Signal and Giphy

[mnx]

This is a clever way to do this, but it still seems like someone caring about their privacy should just do without gifs.

Edit: I should rephrase - I mean someone with a larger-than-usual need for privacy, someone paranoid for a reason. This is great for the typical privacy concious user. But if I was sending documents to WikiLeaks, I would not sum them up with a cute GIF.

[shalmanese]

Except that history has shown us that theoretically secure but feature deficient systems lose out to less ideologically pure systems that provide what users want, leaving the sum total amount of security provided to be less.

[finnn]

At what point has Signal ever indicated that they were targeting users that were trying to send documents to wikileaks (or require similar levels of privacy/security). They have consistently said they are trying to build a messaging app that normal people want to use over stopping targeted attacks. eg [0]

[0]: https://news.ycombinator.com/item?id=10665520

[nfrmatk]

Why should those of us who care about privacy be required to limit the media we use to express ourselves? By including this functionality Open Whisper Systems is giving the privacy conscious a way (albeit experimental) to have our cake and eat it too.

[dmvaldman]

https://twitter.com/isislovecruft/status/793796012506750977

"Lol dude, I don't know what kind of whistleblowers, dissidents, spies, and revolutionaries you're messaging but mine send all the best gifs."

[StavrosK]

Someone who wants gifs shouldn't have to compromise their privacy.

[proaralyst]

If your aim is to get more people to care about privacy, or to enable those who care about privacy to convince their friends to use a more private app, these things help.

[mobiuscog]

<facepalm.gif>

[nilved]

This is Signal jumping the shark. Why is searching gifs their responsibility? Non-essential features should be skipped there is a single shred of security concern, which we can see there is.

[raverbashing]

Good

They know that for a bigger adoption they need those usability improvements, at the same time, they make sure additional features don't compromise the security expected from their app

[Bartweiss]

I've been really impressed with Open Whisper's focus on usability and functionality. So many privacy products take the stance of "if you care about privacy, you won't want to do this", and it seriously harms uptake.

[cryptarch]

Is there a federated and/or self-hosted alternative to Signal with similar privacy and security properties? Even if it supports fewer platforms?

I've been getting more and more interested in running my own (and perhaps my friends') infrastructure, but I haven't found anything better than IRC for chat.

[sschueller]

I run a Synapse server (http://matrix.org/) which is federated and works very well. There are many clients but the nicest at the moment is Riot. Full encryption is now available in the Riot webclient and it's coming to the app soon.

[schlowmo]

> "but I haven't found anything better than IRC for chat"

If IRC was your best bet so far, you might want to have a look at good ol' XMPP aka Jabber. If you're into Android, with Conversations [0] there's a suitable client which supports end-to-end encryption. For other OS there are many other choices with different encryption options. While OTR (Off-The-Record Messaging) might be the most popular one, it unfortunately makes multi-device-support kind of a bumpy experience.

[0] https://conversations.im/

[alltakendamned]

Run an IRC server on 127.0.0.1 on a dedicated server you control and allow access over SSH only. Connect to IRC through a command line client in a tmux session or similar.

[jhasse]

What about XMPP / Jabber?

[kbart]

"For instance, if someone messages you with an invitation, you might want to write back with a message that says "I'm excited." With integrated GIF search, you could instead do a GIF search for "I'm excited" and send one of the results instead."

What? Why? Is it some kind of attempt to become a new "cool" app? Sounds totally useless function to me, but if it helps to get more users, well, maybe that's a good thing.

[ascorbic]

Why? Because lots of people like sending gifs and prefer to use messaging apps that support them. If it's totally useless to you then fine: don't use it.

[StavrosK]

It would be interesting for services to publish a public encryption key, so the signal client could encrypt the payload with that.

However, that has very limited usefulness, so I don't see it happening soon.

[Arnt]

That's more or less what TLS+pinning does. Also DNSSEC+DANE+TLS if you want to argue about that.

[wst_]

Can I, as a receiver, turn off this feature? Ex : get text messages instead of gifs.

[pliu]

I don't have an iPhone, but with the Android client at least, you can disable image auto downloading in the settings page. If you hate fun and are dead inside.

[newsignup]

We do not always search for exact phrase so the text might not convey the emotion..

[newsignup]

> The GIPHY service could use subtleties like TLS session resume or cache hits to try to correlate multiple requests as having come from the same client, even if they don't know the origin.

How would a cache hit mean same user tried to search? TLS session resume, I can understand but cache hit only means same resource was accessed not same user tried to access.

[StavrosK]

You cache a unique ID and then see if you get a hit.

[detaro]

Presumably the clients cache GIFs, maybe even search results, instead of re-fetching them every single time.

[nzp]

Great! Now that these easy, low-hanging-fruit features are taken care of, maybe we'll get some of the more involved security oriented ones, like, IDK, having an indication if I verified a contact or not so I can, you know, know whether I should verify or not when the opportunity presents itself.

[biznickman]

Now if only my friends would use the service!

[hk__2]

Reading this title I thought it was a word play on “Signal and Noise” and it’d be a post about how /giphy adds noise to Slack conversations.

[aluhut]

It makes me sad so see that they waste time on decoration like gif search but they don't have a client I can use on my PC for example.

[verroq]

I honestly don't know if this comment is serious. My girlfriend won't use Signal because it doesn't let her send stickers.

This is only a first step in the right direction.

[MichaelGG]

Or basic message reliability? There's no reason I should be getting "Bad encrypted message" so often. Or tons of repeats. And out of order messages. And random deliverability problems.

And it seems like it has a way of picking just the right time to fuck up. Right when there's a big question or when I need to say something important, bam, Signal will start being erratic. Plus the repeat messages has on at least one occasion ended up providing a totally different meaning.

I'd say with one particular contact, we exchange screenshots of Signal over MMS once a day to avoid misunderstandings.

[Vinnl]

Not perfect, but: https://whispersystems.org/blog/signal-desktop/

[droopybuns]

1) We're moving from a mobile-first to mobile-only world. This prioritization shows that the signal team are fundamentally pragmatic.

2) Most people rely on cliche to communicate. It's obvious that gifs are another cheat that is being commonly integrated by most people. It's kind of silly to avoid acknowledging the reality of how younger people are commonly communicating.

3) Please don't be sad because a software team prioritized a feature you don't like. You deserve to have more control over your own emotions. Why would you let a software feature have such a drastic impact on your own happiness?

[nibs]

I think the key thing is not to sacrifice performance for form. Add all the stickers, GIFs, bots and other fancy features you want. But never let load time get under 200ms. Lots of people talking about how this makes it more broadly applicable but Facebook didn't just beat MySpace on simplicity of use and Farmville access, they also beat them on speed and reliability. Not mutually exclusive either. Keep up the good work.

[wtbob]

I wish that they'd support secure contact sharing. And non-phone-number IDs.

[endemic]

Read this article yesterday (https://www.techinasia.com/line-dev-day), and the introduction was eye-opening. tl;dr people like that extra stuff in messaging apps.

[aluhut]

/// Wow. Woke up to not a single new comment but massive downvotes. Very mature guys.

[laluluala]

This is what Canonical did with Amazon searches on Unity, they proxified them.

[piotrjurkiewicz]

Still no desktop client?

[berdario]

The desktop app is available since almost 1 year (in closed beta at the beginning), and recently apparently it's also working with iOS

https://whispersystems.org/blog/signal-desktop/

It's also a real app[1], independent from the phone's: after the initial key exchange, you can send/receive messages even when your phone is off

[1] Compare with the Whatsapp webapp, which solves/sidesteps the E2E encryption among multiple devices conundrum by simply routing everything through the phone. The Signal app is also written with web technologies, so it might not be palatable for everyone, but it's a good compromise imho

[tdkl]

This is the main reason I've got some people on Wire instead.

[zlatan_todoric]

Oh great, they are catching up with Wire (https://wire.com/).

Now if they would just resolve real bugs (like many people not being able to register to Signal), that would be maybe cool (but as they implemented Signal Protocol to WhatsApp and others (if we can trust code we can't see) I can't say I see any point in it).

Maybe I am wrong, but it lost that appeal it had some time in past.

[MikusR]

That fake video on top is interesting. If they can't even get that right what does it say about their Privacy and Security claims?

[dsacco]

Empirically, absolutely nothing. You can't judge the security of a software based on its marketing material.