A communications tool must have censorship resistance (decentralization), anonymous signup without requiring a phone, and have an official way to obtain binaries signed by the community instead of by corpos that can be forced to insert backdoors.
Signal fails on every single one of these criteria and that is why we must stop recommending it to our friends and family who have a very limited tolerance for technology changes.
Choose decentralization.
Use matrix, or make something better.
@lrvick I would love to use matrix everywhere, but last time I tried, I got the dreaded "unable to decrypt message" and could not read messages from my friend anymore. That's intolerable UX :(. I've been waiting too long for matrix to get good.
Signal is centralized, but has better security and apps you actually want to use.
@vitSkalicky You would rather have a central party have control of the network and binaries to thus have total access to your messages and metadata in plain text, so long as it never has bugs?
I maybe get "unable to decrypt message" about once a month these days, as a power user, and then I just refresh and when their client is online to re-sync keys again later, it works again.
Decentralized protocols take the most time to mature and update but they are worth it, always.
@lrvick Signal is using reproducible builds, so you can verify that the binaries match the source code. And I rather have my messages properly encrypted on a centralized server than using a decentralized network that leaks my messages to hackers because of a bug.
As I said, I'm big fan of decentralized protocols (email, XMPP, Matrix) but they need to work. Matrix does not :(.
@vitSkalicky Signal disabled those reproducible builds for a year so they could work on mobilecoin secretly, and no one noticed. They also mandate you get signed binaries from google play or the app store. They can easily ship you a binary different from the reproducible one.
Also I send end to end encrypted messages to my firends and family directly and via group chats every day. It has been my exclusive personal messaging system in my circles for years.
What does not work exactly for you?
@vitSkalicky By the way the right way to do reproducible builds on mobile is to do a build and submit signed hashes to f-droid, then let the f-droid team build from source and get he same binary and sign it. Then you can verify both signatures match for the same hash confirming independent third parties built the binary.
Moxie refused to do this, claiming he won't get as good of usage tracking from open platforms as Googles surveillance capitalism driven system does.
Lance R. Vick
Vít Skalický 