their rebuttal (that you sent it but deleted it from your phone) would be exactly the same.
In some systems, e.g. PGP, messages are digitally signed. This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email.
If what you wanted the message platform for was to agree legal contracts maybe that feels like a reasonable structure. Alice sends Bob a PGP mail "I agree to X" and Bob now has a signed message proving this agreement. Bob couldn't have faked that, only Alice could have signed it.
Signal deliberately doesn't do that. Signal messages have cryptographic integrity protection (so Charlie can't send Bob a message pretending to be from Alice) but not signatures, so Bob can fake messages from Alice to Bob because Bob is a participant and so has the keys.
As a result Bob knows if the messages are fake or real, but can't prove that to anybody else. That feels much more like what you want from a platform you use to chat with people, not for making legal contracts.
PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place.
So it seems odd to suggest that PGP is inferior to what Signal does.
>This means when I send you a PGP mail, I'm actually providing proof - which anybody can verify - that I really sent that email.
PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature.
What is the word "effectively" doing in your sentence? I suggest that the word you needed is in fact just not. The messages can be authenticated but they are not signed.
> Signal releases data to allow your correspondent to forge that signature after they have received your message.
Nope. Bob always has the ability to produce forged messages apparently from Alice (or Charlie) to Bob.
What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext. At this point any eavesdropper could make forged messages from somebody to Bob, that seem authentic to anybody except Bob (and presumably whoever didn't actually send them) but are rather old news.
> PGP does the identity verification out of band. So you can simply not sign your message and completely eliminate the problem in the first place.
In this case your message can't be authenticated, a very different scenario. Now Bob can't tell if this PGP email is really even from Alice because it lacks a signature. Perhaps useful for an anonymous tips line or something, but rarely what we want for messaging.
> PGP prevents access to signature information with the encryption. So you would need access to the private key of the person I sent the message to before you can verify my signature.
Nope. Just need the signed message. If the message was also encrypted then its recipient can decrypt it and show the decrypted but still signed message to other people as proof of what was sent, without revealing their private key.
This is very often undesirable, and yet it's the only option provided in PGP.
>What may have confused you is that Signal can eventually send Bob's expired authentication keys in cleartext.
Is this a new feature? Originally the decision was made to only allow correspondents to forge messages, not everyone as in the case of Off The Record.
If you signed a PGP message and did not encrypt it then you specifically wanted it to be possible for everyone to verify the signature. A trusted correspondent would not decrypt and release your signed message so the only time that would happen would be if your correspondent was compromised. In the Signal case you would have to claim that your trusted correspondent forged a message from you. That wouldn't really work.
In the case of an untrusted correspondent you would not want to sign your message at all or would sign it with a non-public identity. PGP allows you do do either.
In what sense do you believe X3DH is "signed" ? Is this going to be more handwaving where you treat authenticated as "signed" just because that's how you'd do it in PGP ?
The recipient of a first X3DH message does know for sure it is from the sender, because they're the only one that could have performed the steps needed without the recipient's private keys.
But if (like the recipient) you know their private keys, you can just forge messages that are entirely plausible.
Consider an initial message purportedly from Alice to Bob but let's suppose we're Bob and we're forging it. How do we go about this?
We need to do three DH calculations. First one, is Alice's long term Identity crossed with Bob's prekey. Alice would do this by knowing her Identity private key, but we know Bob's private prekey, so we use that with Alice's public long term Identity.
Second one, Alice's ephemeral crossed with Bob's long term Identity. Alice would do that using her ephemeral private key, but we know Bob's private Identity key, so we use that with any key X.
Third one, Alice's ephemeral crossed with Bob's prekey. Alice would use her ephemeral private key again, but we know Bob's private prekey, so we use that with key X again.
We now have a secret key we can use to encrypt our forged message "from Alice" and we write key X into the headers where Alice would have written her public ephemeral. Our message is indistinguishable from genuine. Only Bob (who forged it) and Alice (who knows she didn't send it) know this is a forgery and neither of them can prove it.
> In the Signal case you would have to claim that your trusted correspondent forged a message from you. That wouldn't really work.
If the Secret Police are content that you are a Blasphemer or you plotted against the Emperor or whatever without proof, nothing would "really work", regardless of the technology used or not used. That's not interesting here because we can't do anything about it. If the Star Chamber will have you executed based on hearsay, that's just as true for literal whispers as for a Signal message.
In contrast PGP provides them with unshakeable proof even though it didn't need to.
* https://signal.org/docs/specifications/x3dh/
... I understand that the prekeys are signed. I will confess that I have no deep understanding of how everything works together. Signal protocol is somewhat baroque.
A loose equivalent in the OpenPGP world would be a user's temporary encryption keys, which may change sometimes while your signing key stays unchanged. I don't know how common this practice is today, I know it was common years ago. Clearly knowing Alice's most recent temporary encryption public key, signed by Alice's signing key, would not prove a message you showed me was from Alice.
> Signal protocol is somewhat baroque.
I agree it seems more complicated in principle than OpenPGP, although I think it's hard to make that argument for the practical deployment of OpenPGP because of the complexity of delivering compatibility.
But Signal's complexity has a specific purpose. For example those three DH pairs are combined together with a KDF so that 1. Bob learns whether the message is really from Alice (assuming Bob is not the protagonist of the movie Memento and so remember if he forged the message); 2. Alice knows the message can only be received by Bob (to the extent she verified Bob's identity, which is an out-of-band problem), and 3. A fresh random Forward Secret key is used for the conversation. Three desired properties, run DH three times.
It is definitely possible that cryptographers will come along and say "Oh, we can do this in a single function" and write like fifty pages of difficult maths and one day we get a replacement for Signal with "simpler" (although like Elliptic Curve maybe not simpler to explain) cryptography than this. Definitely possible, but these moving parts all have a purpose AFAIU today.
Fine with whatever the default is, but I feel like the subtext here is that Signal thinks people's phones are going to be increasingly compromised so this will be a more necessary, and the "remember the passing acoustic conversation" is just a way to put a less depressing spin on that.