Post by Ahmadova MatanatHello,
It's me again. So lots of people got different opinions about what I
first incorrectly called 'self-destructing messages' then later renamed to
'expiring messages'. With some help from Tim.
The reason for this was not to remove messages with no consent from the
receiver. The idea was more having the option to start a new thread/message
thread for expiring messages. Like today, you got the choice for a regular
Message/SMS and a Signal Message. I would like to see a third option called
for example 'Expiring Message' or something more clear to clarify. The
option to remove already received messages was never the intent.And never
aimed for regular Messages/SMS not even on Signal Messages.
I hope this makes it clearer and more sense. Please help me explain this
if you get me :-)
Best regards,
Isak Holmström
+46(0)705323820
another scenario (of self deleting messages) = another app
Email for work; Signal for crypted; land line telephone for private; self
deleting messages for emotions.
E.g. https://taptalk.me/faq
Photo messages with added text, and after youâve seen a message it is
deleted. No Snapchat crap.
Sry, my 2¢
C
I think this comment by Moxie (in relation to Signal requiring a phone
1) Make mass surveillance impossible. 2) Stop targeted attacks against
crypto nerds.
It's not that we don't find #2 laudable, but optimizing for #1 takes
precedence when we're making decisions. It's totally possible for you to
install Signal on an iPod touch with a VoIP number, for instance, but that
takes more effort than the common case we're designing for."
it's a nice breakdown, but the second part is just - wrong. it's biased
by your wish to have a feature that you want. i think it's just paranoid to
look at Message Expiry as a security feature. it's not.
it's not for a mainstream user. with Device Encyiption for storage and
End to end encryption for transfer we have all we need for an average user.
op.sec. is another story, where this feature is even more unneeded
because you need a trained user with the knowledge of her adversary. a
lawyer, journalist, activist, Ed Snowden or cheating husband would have to
send as few information by the phone as possible, delete every message
after reading or even not communicate via mobile phone at all.
i think the Message Expiry as a security feature would only benefit one
kind of user - a paranoic.
- jure
ps - i am very sorry for using some strong words but i think this idea is
ridiculous. ;)
I agree that we should seek to minimize settings. However, the important
part of my proposal is the method by which the user interacts with message
expiry settings. Whether message expiry is controlled by message count,
age, or both is largely irrelevant. Here's the logic behind how I reach
Premise: If the receiver wants to keep a copy, they will do that, even if
it requires manually transcribing it to another app.
Conclusion: There is no way for a sender to enforce that the receiver
keeps no copy. Therefore, the recipient owns the message.
Conclusion: Any feature that claims to implement "true self-destruct" is
making a false promise.
Premise: Signal should not make false promises.
**Conclusion: Signal should not implement any supposed "self-destruct"
feature. Instead, we should think about Message Expiry.**
There are two things which we value here: Security and Convenience.
Sometimes, though not always, these conflict. This is one such time.
Premise: There is no way to protect against a compromised device.
Conclusion: This feature is about minimal retention to protect against
any compromising that may happen in the future.
Premise: Many users consider the ability to read old messages to be more
valuable than the security gained from minimal storage.
Premise: If Signal implemented forced expiry, particularly without user
knowledge and permission, many of those users will uninstall the app.
Premise: Wide Adoption and friendliness to non-technical users are key
goals of Signal.
Conclusion: There must be a way to disable any expiry feature.
Premise: Users who are not security-minded will not delete old messages
on their own.*
Premise: Users will not change default settings unless prompted and given
incentive to do so.
A: Security-minded individuals who would opt IN to security features at
the cost of convenience.
B: Security-unaware individuals who would not opt out of security
features in favor of convenience.
C: Security-unaware individuals who would opt out of security features in
favor of convenience.
It is in group A's best interest for group B to use security features,
and for as many users to switch from group C to group B as possible.
Group B is the interesting group, because they will follow the defaults.
Therefore, to support group A, we should make the security feature be
opt-out rather than opt-in.
It is in group C's best interest to have the minimum interaction with
settings. Therefore, we should delay any opt-out for as long as possible.
The opt-out must be painless.
Conclusion: Message expiry should be turned on by default. This should be
a global setting that the user only must interact with once, at the latest
time at which there is still ample chance to disable it before any messages
are erased.
Either that, or accept that the convenience cost of message expiry is too
high, and abstain from implementing altogether.