Hacker News Reader

Comment by ktosobcy | Hacker News Reader

TBH this was my reason not to use Signal at all... same with WhatsApp super annoying linking between mobile and desktop :/

Why can't we use XMPP where you can have multiple device and accounts without required mobile phone? Oh I know - because dumb walled gardens and BigTech not liking it... it's a mirracle we got away with e-mail before they came to power :/

View on HN

Doing end-to-end cryptography is hard enough to get right. Adding multiple devices to the mix makes it even harder.

So it's an explicit trade-off, made to keep your communication safer. Signal, in general, is uncompromising about privacy and about keeping metadata out of their hands.

YMMV and it's always down to threat model... absurd ammount of information is sent via plain text email

in case of XMPP you have OMEMO which is multi device and works fine-ish (nowadays) though I would still prefer simpler OX (PGP; pefrect-forward-secrecy is an overkill IMHO for majority of people)

just means more places to get your key stolen from.

Just don't talk so nobody will steal your communications.

You can use matrix and gate everything else into it on your rpi

If you think a device with storage mechanism that can simply connect to another computer and view all your keys is safe enough for your communication needs, then it is fine, you don't need to use Signal.

People use Signal because they don't want to be compromised when they just leave their phone / laptop unattended for a couple minutes on a bus or a train. They don't want to be in a situation if one day their laptop gets computer virus and they have to assume all these accounts are compromised and have to restart their digital identity all over again.

In situations you described, everything available on said phone/laptop will be compromised, including Signal, no?

On a laptop, yes. That's why it is not a primary device and you can revoke so it won't have continued access to your messages.

On the phone, no. You need to have a few 0-day to break into Secure Enclave to get access to Signal related keys.

Account is compromised as long as it could be accessible to someone for reading, and potentially impersonation. Possibility to revoke access doesn't mean 'uncompromisable', it means 'easier mitigatable'. The real barrier here is practical restriction of access, and OS-level data encryption, and it works equally well (or equally bad) for any software, whether it's XMPP-based or it's Signal.

You know computers have TPM chips yes?

It's mostly to the device security... you can have encrypted storage on laptop just fine... making Signal/mobile like some holly grail is weird.

Besides - it's way more probable to lose train than a computer (even my laptop almost never leaves the house)

Reply on news.ycombinator.com