[pepijndevos]

I really want Signal to succeed. Or rather, I want anything that has decent cryto and is not FAANG to succeed.

The problem is not which messaging app I want to use, it's which messaging app my friends are using.

That said, if I had to choose, I think Matrix has a slight edge in my books because it's a protocol rather than a silo. Even though Signal is private and open source, they are hostile towards people running their own Signal builds on company servers, and unwilling to federate with other servers.

Essentially, you run the official Signal app on the official Signal servers, or GTFO.

[eipi-1]

They provide good reasons for doing so [1]. I share your hope that "anything that has decent cryto and is not FAANG" will succeed and I would prefer it to be a federated system but I also see what moxie describes in the article. Basically federation only works on a lowest common denominator. This means progress is very slow or impossible. Comparing the current state of the Matrix ecosystem and Signal I find it a lot easier to convince friends and family to join Signal. After all, that is what makes a messenger useful.

Anyway I wish both projects the best of luck.

[1] https://signal.org/blog/the-ecosystem-is-moving/

[tptacek]

Matrix and Signal aren't comparable from a security perspective. Because Matrix is a protocol rather than a silo, many (most?) of its implementations don't even support E2E, and because Matrix has its roots in an ecosystem where E2E was a nonstandard add-on, Matrix will never be as safe as Wire or Signal.

[Arathorn]

Matrix project lead here; fwiw we’re aiming to turn on E2E by default for private rooms by end of Jan. It’s not really a non-standard add-on; it’s in the core of the protocol and has been designed for from the outset. It’s a pain in the ass to get right in a decentralised world though, hence the delay in forcing it on for everyone.

p.s. support for ephemeral msgs was released on the server in RC yesterday.

[tptacek]

The way these conversations are structured, I'm always going to come across like I'm rooting for Matrix to fail, which is not at all the case. Like I said, I use Slack more than any other group messaging system, and while Slack does have some security assets that Matrix lacks, nobody can say that it has a more coherent encryption story. I wish Matrix all the best; I just don't think it's reasonable to suggest it as an alternative for people who need secure messaging that reliably works in groups of people.

[e12e]

Never seems a bit strong? Surely over the next decades we could have a Matrix 2.0 that is still federated, but mandates e2e (especially with Signal doing some of the research)?

[comex]

True. On the other hand, there are some aspects in which Signal will never be as safe as Matrix. The big one is SMS verification. If someone loses their keys and has to reauthenticate over SMS, Signal notifies their conversation partners, but legitimate users do this all the time (in part because Signal lacks good key migration mechanisms), so said partners usually don’t see this as suspicious and often don’t bother reverifying the user’s identity. On Matrix’s side, I’m not sure how well it handles key migration (I don’t use it, for unrelated reasons), but it’s almost certainly less vulnerable to account theft in the first place. Matrix’s identity servers could of course be hacked or legally compromised, but they’re probably not as willing as cellular carriers are to hand over accounts to random people on request! Signal could improve its situation by getting better key migration support, but as long as it’s rooted in phone number identities, it will ‘never’ be as resistant to account theft.

Another aspect is that Matrix, if you’re technical enough, lets you set up a custom server for your secret group, which is somewhat less vulnerable to centralized metadata interception (though there are holes, like centralized mobile notification relays). Admittedly, this is mostly out of scope for Signal, which focuses on security for non-technical users.

Finally, to state the obvious, for many use cases, pseudonymity is safety. Along the lines of the “$5 wrench” XKCD, in practice the single most likely way for your secure messages to be disclosed is not through some clever protocol hack, but by their being pulled at rest from some conversation participant’s device – often with their active cooperation. Similarly, Signal’s deniability feature is cool, intentionally allowing users to forge cryptographically valid messages supposedly sent to them by others. But in practice, messages are typically leaked via screenshots, with no attempt made to detect forgery in the first place.

In such an environment, the most effective defense overall is probably self-destructing messages, which Matrix... apparently doesn’t support, but will soon. (Yikes – like I said, I don’t use it.) But in cases where the people you’re talking to don’t need to know your real identity, pseudonymity is a close second. Its weakness is that people are bad at separating identities and maintaining opsec, but it’s still better than nothing. It’s strongest in cases where you’re part of a large group (say, of protesters): this greatly increases the chance that the adversary will be able to read your messages (with a mole in the group), but also means that they probably don’t care about you personally and would prefer to go after low-hanging fruit. Or even if everyone is equally protected, it increases the amount of time they have to spend going after each person, reducing the number of people they can find.

Anyway, I don’t want to be too negative. The world is certainly better off for Signal’s existence. Maybe Signal will add non-phone-number account support someday, solving two of the issues I mentioned in one blow. Maybe it won’t, but it’ll still be useful to many people, and its continuing cryptographic research will strengthen other messengers, including ones that target use cases Signal does not.

Still, I feel like there’s some dissonance. From a cryptographer’s perspective, Signal is head and shoulders above the pack; they really know what they’re doing, to an extent that practically nobody else does. But in other areas, Signal is just okay. Not bad, often better than average, but rarely outstanding. And that includes areas that impact security, like key transfer and the other things I mentioned.

[sicco]

It seems that Signal is working on adding usernames: https://community.signalusers.org/t/signal-introducing-usern...

[comex]

Interesting. I wonder what design they'll come up with. The thread links to a tweet from Moxie from a few months ago, which (along with some other tweets in the thread) is interesting to think about:

https://twitter.com/moxie/status/1174047779267604480

In theory they could keep using the native contact list and just stuff Signal usernames in there; iOS does have the APIs to do that, and I'd assume Android too.

[mikece]

The one thing I don't like about Signal is that it's tied to a phone number. Sure, you can tie the account to a VoIP number but that's not the same as Wire which allows you to sign up with an email address and your account id based on a username, which cannot be SIM-attack hijacked.

[sdan]

This is why I think Keybase is so awesome. I've gotten some of my friends on it and so far the encryption/exploding messages and all is working great.

[vocatus_gate]

Keybase is awesome, it's really improved over the years.

[Avamander]

I have the same experience. The only chat I've managed to get people on and keep for a longer period of time - no dealbreakers so far.