Signal Blog

Signal desktop (https://signal.org/) supports screen sharing and does not have a time limit for calls: https://support.signal.org/hc/en-us/articles/360007060492-Voice-or-Vid… It's also open source: https://github.com/signalapp/Signal-Desktop Jitsu Meet (https://meet.jit.si/ with reviews elsewhere in this thread) is also great and has a web interface if you'd prefer not to install anything.

I’d recommend Signal https://www.signal.org/. I think any of these options are going to require either configuration which could be complicated, or an app download which is often simpler.

At the end, the author recommends Signal (https://signal.org/) and Threema ((https://threema.ch/en). I've never heard of Threema before, but having more viable options in this space is definitely a good thing.

They seem to have the advice slightly mixed up. It's not "revoke Samsung Messages storage permissions OR switch to another SMS app" it should be "revoke Samsumg Messages storage permissions AND switch to another SMS app" Highly recommend https://www.signal.org/ which on Android can act as your normal SMS client (as an added bonus if your contact also uses Signal there are some security enhancements)

Though I understand your points, Signal is a protocol, you can implement and build things around it the way you want. Sure you can say that WhisperSystems should enforce a secured architecture around it, but it is not their job, and I doubt Whatsapp, Messenger and Skype would be using Signal if they were forcing that. And I would definitely not say Telegram is the best tool here [1][2]. If you want something really secure, I would recommend the Signal app [3]. In the end, it is always who you decide to put your trust in. [1] https://security.stackexchange.com/questions/49782/is-telegram-secure#… [2] https://eprint.iacr.org/2015/1177.pdf [3] https://signal.org/

This is the Moxie that created Signal.[0] I'm pointing this out because people are acting like he's a bit naive. But Moxie has built a very successful company, without the need for VCs, and the tech is used by many big tech companies. Several use the signal protocol. It's a successful nonprofit building open source software. If your focus is to make large amounts of money, maybe his isn't the best advice. But if you're trying to make a high quality product, then I think it is good advice. It depends which you prioritize: profits or money. Obviously you can have both, but when push comes to shove, will you sacrifice the product for profits or will you sacrifice profits for the product? Personally, I believe as engineers our focus should be on the product. The profits are the domain of the business people. The contention we have is good, it creates balance. If engineers overly dominate products roll out too slow and only appeal to other engineers. If business people overly dominate we sell broken garbage. Neither situation is great but which side of the spectrum would you like to be on? [0] https://signal.org/ [note] sure I know it's popular to hate on Signal but let's be real, this is technical nerdy shit we're arguing over (see the too much engineering side). Not something that's actually broken

So if they are using information people freely share to social media sites as the seeds for their investigatory and enforcement actions it follows that there is a simple trick people can employ or minimize their effectiveness. https://signal.org/download/

Perhaps Signal is famous for its encryption, but what is related to handling information about yourself is handled below any expectations, and you can check this yourself by reading the following document. https://signal.org/legal/

There's a great CCC presentation by Moxie (Signal originator) on that https://www.youtube.com/watch?v=DdM-XTRyC9c ~summarized in text form https://signal.org/blog/the-ecosystem-is-moving/

Also worth mentioning that, in the time since this article was written, Signal Messenger is now post-quantum secure [1], and has always been free and actually open source. [1] https://signal.org/blog/pqxdh/

As mentioned in a comment to one of your posts, the GNUnet people have probably gone the furthest in the quest to obfuscate metadata. Unfortunately, to this day no usable messenger application has come out of this, partially because GNUnet has largely been a research project. As for applications in use today that address the metadata problem, have a look at Signal's Sealed Sender feature: https://signal.org/blog/sealed-sender/ As for recommending Telegram for secure messages, I side with the sibling comments ("Don't").

I think you'll find "distributed decision-making" is no panacea. I joined a company recovering from a distributed governance model, and the big challenge was that nobody had enough decision-making authority for the firm to change quickly and respond to the evolving outside world. Bringing a whole room to consensus is a lot tougher than getting a few people to disagree-but-commit and move on with their day. Funny enough, you even see this paradigm in secret messaging with Signal: the ecosystem is moving[0]. If you want a system that can evolve in response to external change, centralization is useful. This isn't a defense of scrum, but a voice of opposition to running businesses as distributed utopias. It sounds great on paper, but you'll be out-competed by the faster-moving entities with centralized power very quickly. [0]: https://signal.org/blog/the-ecosystem-is-moving/

>In addition, KakaoTalk does not immediately notify users if the other parties’ public key has changed... The suggested alternative (Signal) at one point changed such warnings so that that they are much easier to miss and/or ignore[1]. They are now shown in tiny light grey text and the user no longer has to acknowledge the warning at all. So not a great counterexample... It seems that these type of things go through a natural evolution. First security at the expense of usability and then later usability at the expense of security. We really need to come to terms with the hard problem of E2EE usability rather than continue to engage in this constant waffling... [1] https://signal.org/blog/verified-safety-number-updates/

Just so you know: https://grapheneos.org/ and https://signal.org/ do exist!

This is pretty fascinating. For easier reading, the Signal blog post [0] they link to is great. Both Signal and Apple went with CRYSTALS-Kyber [1] as their post-quantum algorithm. If you're interested in the math, and maybe learned at some point about how classic public key cryptography is built on the idea that it's easy to multiply two primes, but hard to factor them, and how this (or other math problems) can be used as a one-way function to make encryption hard to break, the hard math problem that backs Kyber is the "learning-with-errors" [2] problem. [0] https://signal.org/blog/pqxdh/ [1] https://pq-crystals.org/kyber/ [2] https://en.wikipedia.org/wiki/Learning_with_errors

Signal is one of the great undertakings of our time. And it's one of the last bastions of internet freedom. A free-to-use global communications platform that doesn't censor, respects user privacy from the ground-up, and is run by a non-profit foundation that is faithfully dedicated to its mission. https://signal.org/bigbrother/. We should support it. If you haven't already, then consider signing up for a recurring donation to the Signal Foundation. I try to give what I can afford, because I believe that digital freedom is essential for the progress of all humankind, https://signal.org/donate/ Without such projects, our civilization will stagnate and die in darkness.

> Metadata is specifically available "for free" (who calls/messages whom when). That's completely incorrect. Signal has only the following data (backed up by what they have provided when served warrants[1], and what internal FBI documents state about Signal[2]: Date and time a user registered. Last date of a user’s connectivity to the service. [1] https://signal.org/bigbrother/central-california-grand-jury/ [2] https://propertyofthepeople.org/document-detail/?doc-id=21114562

Hmmm ... looking around, isn't the following implemented? https://signal.org/blog/secure-value-recovery/ (It's also relevant to the OP.)

The linked page is on signalusers.org, but Signal's regular home site is https://signal.org/. I'm looking all over signal.org for some link from there to signalusers.org, as that would make me more relaxed about the authenticity of the latter -- i.e., that it really is run by the same people who run signal.org. Yes, maybe I'm being paranoid. But we're talking about an app whose whole purpose is secure communications :-).

It seems that's exactly what the community is doing. Cloudflare recently enabled post-quantum cryptography, in which they're using X25519+Kyber [0]. Similarly, Signal's post-quantum cryptography also uses the same [1]. I'm guessing this spawned from the fact that a post-quantum algorithm was broken on classical computers a few years ago [2]. So now any attacker would have to break both the classical algorithm and the post-quantum algorithm. [0] https://blog.cloudflare.com/post-quantum-to-origins/ [1] https://signal.org/blog/pqxdh/ [2] https://www.quantamagazine.org/post-quantum-cryptography-scheme-is-cra…

"Signal might be safe, but I think it's a honeypot." Based on what? Signal documents its own encryption process, and you can check the app source code to verify it. https://signal.org/docs/specifications/doubleratchet/ Signal is the best choice I know of when I'm looking for the union of 1. True e2e encryption, and 2. Ease of use by non-technical people.

This seems opposite to what their new president said last month: "From the beginning, the team behind Signal put people and their needs at the core of their commitments. They understood that iron-clad security is fairly pointless if people can’t use, access, or feel comfortable with it. In other words, if my friends won’t use a messaging app, it doesn’t work as a messaging app. It works as a thought experiment, at best. Understanding this, Signal’s developers and designers created an app that honors people’s needs and expectations, while maintaining strict privacy promises."[1] I'll echo the other comments here talking about network effects, onboarding friction, and social capital wasted convincing friends/family. [1] https://signal.org/blog/announcing-signal-president/

Terrible decision. You don't improve the average person's security posture by increasing the barrier-to-entry of encrypted messaging - and removing SMS support is doing exactly that. Signal -is- was great BECAUSE it made the transition from SMS to Signal so seamless. Aside: Funny how quickly the wheels fall off as soon as Moxie leaves. (https://signal.org/blog/new-year-new-ceo/)

Signal app : https://signal.org Signal Blog : https://signal.org/blog/ Help people in Iran reconnect to Signal – Run a Proxy – (September 22, 2022) : https://www.signal.org/blog/run-a-proxy/ Signal app Repositories @GitHub - Updated → (October 11, 2022) : https://github.com/orgs/signalapp/repositories

* dynamic HSM https://github.com/intel/ehsm * machine learning in tandem with GPUs https://azure.microsoft.com/en-us/blog/azure-confidential-computing-wi… * autonomous key management https://docs.oasis.dev/general/oasis-network/overview#privacy-first * signal contact discovery https://signal.org/blog/private-contact-discovery/ These will also work with next-gen enclave tech (mainly in the direction of total VM encryption), but those (AMD SEV, Intel TDX) aren’t as secure as SGX yet, so SGX has continued utility to applications beyond DRM.

I found great enjoyment in reading the spec for the double ratchet mechanism. So interesting. https://signal.org/docs/specifications/doubleratchet/

The Internet Archive http://archive.org Signal - http://signal.org

SMTP was there early and with significant adoption - it's not inherent stability or quality of design. Early success and adoption tends to both entrench and freeze protocols despite their deficiencies. XMPP never got the sort of adoption to make it entrenched and its deficiencies were noted far earlier in its lifecycle. Moxie Marlinspike's piece on some of this is well worth reading: https://signal.org/blog/the-ecosystem-is-moving/

Yes. For more thoughts on this, I'd recommend reading Moxie's expansion on these ideas here. https://signal.org/blog/the-ecosystem-is-moving/

Heh. Reminds me of: It's hard to remember now, but there was a period of time not long ago when "the cloud" hadn't yet become an overused catchphrase. In those heady days of yore, people used to store things themselves – usually only on one device, and uphill both ways. These were hardscrabble people, living off of whatever meager storage they could scrounge together. They’d zip things, put them on zip drives, and hope for the best. Then one day almost everyone looked up towards the metaphorical sky and made a lot of compromises. https://signal.org/blog/secure-value-recovery/