Signal is the world’s most widely used truly private messaging app, and our cryptographic technologies provide extra layers of privacy beyond the Signal app itself. Since launching in 2013, the Signal Protocol—our end-to-end encryption technology—has become the de facto standard for private commu...
  • 👁️👄👁️@lemm.eeEnglish
    1026·
    10 个月前

    Crazy how decentralization improves both, but they are vehemently against that. I trust them in terms of privacy, but their insistence on centralization, blocking third party apps, removing SMS, and refusal to support fdroid, I’m not a fan of the direction they’ve gone recently.

        • witten@lemmy.worldEnglish
          194·
          10 个月前

          Wait. Signal was an SMS client. It wouldn’t cost them anything for a user to send an SMS message. IIRC, they nixed the SMS feature for security reasons, not cost.

          • 🤘🐺🤘@monero.townEnglish
            26·
            10 个月前

            That’s what they told me when gave then feedback through their website.

            There’s no free lunch and corporations aren’t the most trustworthy source of information though so maybe it was about cost.

              • 🤘🐺🤘@monero.townEnglish
                42·
                10 个月前

                Some nonprofit organizations are corporations and have pretty shitty practices:

                https://en.m.wikipedia.org/wiki/Kids_Wish_Network

                The Morman church is another US ‘non-profit organization’ yet somehow hordes billions.

                Trusting blindly without doing research because something is presented as a non-profit is a good way to be taken for a fool and separated from your money.

                When signal made their own cryptocurrency which they entirely premined was a huge red flag. Dropping SMS support was an annoyance that broke the camels back.

        • PlutoniumAcid@lemmy.worldEnglish
          72·
          10 个月前

          Yeah I think you are right. I too was really mad at Signal for ditching sms, and THEN having the audacity to ask for donations! This article shines a light on the reasons, wow.

          Still, I would only donate if they kept sms in there. Not without sms because now it’s just one more isolated platform and no longer a one-stop solution at it used to be.

        • Kusimulkku@lemm.eeEnglish
          2·
          10 个月前

          One reason was worry that people accidentally send SMS when they mean to send a secure message

    • InvaderDJ@lemmy.worldEnglish
      104·
      10 个月前

      Removing SMS support makes sense. The potential for a user sending something through SMS that they thought was going over Signal is high. Even for the savvier users who would install Signal in the first place.

      • 👁️👄👁️@lemm.eeEnglish
        135·
        10 个月前

        It killed adoption, since now it’s just another messaging app. Most of my contacts still use SMS, and will stay on it, so being able to use Signal was a smooth all-in-one experience. Now I have no point in keeping it installed because like 3 of my contacts use it, so it has no use to me, thus killing potential adoption.

        • teolan@lemmy.worldEnglish
          42·
          10 个月前

          They’ve never had more users.

          And if you had spent 3 minutes looking at r/Signal or the support forum before they disabled SMS you would have seen how many people were confused by the feature.

        • fkn@lemmy.worldEnglish
          43·
          10 个月前

          Exactly the opposite. Removing sms was the thing that finally made me recommend it to my friends and family. People understand sms replacements. People understand alternate messaging apps. People don’t understand encrypted sms.

          If you have people who love whatsapp, it’s super easy to get them to use signal instead.

        • jaspersgroove@lemm.eeEnglish
          25·
          10 个月前

          Perfect, that keeps you off signal and lowers their operating costs.

          Because if you actually needed signal, you’d still be using it. Security and privacy is not about convenience or a “smooth all-in-one experience”. It’s about actual security and privacy. And that is what signal provides.

    • interceder270@lemmy.worldEnglish
      116·
      10 个月前

      I mean, of course the company is against what will lose the company money.

      They’re not doing this because they care about privacy, lol.

    • Lime66@lemmy.worldEnglish
      73·
      10 个月前
      • Signal wants to be as secure as possible
      • F droid has security issues
      • It makes perfect sense to me
  • u_tamtam@programming.devOPEnglish
    907·
    10 个月前

    A more accurate title could be “Privacy is Priceless, but Centralization is Expensive”: with the era of cheap money coming to an end, grows a lot of uncertainty regarding the future of some large internet services. Signal is no exception and this emphasises the importance of federated alternatives (XMPP, fediverse, …) for the good health of the future internet.

    • Goronmon@lemmy.worldEnglish
      751·
      10 个月前

      Decentralization is expensive too judging by some of the sentiment I’ve seen around running Mastodon and Lemmy/Kbin instances.

      • BaroqueInMind@kbin.social
        20·
        10 个月前

        At some point society needs to figure out how we can subsidize the costs of data storage, remote servers, and provision of internet to people for free.

        • JustEnoughDucks@feddit.nlEnglish
          9·
          10 个月前

          The only real way to do that is government subsidized servers, but that will fall in the same category as literally every other government service: right wing political entities try to privatize it and make it as shitty and parasitic as possible.

        • Venia Silente@lemm.eeEnglish
          1·
          10 个月前

          There’s nothing to figure out, if the question is how “society” does it then the answer is literally taxes.

      • u_tamtam@programming.devOPEnglish
        31·
        10 个月前

        Yup, it has a cost, but there’s perhaps a one or two orders of magnitude cost difference between hosting instant messaging + calls with something like XMPP, and hosting mastodon/Lemmy/Kbin (or why I do the former but not the later, and why I’m ok to pay for the service, esp. considering that my instance’s business model isn’t, unlike Reddit, to re-sell influence and data).

        • Goronmon@lemmy.worldEnglish
          1·
          10 个月前

          How does does decentralization avoid the costs that Signal laid out in the blog posts?

          • u_tamtam@programming.devOPEnglish
            1·
            10 个月前

            I laid it out elsewhere in this thread, but in short, costs grow non-linearly with scale: you can run thousands of users on a RPi, but a million users requires whole datacenters. Decentralization not only helps with not requiring “whole datacenters” in the first place, they also enable maximization of resources: if you have a NAS at home, or a RPi hanging around, a router idling somewhere, or an abandoned smartphone in a drawer, you can probably host enough accounts for all the people that you’ve ever met in your life. And there are hundred of thousands of such underused devices everywhere, which, put together, would be sufficient to host the whole world multiple times around.

            The other issue is sustainability: with this centralization comes single point of failure. It’s no big deal witnessing the disappearance of one or few providers of a federated network. Accounts and data can be migrated easily. For most users, it’s invisible. Now compare this to Signal running into financial issues: you are contemplating million of users losing access to their account and their data, and having to re-bootstrap their whole social graph elsewhere. This is another level of “cost”, or price to pay, for centralization.

            • Goronmon@lemmy.worldEnglish
              11·
              10 个月前

              Who is maintaining all these “unused” devices that you will want working pretty consistently? Who is responsible for replacing hardware when it dies? Who is looking into it when someone stops receiving messages? What happens when the person hosting thousands of users just stops wanting to do it? Who migrates these accounts?

              Frankly, your argument sounds more like wishful thinking than anything practical. You’ve basically described the plan as “Magically some devices in someone’s basement will suddenly start running a messaging service, maintenance free, from now until the end of time”.

              • u_tamtam@programming.devOPEnglish
                1·
                10 个月前

                This isn’t wishful thinking, this is in defense of a model where our digital needs would be distributed at a level lower than that of the tech majors, which was commonplace before everything on the internet was so consolidated.
                I’m not saying that everyone should self-host, I’m saying that federated services could be hosted at family&friends/regional/national levels, simultaneously, and deliver a resilient service at a negligible cost. Hardware, which is very much a problem for Signal & al right now, wouldn’t be in a distributed model, and could be donated and repurposed easily. My example was perhaps a bit too extreme, but I think you get the gist of what I’m saying.

    • Avid Amoeba@lemmy.caEnglish
      301·
      10 个月前

      Decentralisation would just spread the costs over more individuals. Those individuals would have to collect contributions from their respective communities. The total amount people who would have to chip in to make the system sustainable won’t change dramatically. Decentralisation isn’t some magic wand that makes infrastructure and labor costs disappear into thin air.

      • u_tamtam@programming.devOPEnglish
        112·
        10 个月前

        Decentralisation would just spread the costs

        …the costs and the risks: let’s jump forward a few years into financing issues, at what point does Signal become a liability and start operating against their stated mission, if the alternative is that they cannot survive? We are witnessing enough contemporary examples of enshittification to know that it’s a real possibility, and that all centralized providers, but in particular the ones not charging for service, are at risk.

        Some would even argue that this has already started in the case of Signal with their crypto payments and blocking of 3rd party clients which are clearly user-hostile.

        Those individuals would have to collect contributions from their respective communities.

        Perhaps, or perhaps not. Running costs get exponential with scale. You can host 1000 users on a shoebox computer/raspberry pi, but delivering a service for millions requires datacenter-level infrastructure and tons of engineering know-how.
        Most people into self hosting or having a NAS at home can already accommodate their families, friends and more, which means millions of potential users, without the problem of trust from a single organization

    • comfydecal@infosec.pubEnglish
      63·
      10 个月前

      Have any suggestions for “normies” on iPhone and Android that aren’t Signal?

  • Poutinetown@lemmy.caEnglish
    46·
    10 个月前

    The cost of these registration services for verifying phone numbers when people first install Signal, or when they re-register on a new device, currently averages around $6 million dollars per year.

    That’s pretty crazy. Wonder which third party providers they are using. Maybe the identity verification methods we have today is due for some significant changes?

    • verysoft@kbin.social
      41·
      10 个月前

      Yeah, I wasn’t expecting that to be the bulk of their spending. Maybe they should remove the need for phone numbers now they removed SMS.

      • Poutinetown@lemmy.caEnglish
        172·
        10 个月前

        SMS is dead, so they will need to move on eventually. Most carriers are moving towards high data plans now. I mainly use it for verification, although I’d rather use more secure methods.

        • u_tamtam@programming.devOPEnglish
          81·
          10 个月前

          Well, if SMS is dead then RCS is what we get instead, and there’s no difference to us (and probably higher costs for Signal & al.)

          And there are wayyyy too many things that depend on SMS for it to be dead any time soon, too :)

          • smileyhead@discuss.tchncs.deEnglish
            3·
            10 个月前

            Also Signal cannot add RCS support, because Google Jibe servers won’t allow other app than Google Messages… And you must use them because native RCS support for Android is halted for years… And you cannot install some module with RCS support yourself because of anti-Unix monolitic Android userspace architecture…

            Man, there are so many things done wrong.

        • u_tamtam@programming.devOPEnglish
          5·
          10 个月前

          No, I think they are merely working on user ids no longer mandating to be your phone number (so that it can be pseudonymous, e.g. tja@signal instead of +xx0123456@signal), I don’t believe they hope to drop SMS verification at this point because of the spam issue getting worse otherwise

    • u_tamtam@programming.devOPEnglish
      101·
      10 个月前

      Without SMS verification, spam would be so much worse that they’ve been kind of obliged to keep it, even though it defeats/undoes most of the privacy features they like to advertise about

      • Poutinetown@lemmy.caEnglish
        131·
        10 个月前

        The article says it’s to limit spam. I don’t feel platforms like Lemmy (or the other platform) are particularly spammy though. On the other hand I get a lot more spam on Whatsapp, even though it’s phone number bound.

        Signal is pretty good in terms of limited spam, but I’m curious about the impact if they A/B test the removal and see how much spam would arise. Obviously that could only be implemented after they remove the need to add contact via phone number.

        • yanyuan@lemmy.worldEnglish
          27·
          10 个月前

          You are correct my friend, because Lemmy is for smart people like us. And a smart person like you could easily make 10k per month on the side.
          With just a small initial investment you could create a huge passive income in no time.
          Just go to shadyscamspam.com and become your own boss.

        • huginn@feddit.itEnglish
          13·
          10 个月前

          Niche communities don’t deal with spam.

          But the moment it’s big enough Lemmy will be rife with spammers and you’ll need full time moderation tools.

        • Linkerbaan@lemmy.worldEnglish
          52·
          10 个月前

          If you go to Reddit which is more popular for bots certain subs are completely filled with spam and votebots. r/worldnews is like a giant circle of pro IDF bots jerking eachother off. LSF became a shitshow too.

        • skillissuer@discuss.tchncs.deEnglish
          1·
          10 个月前

          plenty of instances have email verification and or captcha, and those that don’t get defederated (sometimes) (this already happened)

  • choroalp@programming.devEnglish
    398·
    10 个月前

    Step 1. Make it federative Step 2. Stop fucking hosting your shit on Amazon servers. Step 3. Profit

    • Kevnyon@lemmy.worldEnglish
      19·
      10 个月前

      Even if they federated (which I doubt they will do), someone would have to foot the bill for those servers. Same thing on lemmy, someone’s eating the server costs here even if it isn’t a major corporation.

  • phoneymouse@lemmy.worldEnglish
    294·
    10 个月前

    I kind of liked WhatsApp’s initial monetization model. It was free for the first year and then $1 per year after that. With 400 million users, that’s a good chunk of change. Assuming only 25% of people would pay, that’s still a good chunk of change. I think Signal should adopt something similar.

    • Scolding7300@lemmy.worldEnglish
      91·
      10 个月前

      I think just like Proton provides free services for the greater good, Signal should do something similar. Even special emojis works well IMO. They give you a badge at least

    • u_tamtam@programming.devOPEnglish
      31·
      10 个月前

      Agreed. Not ideal vs. a federation, because Signal would still be in a position of total control over the network, but with less incentive to go against its users.

  • Scolding7300@lemmy.worldEnglish
    171·
    10 个月前

    They should post a average price per user so we’ll know what’s the minimum to donate (probably 5$ which is the minimum in the app IIRC)

    • kariunai@feddit.nlEnglish
      23·
      10 个月前

      “As of January 2022, the platform had approximately 40 million monthly active users.”[0]

      In 2022 they had $30M expenses, so the cost is somewhat under $1/user/year.

      They said the minimum donation is there to reduce the viability of scammers using it to check if a stolen credit card number is valid.

      [0] https://en.wikipedia.org/wiki/Signal_Foundation

        • deur@feddit.nlEnglish
          9·
          10 个月前

          Its not about protection or even going unnoticed like the responders say. I’ve fixed unprotected payment systems on websites, the real problem is they use it to validate CC information as live. By raising the cost, you make other lower hanging fruit more appealing and keep scammers from using your service to test CC info.

          • Corkyskog@sh.itjust.worksEnglish
            13·
            10 个月前

            Is it just they know they can only charge like $800 before they get shut down and want that extra $4 for themselves? I am still trying to understand the rationale. If I had no morales and a stolen cc, why would I care if it’s a $1 or a $5 charge for validation?

            I feel like I am learning I don’t check my cc info nearly as much as other Americans…

            • pajn@lemmy.blahaj.zoneEnglish
              4·
              10 个月前

              If there’s one service where you can check stolen CC info for $1 and another one for $5 you doesn’t go with the $5 one for no reason. The $4 extra dollars doesn’t matter in itself but that other places are several times cheaper does.

              • Corkyskog@sh.itjust.worksEnglish
                11·
                10 个月前

                See I would go with the $5 one with the thought process that almost no establishment let’s you charge under $5, so if I ever saw something for less than that it would immediately be a redflag.

                • AlecSadler@lemmy.worldEnglish
                  1·
                  10 个月前

                  Half my CCs don’t let me set transaction alerts for less than $5-$10, so a $1 or less charge would never notify me, I’d have to be actively checking it every moment of every day to see it immediately.

                  And yes, I have email/text alerts when possible for every. single. charge. on my CCs at the lowest threshold possible and it has helped at least three times thus far.

        • kent_eh@lemmy.caEnglish
          7·
          10 个月前

          The point of scammers using a small value to test stolen numbers is they hope such small transactions go unnoticed for longer, allowing them a bigger time window to use and abuse the stolen card number.

          • Corkyskog@sh.itjust.worksEnglish
            16·
            10 个月前

            That just doesn’t make a lot of sense. I would question something under a dollar way more then something under $10

  • Goodie@lemmy.worldEnglish
    3124·
    10 个月前

    Ehhhh

    Signal lost a lot of my love when they removed SMS support

    • beeng@discuss.tchncs.deEnglish
      199·
      10 个月前

      Get with the times.

      Signal stands for privacy and not selling your data to be spied on and sold, and you’re STILL using SMS, spam ridden, high cost, old infrastructure, easily read, technology.

      I suppose you want email in your Signal client too?

      • KrummsHairyBalls@lemmy.caEnglish
        204·
        10 个月前

        It’s not about that. It’s about moving people over.

        You know why RCS is picking up steam? Because it’s 1 app. If the person you’re talking to has RCS, you’ll send messages via RCS. If they don’t, it’ll fall back to SMS. If RCS was a separate app from SMS, adoption would be really low.

        Older people especially don’t want to juggle 2 apps. If you get your dad on signal, and then his friend who uses SMS messages him, he’ll be back in his SMS app and won’t go back to signal, meaning the next time he messages you, or anyone else that has signal, he’ll instead just send an SMS since he’s already in the SMS app.

        Removing SMS fallback was a surefire way to kill adoption of signal.

          • KrummsHairyBalls@lemmy.caEnglish
            62·
            10 个月前

            That’s great. Most older people aren’t juggling two apps.

            I’m also not sending baby photos because fuck kids, but if I wanted to send photos, it wouldn’t be compressed over signal or WhatsApp.

              • KrummsHairyBalls@lemmy.caEnglish
                2·
                10 个月前
                • Any of the million storage options (Proton Drive, OneDrive, Gmail, Mega, etc)
                • Google Photos in full quality
                • Sending a public link that is self hosted on my NAS

                I dont use MMS, I use RCS, and even then, if I cared about quality, I am not sending it directly via any chat service as they will compress it.

    • Margot Robbie@lemm.eeEnglish
      92·
      10 个月前

      Especially when your identity on Signal is STILL only tied to a phone number, instead of a username, and there is nothing less private than actually giving out your real phone number.

      Absolutely baffling.

      • sergih@feddit.deEnglish
        7·
        10 个月前

        I heard they gonna introduce usernames for sharing your acc. but to make one u still need a phone to create an acc. which I understand.

      • miss_brainfart@lemmy.mlEnglish
        61·
        10 个月前

        Giving out a phone number harms anonymity, which is something they never claimed to give you.

        I’d like not having to use my number as much as you, but lets be angry about it for the right reasons, at least

    • voxel@sopuli.xyzEnglish
      94·
      10 个月前

      sms is useless tho?
      it’s basically a confirmation code delivery system, with some ads and spam

      • KrummsHairyBalls@lemmy.caEnglish
        94·
        10 个月前

        It’s not useless in western countries. We don’t all have our entire country communicating via Metas WhatsApp lol

        • voxel@sopuli.xyzEnglish
          2·
          10 个月前

          i live in Ukraine and I don’t know anyone who uses sms.
          also Whatsapp is not prevalent here either, basically everyone is using Telegram (or in case of older population, viber, which is installed on like 90% of devices)

          are there any countries in which sms is still used?

          • KrummsHairyBalls@lemmy.caEnglish
            21·
            10 个月前

            Yes, North America between Android and iPhone.

            I use RCS with everyone except iPhone users, which defaults to SMS.

        • onlinepersona@programming.devEnglish
          53·
          10 个月前

          Do you maybe mean USA when you say “western country”? Living in Europe, I don’t know a single person who uses SMS for communication.

          • KrummsHairyBalls@lemmy.caEnglish
            23·
            10 个月前

            Exactly.

            I also prefer not to have one of the most garbage companies apps on my phone (WhatsApp). The messages may be encrypted, but the location data and storage permissions you’re giving it aren’t.

    • Joelk111@lemmy.worldEnglish
      3·
      10 个月前

      That is dumb that they’d remove a feature, but I tried it and switched back to a dedicated texting app. The feature wasn’t full featured enough for me to want to use it.

      • laurelraven@lemmy.blahaj.zoneEnglish
        11·
        10 个月前

        Not being able to copy my SMS message history into Signal kept me from switching… Well, I might have anyway if googie didn’t make it so their app only lets you see your message history if you make it the default

    • polle@feddit.deEnglish
      53·
      10 个月前

      Lol, that was the worst feature ever. If you forgot disabling it at install, it was nearly impossible to see it’s going to be a sms or signal message. (Especially for people who aren’t tech savvy)

      • Goodie@lemmy.worldEnglish
        1·
        10 个月前

        To dislike the feature is one thing, to not understand why ithers valued it is a whole pther ball game of ignorance

    • u_tamtam@programming.devOPEnglish
      74·
      10 个月前

      XMPP

      As I wrote elsewhere in this thread, XMPP would be my preference. It just works. In fact that’s what the other messengers (at facebook, Google, …) already use, but chose to put behind a walled-garden.
      What matters is that whatever comes next (or, from the past in the case of XMPP) is federated, so no single organization has a single-handed control/monopoly over the network. Matrix and SimpleX are federated alternatives to XMPP, but I don’t see Matrix stabilizing any time soon, and SimpleX just isn’t ready yet. XMPP can offer you today an experience that’s comparable to WhatsApp/Signal/Telegram/…

      • soulfirethewolf@lemdro.idEnglish
        2·
        10 个月前

        My only problem with XMPP (and a lot of other federated protocols) is really the lack of quality clients. Most of them (especially on systems beyond Android and Linux) don’t really have that good of a UX, or their UI is kind of bland or dated.

        It’s something that I hope gets improved eventually. Because having a variety of choices doesn’t mean much if none of the choices feel particularly good.

        • u_tamtam@programming.devOPEnglish
          1·
          10 个月前

          What the other responders said (there are great clients out there, that fit mainstream and niche needs).

          Also, it is not a problem of “federated protocols” per se, but of community-led projects. On the downside it may lack consistence and direction, but on the upside you can step in and contribute feedback, tests, documentation, and why not, code :)

  • gr522x@lemmy.mlEnglish
    118·
    10 个月前

    Ended my donations to Signal after discovering they choose Google Hosting Services over open source and privacy respecting alternatives.

      • Tekchip@lemmy.worldEnglish
        1·
        10 个月前

        I will preface this with, I may be wrong, but as I understand it xmpp is just a protocol. One that, unless it’s been revised, imparts no encryption at all. Signal, and Session, are full architectures that enable all of the afrementioned features from my initial post including server and client.

        • u_tamtam@programming.devOPEnglish
          1·
          10 个月前

          Everything you might use relies on a protocol down the stack. XMPP happens to be the only one to date that is an internet standard (IETF), is extensible by design (past/present and future use-cases can be build into it, what makes it still relevant 25 years later), is federated (but not P2P, a good trade-off for mobile usage), has a diverse/multi-partite ecosystem of client and server implementers (sustainable and resilient), and is deployed successfully at scale (on billion of devices).

          unless it’s been revised, imparts no encryption

          Today’s XMPP uses the same E2EE as Signal/WhatsApp/Matrix/… XMPP had end-to-end encryption 10 years before Signal was invented

          • Tekchip@lemmy.worldEnglish
            1·
            10 个月前

            Sure, now which pre-existing piece of xmpp based software checks all the feature boxes as noted by both Signal adherents and myself regarding Session? Are you implying the lay user code their own? If that exists you could have just linked to it rather than engage in whatever this is.

            • u_tamtam@programming.devOPEnglish
              1·
              10 个月前

              Sure, now which pre-existing piece of xmpp based software checks all the feature boxes as noted by both Signal adherents and myself regarding Session?

              All of those. Essentially you would have to go out of your way looking specifically for incompatible clients.

              And “incompatible clients” is simply the natural state of any technology that’s been around long-enough. The only way Signal fends itself from this is by mandating its own client and version (and banning anything else, technically or from its ToS) which is terrible for a bunch of reasons (you must agree with Signal’s direction and whatever features they might decide to add and remove for your own good, you cannot use Signal on devices/platforms that Signal has no resources/interest to support, etc). If Session is in any way open, and assuming it ever becomes successful, it will face the same challenge (just like Matrix does).

  • onlinepersona@programming.devEnglish
    25·
    10 个月前

    20M USD for 50 employees? ~400+k per employee is nuts!

    There are European engineers working at private companies for less 20% (1/5th) of that - if even that! They aren’t worse than their American counterparts. Signal could increase their team sizes by at least 30%, maybe even 50% if they hired engineers and other employees from Europe.

    If signal paid 100k for European engineers to work on opensource software, mate, they’d have absolute no problems retaining them. I personally don’t know a single engineer earning 100k on the European mainland. Not one.

    Edit: seriously, wtf. I’m all for paying employees well and it’s great that Signal has a dedicated workforce, but 400k? I’m fine canceling my donation. My jaw is still on the floor.

    • ironeagl@sh.itjust.worksEnglish
      5·
      10 个月前

      It’s not only salaries:

      about half of Signal’s overall operating budget goes towards recruiting, compensating, and retaining the people who build and care for Signal. When benefits, HR services, taxes, recruiting, and salaries are included, this translates to around $19 million dollars per year.