Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

(A very tiny fwiw): you /can/ create a backup in signal and use it to transfer seamlessly to a new device, without triggering new safety number checks. The user flow sucks, but it is possible.


Backups are only possible on Android, and the most recent Signal non-beta builds have had this feature broken, making backups you had useless.

Unless your willing to open a bug and be a pest for 2 weeks (and still have access to your old phone/leave it registered) I wouldn't plan on retaining your messages or keys across phones. Its a huge weak point of Signal.


Even in that case, you could only backup on device storage, had to write down (!) a huge set of numbers and manually copy files around. The whole flow is awfully terrible to any user - at least WhatsApp can sync your profile over Google Drive.

Last time my phone died, I lost all of my Signal group memberships, because the app is incapable of transfering those to a new phone without backup... and it's also incapable of doing the backup automatically. Those UX choices continiously baffle me - it's like authors didn't learn anything from the failure of PGP.


Backups are low priority for Signal, and they don't want to make security compromising choices like WhatsApp does with backing up.

It'd still be nice if the UX and reliability of restoring from backups could be improved.


Yep, I ran into this. It really soured me on signal, I definitely disabled it as my default SMS. I have a history of combined SMS and signal messages trapped on one phone. I can read them in the signal app, make backups, but not import them on a new phone.

Even if the backup works, the process is rather tricky. You have to get the backup file into a specific directory on the new phone BEFORE you open signal. There's no "import from backup option". If you mess up, you have to uninstall, then do the file copy.

There are issues like this going back years.


Hmm, that's odd. I very recently had to cycle through using four different phones (one was dying, two ended up being defective, finally got a decent one), and each time I successfully transferred all my messages to the next. I thought that just transferred your messages though, not your keys (I could be wrong there).

But it is a bit silly that you need to manually move the file from the old phone/backup location to the new one without some in-app option to do so.


This was circa 1 month ago that I had this issue, and it was fixed in the beta build of Signal Android after a few days. Moving to the beta channel doesn't really help if the old device is not avaliable anymore, as the backup is still not usable.


Since this feature came out I haven't had to change my keying with Signal in over a year. To your point, for heavy use Signal users the flow is a bit arduous. I hope that Signal can offer a continuous backup option at some point so I can just have the app incrementally backup while I'm at home to my NAS. This would solve for both the problems of unforeseen mobile phone loss as well as the level of time it takes to migrate to a new phone.

In the interest of transparency I also use Keybase for things as well. The problem I ran into with Keybase my first go-round was I lost any ability to restore my account after I hadn't used it for about 9 months. That is mostly my fault for not having more bases covered, but had I had anything notable I would have wanted access to I would have lost it at that point. As an end user I don't feel that Keybase competes in the same manner as Signal. Since I'm an Android user Signal is 100% transparent to my normal use handling both SMS/MMS and Signal messaging. Keybase isn't a drop in replacement with that in mind. I realize this isn't the norm for iPhone users. Regardless, my question is: are many people using Keybase for messaging? About half my contact list uses Signal, yet I only have ever communicated with two people via Keybase.


It does suck incredibly badly. I don't understand why either, why can't I just initiate a transfer from a different instance, get notified on the old phone and initiate an encrypted transfer between the two? Instead I have to write down a ridiculously long number and transfer the backup by myself. Last time I couldn't get it to work on my first try so I gave up and restarted from scratch.


Given that these are mobile phones, a more sensible way of transferring a secret between devices would be to display a QR code on the old device and scan it on the new one. You could even make this secure against local eavesdroppers by encrypting the data in the QR code with a key provided to the devices by the server.


That's how Keybase cross-sign a new device: By scanning a QR Code with the old dvice. That seems to be simple and safe enough.


Having actually built such functionality for a different android app, I can assure you that 'just transfer the file' is extremely difficult. Problems include Android API skew across versions, different OEM android implementations of those skewed APIs, and more!

For transferring backups from one phone to the other, I used Xender. Probably best to just transfer with an sd card, though.


I can totally believe that, but Signal already has most of the infrastructure in place to sync messages and files across devices in a secure manner. It doesn't seem to me that it should be too difficult to repurpose it to do an initial sync between two devices.


The "WhatsApp Business API" client also offers the ability to backup/restore the Signal cryptographic identity, because it would be a bad experience for end-users to see identity change notifications from businesses every time their IT person decides to fiddle with their servers.

It would be nice if this could be done on smartphone clients, but that pretty much requires leveraging some sort of "trusted key store" external to the app. (Which I'll admit may exist on some platforms, to varying levels of trust. How feasible and acceptable it is for this use case, I honestly do not know.)


on Android: Settings, Chats and media, Chat backups - Backups will be saved to external storage and encrypted with [30 decimal digit password] ... ... Other than chat message contents, it is unclear exactly what gets backed up. It defaults to saving in the Signal folder on the INTERNAL sd.

on Windows: File, Preferences, Contacts - Import all signal groups and contacts from your mobile device. ... ... It is unclear what else gets imported.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: