Hacker News Reader

Comment by jttnr | Hacker News Reader

TIL: The official Signal app can now use one account, shard over two devices.

This was my main reason to use Molly over Signal.

https://aboutsignal.com/news/signal-allows-iphones-to-be-lin...

TBH this was my reason not to use Signal at all... same with WhatsApp super annoying linking between mobile and desktop :/

Why can't we use XMPP where you can have multiple device and accounts without required mobile phone? Oh I know - because dumb walled gardens and BigTech not liking it... it's a mirracle we got away with e-mail before they came to power :/

If you think a device with storage mechanism that can simply connect to another computer and view all your keys is safe enough for your communication needs, then it is fine, you don't need to use Signal.

People use Signal because they don't want to be compromised when they just leave their phone / laptop unattended for a couple minutes on a bus or a train. They don't want to be in a situation if one day their laptop gets computer virus and they have to assume all these accounts are compromised and have to restart their digital identity all over again.

In situations you described, everything available on said phone/laptop will be compromised, including Signal, no?

On a laptop, yes. That's why it is not a primary device and you can revoke so it won't have continued access to your messages.

On the phone, no. You need to have a few 0-day to break into Secure Enclave to get access to Signal related keys.

Account is compromised as long as it could be accessible to someone for reading, and potentially impersonation. Possibility to revoke access doesn't mean 'uncompromisable', it means 'easier mitigatable'. The real barrier here is practical restriction of access, and OS-level data encryption, and it works equally well (or equally bad) for any software, whether it's XMPP-based or it's Signal.

You know computers have TPM chips yes?

It's mostly to the device security... you can have encrypted storage on laptop just fine... making Signal/mobile like some holly grail is weird.

Besides - it's way more probable to lose train than a computer (even my laptop almost never leaves the house)

Doing end-to-end cryptography is hard enough to get right. Adding multiple devices to the mix makes it even harder.

So it's an explicit trade-off, made to keep your communication safer. Signal, in general, is uncompromising about privacy and about keeping metadata out of their hands.

YMMV and it's always down to threat model... absurd ammount of information is sent via plain text email

in case of XMPP you have OMEMO which is multi device and works fine-ish (nowadays) though I would still prefer simpler OX (PGP; pefrect-forward-secrecy is an overkill IMHO for majority of people)

just means more places to get your key stolen from.

Just don't talk so nobody will steal your communications.

You can use matrix and gate everything else into it on your rpi

That article only mentions iPhones, for which Molly was never an option anyway.

But, apparently Android is also supported: https://aboutsignal.com/news/signal-allows-android-phones-to...

So glad they finally added this!

Unfortunately linked accounts don't count as primary devices so you will always have to keep the original device active or else they'll eventually delete your account.

I believe Signal last year started allowing you to backup your primary account and transfer it to a new device?

Yes but that's different than linking a device. Moving it to a new device deactivates the old one. You can only have one primary device and you must log in with it every so often or else your account gets deleted.

Wow, they have not done a good job advertising that when I needed that feature.

I’ve been using Beeper to keep using Signal on my older iPhone when I upgraded.

I have the opposite use case where I need to have two Signal accounts on a single phone. Having Molly alongside the official Signal app was always the solution, but I wish Signal would allow switching between profiles, or Android would allow arbitrary user accounts (I don't really want to add Signal to my work profile).

Beeper allows multiple accounts from various apps in one chat app FYI

I believe you can use Samsung secure folder to do something like this, I haven’t quite tried it yet though.

Android 15+ has Private Space which is basically an additional work profile but managed by the system and not a third party app.

https://support.google.com/android/answer/15341885?hl=en

Which is a massive pain to use for stuff like this, and it explicitly recommends against using it with apps that use notifications when you enable it. It shuts down constantly, like as soon as your phone locks (at least for me), and won't process push notifications until the space is opened again.

I really don't get why they don't just give you a thing to install something as many times as you want. It's insane that you still have to use these weird workarounds.

You can configure the private space to lock when: - Every time device locks (default) - 5 minutes after screen timeout - Only after device restarts

The last option would work just fine for you

Given all the commentary it's very clear you don't understand and have taken zero time to enlighten yourself on Private Spaces.

You do realize you can still create a work profile through things like Insular/Island, right?

It's insane people complain about these things when they're legitimately non-issues

I've used work profiles too. Together, that gives you a total of three installs of an app, all with strange (and different) interactions and limitations between them. All of which is quite different than you'd expect for a "let me have two of this app" feature (because it isn't one, though it's frequently propped up like it is).

Again, you're confirming that you don't understand the features. First you complain about Private Spaces locking, and now you're legitimately complaining about having to install an app twice? A) you don't and B) the segmentation is the entire point.

No... I'm saying that they don't let me install it an arbitrary number of times, and none of them are "normal" additional installs. They come with weird restrictions and extra complications that are wholly undesirable for many situations.

Those restrictions can exist too, and e.g. work profiles are obviously useful. But it's strange that we don't have an option that isn't restricted like that.

Android work profiles allow you to run multiple isolated copies in parallel - with separate address book and all. Works very well for Signal. I wish there was something similar for iOS.

There are some tools available to make management even more straightforward, like Insular, a fork of Island: https://f-droid.org/packages/com.oasisfeng.island.fdroid/

They do not support Android tablets as a second device. Molly is the only choice. It is why I stopped my annual contributions to them.

This is not true. Signal added support for linking secondary Android phone or tablet in August

Good to know, thanks. Will check.

That has been my main reason for Molly as well. Good they finally understood that people might be using more than 1 phone.

Or have a tablet. That was my main reason for using Molly.

Seems only for iPhone and seccond iPhone, the article does not mention iPadOS

you’ve been able to link an iPad as a secondary device for years

Have you managed to transfer from Molly to Signal?

Molly backups stopped working (probably due to lack of updates) and I can't seem to transfer between the two apps on the same device.

I deployed my own Matrix server for exactly this reason. Now it's too late. I'm not ever going back to Signal.

Reply on news.ycombinator.com