Signal is finally tightening its desktop client's security by changing how it stores plain text encryption keys for the data store after downplaying the issue since 2018.

I really don’t understand why so many people like Signal. It’s an utter piece of shit in terms of UX, has questionable security practices, harvests phone numbers, and it’s located on a central server in US.

  • CCCP EnjoyerEnglish
    241·
    2 months ago

    Signal has always looked like a honeypot operation to me. Keep in mind, too that if you run a CIAware operating system, the key can be remotely pulled off of the filesystem or extracted from memory. It’s not possible to have any secure piece of software on an unsecurable OS.

  • porcupine
    8·
    2 months ago

    What else is free, open source, end-to-end encrypted, has better UX and security practices, and isn’t located on a central server in the US?

    • loathesome dongeaterAEnglish
      9·
      2 months ago

      I have zero expertise in this but xmpp is an old decentralised technology with encryption available

      • CCCP EnjoyerEnglish
        6·
        2 months ago

        You can also layer encryption on top of xmpp like omemo and openpgp

      • CCCP EnjoyerEnglish
        9·
        2 months ago

        Matrix (as a protocol) appears to be very strong end-to-end encryption and is federated/decentralized. It can do encrypted and unencrypted chats for any number of users, so it can replace discord (which is not at all private or secure) and do private 1:1 communications (which I’d say is the best use case for it). It also does not require a phone number like signal does (which is usually tied to your legal identity and can be used for geolocation).

        I wouldn’t trust any electron apps, which is the framework the official Matrix client, Element, is built on. It’s fully open-source so there are other clients out there which may be better. Of course, the biggest weakness is probably going to be the OS/firmware of device you run it on.

        Edit: The desktop element clients rely on electron (which is a webapp framework built on google chrome, which is spyware). If you’re on android, the app also renders in chrome (which is spyware), but that matters a bit less because android itself is a massive pile of spyware. iOS is also spyware that openly just copies all your files to a server in the US where they are “scanned for very bad things”, retained indefinitely and may be accessed by your favourite state agencies without warrant.

        • Muad'DibberMA
          5·
          2 months ago

          On android, element, and it’s newer version element X, are native android, not electron at least.

      • ☭ Comrade Pup Ivy 🇨🇺
        5·
        2 months ago

        Session is, fine, but the app can get really laggy at times of you are in it for a long period of time, pr especially if you scroll to an older message, this is my experience using it

      • ImnecomradeEnglish
        3·
        2 months ago

        Isn’t Signal very similar to Telegram but focused on “security” and less features? Revolt is more like Discord. Matrix feels more similar to XMPP, and I see it as a compromise between Telegram style and Discord style. Matrix works well as a one to one chat as well as a team collaboration chat, but audio and video chats are very laggy. Self-hosted Jitsi would serve as an alternative to video and audio chats.

    • porcupine
      4·
      2 months ago

      I genuinely appreciate everyone suggesting alternatives, but I’d humbly suggest that, from a normie perspective, “better UX” doesn’t involve learning how to host or locate a server. There’s a reason Reddit is still more popular than Lemmy. In my personal experience, getting a local org with some members that already had trouble using email and SMS onto Signal was difficult. Trying to get them onto an alternative that involved selecting a specific server or learning the technical details of different internet communication protocols would have been a nonstarter. I’ve gotten multiple Boomers to reliably use Signal, and they have no idea what encryption is.