Reading List
Signal Moves Ahead on Post-Quantum Computing, But Still Sucks Ass When You Switch Phones from Daring Fireball RSS feed.
Signal Moves Ahead on Post-Quantum Computing, But Still Sucks Ass When You Switch Phones
Graeme Connell and Rolfe Schmidt, writing earlier this month on the Signal blog:
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s resilience against future quantum computing threats while maintaining our existing security guarantees of forward secrecy and post-compromise security. [...]
What does this mean for you as a Signal user? First, when it comes to your experience using the app, nothing changes. Second, because of how we’re rolling this out and mixing it in with our existing encryption, eventually all of your conversations will move to this new protocol without you needing to take any action. Third, and most importantly, this protects your communications both now and in the event that cryptographically relevant quantum computers eventually become a reality, and it allows us to maintain our existing security guarantees of forward secrecy and post-compromise security as we proactively prepare for that new world.
It is impressive that Signal is ahead of the curve on post-quantum computing. But speaking as someone who is currently switching between multiple phones regularly, they need to get their shit together on basic stuff like using more than one phone with the same Signal account, and making it take just a minute or less to switch your primary Signal phone from one device to another. Right now it takes me over 30 minutes to switch Signal from one phone to another, and I’m not a particularly heavy user of the app. Normal people don’t use Signal because it offers, by far, the worst and most limited user experience of any major messaging app. Signal is never going to get most people to even give the app a fair chance when the user experience is so much worse than Apple Messages and WhatsApp.
Again, I don’t mean to disparage the technical ingenuity of their post-quantum ratchet achievement. But they’re bragging about defenses against hypothetical threats from the future when, right now today, you still can’t use the same Signal account from two different phones.