However, if "dropping support for SMS messaging also frees up our capacity to build new features (yes, like usernames)", I think it is something I would not miss.
Besides, I agree with them on the point that SMS leak metadata.
SMS does leak metadata but guess what, that leakage is going to continue because people aren't going to just cut off their SMS-only-using friends and relatives. Now they'll be leaking Metadata from an even less secure app, so the user is in no way better off.
Exactly right. In fact, I will be doing this too. Right now, I use Signal as my default messaging app, and messages go via Signal to people who've registered their phone number with Signal without me having to do anything to effect that. When Signal stops working as an SMS client, I'm not going to look up which of my contacts wants to use Signal and which can only use SMS - I'm just going to use my default SMS app for everything except the couple of group chats which are on Signal already. Messages which would have been opportunistically encrypted are now going to go out plaintext, because the friction to find out who uses Signal and who doesn't is too high.
This already happens with iOS, because the Signal app doesn't work as a default SMS client. People who use Signal and Android reliably send me messages over Signal, whereas my contacts who use Signal and iOS mostly send messages over SMS unless they're directly replying to something I've sent them over Signal.
And even if I wanted to do the work to send everything over Signal to those contacts, how am I supposed to remember exactly which of my kid's friend's parents use Signal and which don't? Fuck it, the juice isn't worth the squeeze, everything is going over SMS.
I'll just have to hope that Google figures out a way integrate a seamless, opportunistic end-to-end encryption protocol into the default Android messaging client, since Signal is deliberately dropping the ball here.
Gutted. I will end up switching to a different provider. Absolutely don't know if I'll be able to convince family and friends to switch again.
I don't really see Signal as a useful tool for my uses after this change. I liked the SMS and encrypted messages in one place thing even though some friends rarely check it. For those friends I send SMS through Signal. There are certainly issues with group chats and media but nothing bad enough to consider using two apps. Now I have to look for a new tool, and figure out what to do with certain archive conversations I'd like to retain.
>Now we will get neither
Correct me if I'm wrong, but:
- If you and your counterparty are both using Signal, nothing about the security of your communication changes.
- If your counterparty was not using Signal, your messages were over SMS/MMS and therefore not encrypted in the first place, and so once again, nothing about the security of your communication changes.
Are you seeing something I'm not?
I have (iOS-using) friends I have convinced to register their numbers with Signal...but they never check Signal. They do check SMS.
This actually drove me away from using Signal for SMS on Android, because I couldn't send those friends SMS messages through Signal. They could only go out as Signal messages, and my friends never checked them.
Fortunately, I only have a handful of friends in this category, and virtually everyone else I talk to does use and check Signal, but it's a usability problem both ways.
This is what Google's RCS implementation is, to my understanding.
Although the end-to-end bit might be a bit on the squishy "kinda-maybe-sorta" side, rather than Signal's enforcing of it.
There's an overwhelming mountain of evidence that says that ends poorly.
As far as instant messaging services are concerned, I have let go my earthly tether; entered the void; empty and become wind.
This is actually a complaint of mine. I've regularly had Signal send secure messages to people who have tried Signal in the past, but have since uninstalled the app (or in iOS's case, they 'offload' apps when you don't use them frequently which silences notifications). This results in me thinking my messages are sent only to find out that they'll never read them. I then get frustrated and have to go back and re-send the message via SMS.
I've onboarded friends and family, too, ensuring them it should be set as their default messaging app and that it _just works_. Unfortunately, people in the general population seem to have pretty much zero tolerance for any friction whatsoever. If they have to use 2 apps, they'll just end up communicating with me in the clear using their "default SMS" app on their phone. That's what this is going to result it...a reduction in overall message security due to people defaulting to what's easier...which is to _not_ have to remember which app to use for which "send a message" purpose. Fuck.
I understand the argument about people in markets where SMS is expensive getting screwed sometimes when they don't realize they're sending a message over SMS. However could that not be fairly trivially solved for with some UI notification or app setting that warns you about this and allows the warning to be perm-disabled if the user doesn't care!?
I think the real reason here is this desire to transition the service into supporting usernames, which is a topic that's been discussed before (and is explicitly mentioned in the post). Right now the service is tied to your phone number. After this change I suspect it will not be or not need to be.
This is very, very unfortunate for those of us who've convinced a ton of non-technical friends and family to use TextSecure->Signal over the years...