Conversation

Replying to

@RealSexyCyborg

I wrote twitter.com/DanielMicay/st as an overall summary of it after being blocked. Before then, I'd simply left a few replies deep in a thread. Overall, my impression is that they aren't willing to stand behind these design decisions and resort to inaccurate claims + misdirection.

Quote Tweet

I've been a user and supporter of Signal for years. I've disagreed with various design decisions, but there has always been sensible reasoning behind their decisions based on facts and logic. I only used to disagree on certain priorities and had faith in them. No longer the case.

Show this thread

1

2

Replying to

@RealSexyCyborg

Such as blaming it on Android or iOS in a way that users without deep platform knowledge won't know any better. I was already pretty put off by their response to these things before I was blocked for a couple inconvenient, legitimate questions. I still recommend using Signal...

1

3

Replying to

@RealSexyCyborg

All I want is for them to stand behind design decisions. It's fine if they disagree with me about the best way to do it. I don't expect them to change it or debate it. I don't think it's fine for them to tell people the OS prevents them from doing something that it doesn't.

1

2

Replying to

@RealSexyCyborg

As a user of the feature, I was disappointed to see them claim that the encrypted backup/restore feature on Android won't be possible anymore on Android due to Scoped Storage. The user just has to have control over where backups will go. Seems they want an excuse to remove it...

1

1

Replying to

@RealSexyCyborg

... and it's part of the excuse for moving to having a form of remote backup / sync secured via SGX by default rather than a strong key like the prior full encrypted backup/restore feature on Android. That has you write down a high entropy seed you need to restore the backup.

1

Replying to

@RealSexyCyborg

So, at least on Android you can migrate Signal across phones (or across user profiles) using this and keep all your data including the same safety numbers. It's tucked away in the settings and people don't realize they can do it. Maybe they dislike trusting users to store a seed.

1

1

Replying to

@RealSexyCyborg

They could just admit

@RealSexyCyborg

raised a legitimate concern and they changed their mind. Instead it's this mess. I previously brought up the possibility of checking the security patch level and letting users know if their device is known to be insecure. Apps can do this.

1

5

Replying to

@RealSexyCyborg

Apps shouldn't be able to do this, though.

1

1

Replying to

@RealSexyCyborg

A malicious app can figure it out by checking the code and functionality instead of the property. I don't think there's a point in pretending that the device model, patch level, etc. can be hidden from native apps. They can even just look at the libraries loaded into them, etc.

1

2

Replying to

@RealSexyCyborg

The amount of identifying information can at least be reduced. Banks etc. will misuse this sort of information.

1

Replying to

@RealSexyCyborg

For what it's worth, I'm not aware of any bank or any other app disallowing users from using their software based on the security patch level. They love to forbid using their software on a non-stock OS but they don't seem to care much about whether the OS is secure.

3:48 AM · Jan 24, 2021Twitter Web App