Someone in that thread notes that when you install the Signal APK from here [1] it "doesn’t get updates tho", but this isn't the case. Signal will update itself; you get a notification to update. Often earlier than the Play Store, probably due to its reputation to randomly delay updates.
Yeah. Installed Signal as raw apk in GrapheneOS and you just need to open it to install the update. It does not update automatically in background. But anyway, works.
Yes, it notifies of updates (once it did wake me up in the middle of the night), but last time I checked, it does not update itself automatically. Obtanium works, though, but a bigger issue is the extreme power drainage of the websocket.
Signal sends you a notification that says "new version available, tap here to update", but tapping it never did anything for me. I have to re-download the apk their website every time there is an update.
Sometimes I get the feeling that Signal hates users who aren't total normies. Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client. Just as they could easily offer a Google free version for F-Droid or simply for people who want nothing to do with Google. But they just refuse. Just like it took years for nicknames to be introduced, and registering without a phone number has only recently become possible and only through the Google Play Store.
Using the preinstalled Google services effectively turns your smartphone into spyware. In the standard Android that comes preinstalled on most smartphones, Google services run with system privileges and can collect all kinds of data including location data. If Signal exclusively supports this, it reinforces dependence on Google and discourages people from using versions of Android that don’t include Google’s spyware.
The whole point is that it's unusable without Google services due to battery drain. Meta got it right with WhatsApp and a battery-efficient WebSockets implementation for notifications without Google services, but Signal's implementation is poor.
This is an exaggerated take. I've been running Signal on LineageOS for years across at least 5 different phones in exactly this manner with no Google services installed. I'm currently using a Motorola G84 and charge every 2 days with moderate usage; Signal is my primary communication method with family.
The G84 has a very good battery by default though, judging from its predecessor. It can take some additional strain. Something weaker will suffer more.
I have run Signal on LineageOS or GrapheneOS for nearly a decade, no Google services, and I have always had satisfactory battery life, i.e. ~2 days of normal use.
I bought a PinePhone, so I definitely know what truly unoptimized battery life looks like, lol.
It's a moot point, as Signal isn't going to support self-hosted notification servers any more than it'll support self-hosted communication servers.
Signal works without GMS or any alternative, at the cost of more phone wakeups. This is much more preferable to everyone whose WiFi or data service you use see you connect to "push.myownname.com", or for you to rely in some rando gatekeeping your message delivery.
There is no reasonable reason why they shouldn't support it. Having my cell phone battery drain faster is a much bigger drawback for me than simply hosting my own push server at home.
This argument doesn't make sense, Signal is fundamentally not an anonymity tool. It's a privacy tool.
They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.
"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.
> When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.
You're also hedging against mandated government backdoors.
A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.
>You're also hedging against mandated government backdoors.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
Signal isn't anonymous. The server has access to your IP addresses and the server can at will build social graphs about the users.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
It's a hard problem, worth making some trade-offs. Signal published an interesting blog post about this, including this passage:
> In order to turn the address book on a device into a social graph for Signal, the Signal client needs to be able to determine which of the device’s contacts are Signal users. [...] The obvious problem with this method is that the hash of a user identifier can almost always be inverted.
(Not to object the degoogeling, but:) To create a Signal account, you have to validate a phone number. So Signal is currently largly about privacy, not anonymity.
FWIW I wouldn't know why to message someone if I didn't know who they were. The same goes for them not knowing who I am. What would we even talk about?
There just is a contention between software freedom and privacy that people don't want to acknowledge sometimes. Signal is firmly on one side of the divide, and their software is open source because it is the convention to have the source public and auditable, not because they are interested in user freedom and respect.
It's not that they're not interested in user freedom and respect. They just have different ideas about what's important. If Signal federates, that will bring to the table all sorts of 3rd party clients who will have say in how Signal does things, yet no duty to comply with the Signal's spec sheet and deploy timely protocol updates and features. Any clients not keeping up are damaging the brand, as was in the case of Matrix clients' poor support for E2EE. Then there's the aspect that the larger the organization managing the spec becomes, the easier it is to infiltrate and clog with bikeshedding.
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
They could still implement these things in the app and put them behind a switch for users who care about independence more than one specific type of anonymity. Explain the tradeoffs on the settings screen.
The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.
One of the most frustrating decisions from them was to stop allowing signal to be a catch-all messenger for encrypted and non-encrypted messages. I was able to onboard so many people, including very non techy relatives, because switching to a secure app for a small subset of people was never something they really wanted to do.
For security and privacy to really win out and raise the bar, it has to be able to happen in the background without the user even realizing it.
Making an app for enthusiasts is fine but Signal is going to remain niche if they can't make it more of an open ecosystem.
No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.
>Just as they could easily offer a Google free version
Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
Hates users who are not total normies and designed explicitly for normies are not opposite. In fact an app that hates not normies would be designed for explicitly for normies.
> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
> They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.
> unicorn
Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.
Yeah, the hostility toward F-Droid and wanting to run their app on LineageOS without gapps made me ditch Signal years ago. It seemed like the main gimmick back then was that it was also your SMS app, which IIRC isn't a choice anymore. So what's the draw now? Why would you not use XMPP+OMEMO or Matrix which work everywhere, don't need a phone number (at all, ever), and have free as in freedom clients and servers? It's insane to me.
To put it simply, I need a messenger app to talk to other people. Most people I talk to are not programmers or very tech savvy.
Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.
Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.
Well I bet you didn't have to convince them to leave messenger back then.
It's not that they are not capable of figuring out something more complex. It's that it's hard to convince non-tech savvy friends to switch apps and it becomes much harder if the alternative needs setup or feels unfamiliar .
Before the smartphone era, non-tech-savvy young people were still pretty tech-savvy compared to modern computer (= phone) users, who rarely step outside a few corporate phone apps and have even lost the concept of the file and the directory. You can't expect the same curiosity and willingness to make an effort from normies today as back in the XMPP era.
You can both appreciate Signal overall and be critical of some aspects.
What the user criticizes is due to sheer choices, which affect some users a lot; for example, numberless registration and full cloud backups can only be purchased with a Google or an Apple account, which clashes a bit with the privacy objectives.
And it's not a problem of not having the infrastructure to support other payment methods, since the donations support all the common ones, and there's now even a cryptocurrency integrated in the platform.
Disallowing and ostracizing other clients is a choice, they spent effort to enforce it (for example by adding mechanisms to recognize the official clients).
Hear hear. It’s been my observation that HN in particular has become much more combative. It’s full on like the meme where someone says “I like strawberries” and someone else complains “oh, so you hate pineapples?! They’re a fruit too, you know?! My great-grandfather ate pineapples. You’re a monster”¹. Yeah, chill, no one said anything about pineapples, stop assuming things or thinking everyone is against you. Don’t succumb to the tribalism.
¹ Unfortunately, I feel I must point out that I’m (I hope obviously) exaggerating for comedic effect.
What really disturbs me as I’m watching myself engage it more frequently. I’ve left other sites because I didn’t like the side of me that came out. Feeling a little bit like that these days here.
Signal is not good for normies: compare sending a message with Signal to WhatsApp. Didn’t go through? WhatsApp will try try try to resend. Signal tries far less then shows the dreaded red exclamation point. Not great while travelling or with poor reception.
I spend about half of every year traveling the mountains and deserts of the world, often ones with poor infrastructure. I use Signal more than any other messenger app, and I have never had the deliverability issues you complain about; messages do all get through eventually.
Signal hates anyone who even thinks about using this IM app as the de-facto IM app, or with more than that one person who also tries Singal as an annual ritual in your friend circle. I tried to use the app again after a year or so. Gave it full contact permission and it wasn't able to pick friends who are alreasy on Signal. I was not even able to send them messages using the number. But a friend was able to send it a message to me. After 2-3 days finally the app started showing friend's name that's in contact. Tut there were scary warnings (I know, I know that's for my safery). The whole UX just feels at odd with anything and everything I've used. They manage to look and feel worse than WhatsApp of today and that I'd say is an achievement.
Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.
But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
So that means your messages are all there, on your device, running open-source software, and yet you cannot get them.
This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"?
(I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.)
So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it.
Makes me wonder:
Does this mean users suffering this need to GDPR-request their data out from Signal?
> Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
This is not something exclusive to iOS; Android does the same thing.
Something doesn't connect here. I have a workout tracker app I use, and while I can't access the sandbox from the outside, the app has a feature to import/export workout history and it lets me dump a sqlite db copy via iOS share sheets just fine.
I'm not sure about Signal, but I had a similar issue with another app, a SQLite db inaccessible. I found that you could take a computer-based full backup and then there are various 3rd party tools that will poke through that backup for whatever "hidden" app data you need. One I previously used is iMazing, but I'm sure there are free open source ones as well.
To be sure this would mean Apple has to allow for 3p installs that have self signing keys that can let one gain visibility into the data of the app(in this case its in the sandboxes), yeah?
An owner of a device in physical possession of it and with the knowledge of all keys and passwords involved, they should be able to get all their personal data stored on it out of it, yes I think so, no matter who signs what on whatever app store.
The whole point of signal is that they cannot provide you with your data - they do not store it.
Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.
I also would like it to have stable supported libraries. But this doesn't seem to be a focus. It's a pitty, we have a Foss solution and it's hard to integrate with it....
> Sometimes I get the feeling that Signal hates users
one would think this is a well known fact already after the PIN nag screen forcing users to use PIN or have half of the screen blocked (at that time we left with family and never returned back) or removal of SMS feature, which would be only reason why to keep Signal in the phone for those few people who use it since you could use it at least to receive SMS
TBH Firefox devs are not much better, I remember waiting years and years for pull down to refresh while they kept playing with features nobody asked for (on related note Vivaldi for Android supports already extensions) or Proton Mail devs requiring Android 10 minimum to install the app, while all other clients (Nine Mail, Gmail, etc) are fine with older Android (I mention it because I was setting up old extremely locked phone for my kid recently, I have A16)
I've used F-Droid for years. It's simple, has good apps that aren't full of ads, just works. PGP... sucks a lot, I never really got along with it. Maybe an age thing, but hardly anyone I've met uses PGP/GPG. Yet I have many friends/family on Matrix.
2 years ago when I got a new phone, I had to re-register in both WhatsApp and Signal.
Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.
This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.
I’m pretty sure it’s for security reasons, it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor. It’s hand holding yes but it’s a trade off in favor of non-technical users.
I understand you’re being a bit overdramatic to make a point, but no, Signal and Facebook messenger are not the same levels of secure for the user. That’s not the same as “trust them wholly,” but surely you understand they are on very different ends of the spectrum.
I have been a signal user from very early on, converted most of my family and quite a few friends. I did use Molly to register my second phone (just found I can do that with signal now, so uninstalled Molly and installed signal).I have the impression that the calling experience significantly degraded over the last year, i.e. calls just not ringing at the other end, sometimes even not showing as missed calls, Video calls being very low quality even though both ends are on high quality connections (and switching to other apps yields high quality). Just yesterday I was standing in a queue inside and a friend was outside. We both tried to call each other but the call was just giving ringtone without ringing on the other end. It's become so bad that I'm now considering setting up my own matrix server and transition to that.
Anyone else experiencing the same? I have been wondering if it might have been me using molly, so will test now after going back to signal for second device.
Now should be quite a good time to set up a Matrix server fwiw; we are finally at the tail-end of the journey to Matrix 2.0 (instant sync; auth via OAuth; native multiparty e2ee calling; encryption which operates invisibly). https://matrix.org/blog/2026/10/30/this-week-in-matrix-2026-... gives an overview of where things are at. I'm biased, but by far the easiest and most robust way to run a Matrix stack should be https://github.com/element-hq/ess-helm#ess-community.
As someone that follows This Week In Matrix, is there likely to be a major shuffle in the next few weeks regarding calling configuration for self-hosting? I see that there is work being done, thoug I'm not sure how much that will affect server operators
no, there shouldn't be; MatrixRTC calling has finally (after only 5 years of iteration :) stabilised. The biggest change is renaming the APIs from unstable to stable URL prefixes, but this should be invisible.
It explains perfectly why Signal does not want third-party clients.
To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't.
Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally put E2EE on the map!
Signal has a threat model, and they do the best app they can addressing that threat model. Which means that they cannot accept third-party clients or federation. They don't say "you cannot use XMPP or SimpleX or Matrix on the side", they just say "we provide this, if you benefit from it, use it for free".
Still, there is a very vocal minority that takes every opportunity they take to explain how "insane" that is, and how they "cannot imagine how anyone with some kind of intelligence wouldn't be revolted". I believe it is the same posture as those complaining about Android or GrapheneOS not giving root access ("even in the advanced settings"). The fact is that if you want root access on your phone, you should install a system that gives you root access, and not select a system that does not and then complain.
Signal is great at what it does. It's okay to also want something else while acknowledging that Signal is great at what it does.
Under Signal's original leadership, there was definitely a hard stance against third party clients connecting to the network. I think they've been quiet on third party clients since Moxie left.
You can totally fork their projects! You just can't call yours "Signal" (trademark I guess?) and you can't connect to their servers. Molly seems to be tolerated, somehow? Maybe because it is niche.
But clearly connecting to the Signal servers with an outdated, modified fork is against Signal's goal.
They can give you the right to reuse their source code for building your own service using your own network (an aspire to give you this right), but still forbid you to connect to their service on their network with third party clients.
In practice, they don't seem to enforce that a lot (anymore).
Network-connected application developers have as a community, desensitized me to this. They are the Boy Who Cried Wolf. Continuous mandatory updates in the name of security. Guilting you into thinking each update is critical due to "security".
I don't care. It's a hassle, and I don't believe the threats they warn of are something to warrant my attention in the landscape of things I should worry about in my life. Anecdotes don't help. To overload with another analogy: Security is a "think of the children" or "full stop": it's a thought-terminating cliche, and I don't believe people who use it.
The incorporated 501c3 named Signal is, in IT terms, a vendor. Is it not?
The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are rare.
Suppose you configured an instance of the Signal server software and others you know ran also a somewhat modified Signal client that could access that instance of the Signal server software.
But the centralized namespace of the hosted Signal service hosted by the incorporated 501c3 named Signal would not be accessible through that server instance now would it.
And, as dictated by the incorporated vendor of the centralized namespace, and other reasons, in practice, this client would have to run as a separate piece of software. "Another app".
This is vendor lock-in.
The service hosted by the 501c3 named Signal seems widely open yet is a permissioned namespace. A physical location tracking number aka phone number or a credit/debit card is required to access the namespace. This is for slaves. The profane.
Open Signal on your phone to keep your account active
This vendor is abusive.
And, I don't think this is what Moxie wanted.
Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.
> Moxie knows about everything I’ve said in this article. He’s a very smart guy and I am under no illusions that he doesn’t understand everything I’ve put forth. I don’t think that Moxie makes these choices because he thinks they’re the right thing to do. [...] Moxie can’t come out and say it openly, but he’s made the decisions he has made because they serve his own interests.
And it looks like it's working. The Signal social network is growing. Revenue is growing (revenue pays for ongoing maintenance). Alternative servers are not sapping user metrics. It's still easy to push both security fixes and eye-catching new features because one central server, and client upgrades are aggressively pushed. Spam is not a plague because registration remains expensive - you need a genuine phone number you control, or Google to vouch for you (who in turn have their own robust defences against account creation).
If it was a free sign up where you just need an IP address to play, spammers would have hundreds of millions of accounts and you'd get as much nuisance friend requests as you get email spam. Most people would leave. You've seen the scraperpocalypse, every sketchy person on the planet has money to fund a million sign ups each from a unique US residential IP (thanks to "smart" TV vendor neglect/corruption allowing residential proxies), IP reputation is worthless.
Personal instances of Signal would hide until spammers found them but you'd better have your own locked down registration because you can't hide forever. Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting, moreso than using Signal's centralised services.
You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted?
A self-described anarchist who described the original cypherpunks as his teenage heroes?
When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk?
That is just crazy, man.
In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends and colleagues already on top of pure Internet Protocol, is on its face absurd.
_
> Spam is not a plague because registration remains expensive
The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this.
The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace.
Very simple concept.
Simple enough for a mediocre dev to implement without an LLM.
The spectre of spam does not justify the demand for "checking in" with your local PSTN tower, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved.
The spectre of spam does not justify any of this horse shit.
"Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal.
The new, grossly degenerated Scope of Choice.
Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them.
Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible.
An invite token personally sent by Alice or read aloud by Alice to Bob, is not.
But if somebody wants to harass a specific user on Signal, that's relatively cheap to do.
_
> Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting
Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server.
On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not.
Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users.
_
> Alternative servers are not sapping user metrics.
This imperative is not the users' problem and runs counter to the best interests of the users.
_
> Its tradeoffs all the way down.
Right. In Matthew's view, the horse shit is a tradeoff.
I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
You should definitely avoid Session. While its decentralized nature is a positive, the developers have implemented many features insecurely and have also removed forward secrecy. There are blog posts by a cryptography expert on this topic: https://soatok.blog/2025/01/14/dont-use-session-signal-fork/
Moxie as far as I know is still involved in the project and is the source of decisions such as requiring a phone number. My understanding is he is leaning hard on "encryption for anyone and everyone" over all other considerations such as decentralization.
A common criticism is "huh, not very anarchist of him!" Which, maybe? If decisions like that can get Signal into as many hands as possible, and if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date, I think that's an improvement in material conditions.
Your bio has a pretty frank indication of the maximally decentralized, encrypted alternative, and how user hostile that still is:
> If you want to DM, I am generally open to chat. Generate a https://SimpleX.chat invite and paste it into a file simplex-invite.txt, then run the commands below and include pasted contents of DM.txt in one of your comments in any thread we're both participating in.
This was my main reason to use Molly over Signal.
https://aboutsignal.com/news/signal-allows-iphones-to-be-lin...
But, apparently Android is also supported: https://aboutsignal.com/news/signal-allows-android-phones-to...
So glad they finally added this!
I’ve been using Beeper to keep using Signal on my older iPhone when I upgraded.
[1] https://signal.org/android/apk/
When you say "Each user can choose a different notification service" you aren't enhancing privacy you are standing out.
When you say "Each group of users can have their own servers" you aren't enhancing privacy you are standing out.
So yeah, it's only for "total normies" in the sense that if you insist on standing out from those "total normies" that's a problem.
Signal is taking advantage of the inherent camouflage of crowds, once you insist on standing out that's gone and you can't get it back.
Install vanilla LineageOS or GrapheneOS with no GApps. Then install Signal from https://signal.org/android/apk/
I bought a PinePhone, so I definitely know what truly unoptimized battery life looks like, lol.
Unified Push, which works flawlessly on Molly, could easily be implemented in the regular client.
Signal works without GMS or any alternative, at the cost of more phone wakeups. This is much more preferable to everyone whose WiFi or data service you use see you connect to "push.myownname.com", or for you to rely in some rando gatekeeping your message delivery.
Mozilla has one. Hell, Signal _themselves_ could host a UnifiedPush server. Not an excuse to say 'you use Google or our app uses 10x the battery'.
They intentionally store very little data about their users but their "mailbox" model explicitly means that the server (or an attacker) can figure out who is talking to whom. And that's fine! Signal isn't trying to be an anonymity network, so while stuff like sealed sender are nice features it's important to remember that anonymity breaks are explicitly not part of the Signal threat model.
"Don't stand out" only makes sense as advice for anonymity tools to avoid bifurcating the anonymity set -- it doesn't make much sense when you're taking about a service which links your account to your phone number and thus every server request is explicitly identifying you.
You're also hedging against mandated government backdoors.
A single organisation like signal can easily compelled to add a backdoor (or leave the territory) like the EU is trying to do. Going after thousands of servers individually is a whole different problem.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
https://en.wikipedia.org/wiki/Code_as_speech goes into this in more detail and mentions https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... where the defense was used.
That said, I would like all users to look degoogled.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
How could it build a social graph? I think most messages are P2P unless the user activates relaying?
> In order to turn the address book on a device into a social graph for Signal, the Signal client needs to be able to determine which of the device’s contacts are Signal users. [...] The obvious problem with this method is that the hash of a user identifier can almost always be inverted.
Src.: https://signal.org/blog/private-contact-discovery/
FWIW I wouldn't know why to message someone if I didn't know who they were. The same goes for them not knowing who I am. What would we even talk about?
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
The only valid reason to be against an optional feature is the maintenance burden, I don't think it's too much here but I also can't speak for the Signal team.
For security and privacy to really win out and raise the bar, it has to be able to happen in the background without the user even realizing it.
Making an app for enthusiasts is fine but Signal is going to remain niche if they can't make it more of an open ecosystem.
No it's the other way around. Signal is explicitly designed for normies, which is why so many people use it. I doubt they sat around and thought of ways to screw certain users.
>Just as they could easily offer a Google free version
Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
That said I also wish they had a degoogled version.
I'd take an untested version over nothing, anyhow.
And I'm not sure that the current version undergoes that much testing, bugs are not very rare.
> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.
It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.
The donation to Signal and VC investment are very different things: Donations to Signal are for operating costs. VCs invest for the purpose of enabling and owning a share of exponential growth to 'unicorn' status.
> unicorn
Unicorns are billion dollar companies that are rapidly growing. Signal isn't close to that.
Putting them on Signal requires me to convince them to download an app from the play store, with thr same name. The app is very similar to messenger or whatsapp and they're used to the functionality already. So many of my friends made an account so we can talk.
Anything more involved and they stay on meta's garden. Any successful messaging app needs to prioritize "normies" to get users.
It's not that they are not capable of figuring out something more complex. It's that it's hard to convince non-tech savvy friends to switch apps and it becomes much harder if the alternative needs setup or feels unfamiliar .
Today, I discussed my father's health condition with my family. Signal worked smoothly (even for my aging mother!), and it's free and secure.
Over the past five years, I have donated $500 to the foundation in total. I hope they continue to maintain the app into the far future.
What the user criticizes is due to sheer choices, which affect some users a lot; for example, numberless registration and full cloud backups can only be purchased with a Google or an Apple account, which clashes a bit with the privacy objectives.
And it's not a problem of not having the infrastructure to support other payment methods, since the donations support all the common ones, and there's now even a cryptocurrency integrated in the platform.
Disallowing and ostracizing other clients is a choice, they spent effort to enforce it (for example by adding mechanisms to recognize the official clients).
¹ Unfortunately, I feel I must point out that I’m (I hope obviously) exaggerating for comedic effect.
https://github.com/signalapp/Signal-iOS/issues/5813
Interestingly here, the sqlite DB would be trivially fixable, and messages restorable, with the `sqlite3` CLI.
But there's no way to get at that sqlite DB file. Even if you change Signal's code to add a feature to export the DB, it apparently cannot see your DB, because iOS sandboxes that so that it is only visible to Signal builds signed with the Signal developers' keys.
So that means your messages are all there, on your device, running open-source software, and yet you cannot get them.
This cannot have been the intention of Signal being Free Software. Where is "change it to make it do what you wish (freedom 1)"?
(I do not use iOS myself but have friends suffering this issue. Everybody involved is programmers and yet we seem to be able to do nothing about it.)
So it seems that even though the messages are on the user's device, it really is the Signal developers who "own" that data, and have the exclusive and ultimate control over it.
Makes me wonder:
Does this mean users suffering this need to GDPR-request their data out from Signal?
This is not something exclusive to iOS; Android does the same thing.
If yes, that's exactly what the users in the linked bug report are asking Signal to add to be able to fix this problem themselves.
Copy the backup off your phone and use https://github.com/bepaald/signalbackup-tools to extract everything.
Best of luck!
It seems to me like the app itself should be able to perform this operation and restore data? Why is this not just fixed in the app?
Which is all well; after all nobody is paying them to do it.
My complaint is that they + iOS simultaneously prevent able users from fixing it themselves, or paying somebody to fix it.
Further, I have been frustrated with similar design decisions with Signal - but how can they ensure you can export your messages without allowing letter agencies to do the same? Falling back on platform security guarantees is a rather good choice in terms of the economics - Signal need not gatekeep access to their private data - it is android and iOS that do the heavy lifting there. I’d love to move my messages between devices and sims - but I understand why that is not feasible for now.
one would think this is a well known fact already after the PIN nag screen forcing users to use PIN or have half of the screen blocked (at that time we left with family and never returned back) or removal of SMS feature, which would be only reason why to keep Signal in the phone for those few people who use it since you could use it at least to receive SMS
TBH Firefox devs are not much better, I remember waiting years and years for pull down to refresh while they kept playing with features nobody asked for (on related note Vivaldi for Android supports already extensions) or Proton Mail devs requiring Android 10 minimum to install the app, while all other clients (Nine Mail, Gmail, etc) are fine with older Android (I mention it because I was setting up old extremely locked phone for my kid recently, I have A16)
Non-normies can continue to use PGP like they always have.
/s second paragraph.
As it stands it's a proprietary app with a lot o marketing to convince me otherwise.
Both send you a code over SMS. I hate giving apps SMS access, so I refuse SMS intercept permission when an app asks for it, and instead I manually enter the received code in the app.
This was possible in WhatsApp, but was not possible in Signal. It won't allow you. You must give it SMS access to read the code. So much for privacy/security/... Only app I use which didn't allow me to manually enter the SMS code.
Signal always has excuses, "we can't add usernames because we don't know how to make them secure"
But if they sent you the code, even if a third party actor could somehow see it and hand it to you instead -- so what? What's the difference?
Why would I give any app permission to read my messages, no matter how secure it claims to be?
It’s security!
Anyone else experiencing the same? I have been wondering if it might have been me using molly, so will test now after going back to signal for second device.
Signal got an update yesterday and when I saw the notification I couldn't remember the last time Molly was updated...
To the haters: I am not saying that it is perfect, in an ideal world we could have secure third-party clients. I am just saying that it is pragmatic: in our world, we don't.
Signal has forever been a pragmatic approach to private messaging, and it succeeded at that: Signal literally put E2EE on the map!
Signal has a threat model, and they do the best app they can addressing that threat model. Which means that they cannot accept third-party clients or federation. They don't say "you cannot use XMPP or SimpleX or Matrix on the side", they just say "we provide this, if you benefit from it, use it for free".
Still, there is a very vocal minority that takes every opportunity they take to explain how "insane" that is, and how they "cannot imagine how anyone with some kind of intelligence wouldn't be revolted". I believe it is the same posture as those complaining about Android or GrapheneOS not giving root access ("even in the advanced settings"). The fact is that if you want root access on your phone, you should install a system that gives you root access, and not select a system that does not and then complain.
Signal is great at what it does. It's okay to also want something else while acknowledging that Signal is great at what it does.
Their open source code is permissive of commercial forks.
Like, if their goal was to block third-party clients, then they would look more like Facebook or Reddit
But clearly connecting to the Signal servers with an outdated, modified fork is against Signal's goal.
They can give you the right to reuse their source code for building your own service using your own network (an aspire to give you this right), but still forbid you to connect to their service on their network with third party clients.
In practice, they don't seem to enforce that a lot (anymore).
I don't care. It's a hassle, and I don't believe the threats they warn of are something to warrant my attention in the landscape of things I should worry about in my life. Anecdotes don't help. To overload with another analogy: Security is a "think of the children" or "full stop": it's a thought-terminating cliche, and I don't believe people who use it.
The Signal client software is open source and some of the clients have reproducible builds. The Signal server software is open source, though has a history of being over a year out of date at some points. Other deployments of this server software for production use are rare.
Suppose you configured an instance of the Signal server software and others you know ran also a somewhat modified Signal client that could access that instance of the Signal server software.
But the centralized namespace of the hosted Signal service hosted by the incorporated 501c3 named Signal would not be accessible through that server instance now would it.
And, as dictated by the incorporated vendor of the centralized namespace, and other reasons, in practice, this client would have to run as a separate piece of software. "Another app".
This is vendor lock-in.
The service hosted by the 501c3 named Signal seems widely open yet is a permissioned namespace. A physical location tracking number aka phone number or a credit/debit card is required to access the namespace. This is for slaves. The profane.
This vendor is abusive.And, I don't think this is what Moxie wanted.
Signal 501c3 is a centralized service. XMPP and Matrix are decentralized/federated. SimpleX is distributed.
I think this is exactly what he wanted, as these were the complaints levelled against the service when he was still in charge.
From 2018: https://drewdevault.com/blog/Signal/
> Moxie knows about everything I’ve said in this article. He’s a very smart guy and I am under no illusions that he doesn’t understand everything I’ve put forth. I don’t think that Moxie makes these choices because he thinks they’re the right thing to do. [...] Moxie can’t come out and say it openly, but he’s made the decisions he has made because they serve his own interests.
And it looks like it's working. The Signal social network is growing. Revenue is growing (revenue pays for ongoing maintenance). Alternative servers are not sapping user metrics. It's still easy to push both security fixes and eye-catching new features because one central server, and client upgrades are aggressively pushed. Spam is not a plague because registration remains expensive - you need a genuine phone number you control, or Google to vouch for you (who in turn have their own robust defences against account creation).
If it was a free sign up where you just need an IP address to play, spammers would have hundreds of millions of accounts and you'd get as much nuisance friend requests as you get email spam. Most people would leave. You've seen the scraperpocalypse, every sketchy person on the planet has money to fund a million sign ups each from a unique US residential IP (thanks to "smart" TV vendor neglect/corruption allowing residential proxies), IP reputation is worthless.
Personal instances of Signal would hide until spammers found them but you'd better have your own locked down registration because you can't hide forever. Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting, moreso than using Signal's centralised services.
Its tradeoffs all the way down.
> I think this is exactly what he wanted
You think, users should be required to carry a cell phone or make use of a debit card or credit card, in order to message another user, is exactly, what Matthew wanted?
A self-described anarchist who described the original cypherpunks as his teenage heroes?
When XMPP+OTR had already been, among competent people, the prevalent norm for over half a decade when he gave that DEF CON 18 talk?
That is just crazy, man.
In that DEF CON 18 talk, Moxie talked about scope of choice and how the scope of choice changed to "do I want to carry a cell phone, or not?". A notion that Matthew's dream was to impose on the world a demand to carry a cell phone or a debit/credit card transaction on others, such a tax, to enjoy what he and his friends and colleagues already on top of pure Internet Protocol, is on its face absurd.
_
> Spam is not a plague because registration remains expensive
The issue of spam is fully mitigated with an invite token, a 16 byte string ; "is", not "can be", because other systems in production have already been doing this.
The way it works is simple. If Alice wants to receive a message from Bob, Alice can share a connection string username+token to Bob. Then Bob can message Alice and for that time not other users of the hosted centralized namespace.
Very simple concept.
Simple enough for a mediocre dev to implement without an LLM.
The spectre of spam does not justify the demand for "checking in" with your local PSTN tower, nor the friction involved with an uninvolved and unwanted third party named Google (love Google overall but this is such a bastardly and disgusting concept), nor does it justify demanding a debit/credit card transaction become involved.
The spectre of spam does not justify any of this horse shit.
"Hey Bob, here is my username to message me, provided you subject yourself to this horse shit", where such horse shit antithetical in a fundamental way to the values espoused founder of Signal.
The new, grossly degenerated Scope of Choice.
Perhaps some who call themselves "hackers" or software developers may have been actually fooled by this false spectre of spam. I was never among them.
Even worse, the phone numbers, Google Play accounts, debit cards and credit cards, these are cheap. Among the scammer underworld these are a plenty and fungible.
An invite token personally sent by Alice or read aloud by Alice to Bob, is not.
But if somebody wants to harass a specific user on Signal, that's relatively cheap to do.
_
> Not to mention that sending ongoing traffic to your own server tells everyone where and when you're posting
Uncle Jeff, AWS, who doesn't tell exactly everyone but a lot of people, not excluding ICE at any given time, knows when you are posting, from where, and to what other users. The last of which is specifically obviated by a separate namespace hosted on a separate server.
On the occasions I have run Signal's server software, I and other users did mitigate these concerns. We do appreciate that others also have these means, or not.
Another messaging system, you may have already read its name actually, has already solved these problems in a way that they are successfully mitigated in a wholly transparent way for casual users.
_
> Alternative servers are not sapping user metrics.
This imperative is not the users' problem and runs counter to the best interests of the users.
_
> Its tradeoffs all the way down.
Right. In Matthew's view, the horse shit is a tradeoff.
I believe there are other tradeoffs available that are ethical, not more ethical, but ethical, and carry much less technical complexity.
Session is a decentralized Signal fork that creates the account on the device without associating it with a phone number.
https://getsession.org/
See also maqp2's comment here regarding Simplex:
https://web.archive.org/web/20250302182017/https://reddit.co...
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
Moxie as far as I know is still involved in the project and is the source of decisions such as requiring a phone number. My understanding is he is leaning hard on "encryption for anyone and everyone" over all other considerations such as decentralization.
A common criticism is "huh, not very anarchist of him!" Which, maybe? If decisions like that can get Signal into as many hands as possible, and if Signal can continue to operate in such a way as to have basically nothing to offer governments that demand data other than account join date, I think that's an improvement in material conditions.
Your bio has a pretty frank indication of the maximally decentralized, encrypted alternative, and how user hostile that still is:
> If you want to DM, I am generally open to chat. Generate a https://SimpleX.chat invite and paste it into a file simplex-invite.txt, then run the commands below and include pasted contents of DM.txt in one of your comments in any thread we're both participating in.