I don’t know if I’m opening a can of worms here, and I’m still trying to backtrack a lot of history where I was tuning everything out. I keep seeing random swipes at Signal (or the representatives (?)), and I was wondering whether they are founded or just lies.Is it another situation like Lemmy where we just “take the technology and move on”? Thanks!
Signal is great, you should use it.
Current problems with signal
Details
Means it’s vulnerable to government pressure, it’s not wrench proof
means you can’t really trust it for sensitive things, like if you were running the french government communication systems it would be foolish to use signal. Signal uses the power of Intel SGX enclaves to keep your private key safe, so your trusting Intel not to sign something bad, your trusting sgx to not have exploits, etc.
Means it’s a walled garden, and not open to self hosting.
Signal is the best main stream e2e out there, but it’s not the last one we will ever see, something will replace it
There is not „your encryption key“ because there is not only one.
The cloud backup (protected by the pin) includes the contact list, NOT your messages. Those are encrypted on device with a key that is on device and can not be recovered by anyone from the cloud.
It’s close enough, its the master key from which all other keys can be derived.
https://signal.org/blog/secure-value-recovery/
Your encryption key can be stored encrypted in the cloud. This isn’t a fundamentally bad thing, but they should allow better protection than the short pins they allowed last time I checked.