Conversation

Notices

1. Embed this notice
   varx/tech (varx@infosec.exchange)'s status on Monday, 17-Feb-2025 10:42:32 JST varx/tech

   Signal *really* doesn't like having desktop users, do they?

   Apparently the only way to get this working without a smartphone is to install their desktop app (which *does* exist—this screenshot is from before I enabled JS) but then also install a third-party tool called "signal-cli" that uses a hacked-up version of Signal to provide functionality like creating an account based on an SMS or voice call.

   It's kind of appalling. There's no reason the desktop app couldn't have this functionality. Why are Signal forcing people to use a third-party utility? It's very weird in juxtaposition to their tight central control of Signal in other ways.

   #signal #desktop

   • Embed this notice
     feld (feld@friedcheese.us)'s status on Monday, 17-Feb-2025 10:42:31 JST feld

     in reply to

     • Bob Young :verified:
     @varx @fifonetworks I've used Signal with a VOIP number before. It was originally a cell number I ported to a VOIP provider which seems to have kept its classification as a cell number somehow
   • Embed this notice
     Bob Young :verified: (fifonetworks@infosec.exchange)'s status on Monday, 17-Feb-2025 10:42:32 JST Bob Young :verified:

     in reply to

     @varx Tying every Signal account to a real phone is a smart move to reduce the number of fake accounts. Hacking around that protection mechanism is unfortunate.

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Monday, 17-Feb-2025 10:42:32 JST varx/tech

     in reply to

     • Bob Young :verified:

     @fifonetworks This method still requires a phone number. That's not the issue at hand—the problem is that Signal requires a *smart phone*, not just a phone number.

   • Embed this notice
     feld (feld@friedcheese.us)'s status on Friday, 11-Apr-2025 02:15:35 JST feld

     in reply to
     @varx Few people knew this, but with Signal Desktop you lost the privacy of sealed sender. I don't know if this is still valid. I need to reinstall and test
   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:36 JST varx/tech

     in reply to

     Let's tally up my Signal Desktop first-time experience!

     - Time spent on setup: 1 hour
     - Third-party websites trusted: 3
     - Commands executed: 30
     - Temporary files created: 5 (URLs, QR screenshots, etc.)
     - Captchas attempted: 6
     - Positive vibes towards Signal at the moment: 0

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:36 JST varx/tech

     in reply to

     I've still got this signal-cli "device" attached to my account. I wonder if this will cause problems. Does it need to periodically be synced to the server? Does it store things less securely than the official client? Is it even possible to unregister this "device", or will that break everything?

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:36 JST varx/tech

     in reply to

     The latest in my #Signal Desktop saga: An annoying little banner has appeared telling me to launch Signal on my phone.

     https://support.signal.org/hc/en-us/articles/9021007554074-Open-Signal-on-your-phone-to-keep-your-account-active

     Apparently I'll need to download a new version of signal-cli (my "phone") every month or two and access my account that way, or Signal might stop working on my laptop.

     What a load of bullshit.

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:37 JST varx/tech

     in reply to

     ...oh, no, apparently I was supposed to ignore that prompt, and instead copy a link that appears *after a delay* in that page, and then call signal-cli with that as the --captcha arg.

     This fails the first few times, maybe because timeouts?

     But finally, a text message!

     Now I call signal-cli again, but with a verify command.

     Did it work? I cannot tell.

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:37 JST varx/tech

     in reply to

     Now it's over to some random gist (https://gist.github.com/szepeviktor/2c6a19cb91c4bb561369707f22bcf413 "Signal on Windows without a smartphone" although I'm not on Windows) because this is apparently The Authoritative Guide to doing this unofficial thing.

     The guide asks you to upload a QR code to a completely unaffiliated barcode-decoding site at one point so that you can decode it. Is this safe? Who knows! Probably not!

     (I used a local program. Probably most people don't do this.)

     Now Signal Desktop is paired or whatever...

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:37 JST varx/tech

     in reply to

     Signal Desktop got stuck on this "Syncing Contacts and Groups" screen for a full minute. Wild, because I don't have any.

     And... I think I'm in?

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:38 JST varx/tech

     in reply to

     After several manual steps for installing Signal Desktop (download a keyring, install it in the system, add a repo signed by that keyring, and *then* update and install the package) I'm now onto trying to use signal-cli.

     It turns out that my options for signal-cli are:

     1. Use a newer or different operating system, because it needs a cutting-edge version of Java (JRE 21) while my OS only has version 17; or
     2. Use the native build, which requires a newer *processor*, lord only knows why.

     This is some real bullshit, Signal.

   • Embed this notice
     varx/tech (varx@infosec.exchange)'s status on Friday, 11-Apr-2025 02:15:38 JST varx/tech

     in reply to

     OK, I've got JDK 23 installed, from Oracle's download site: https://www.oracle.com/java/technologies/downloads/

     signal-cli runs, now. I can call the registration endpoint. And now it's captcha time, apparently.

     ...which involves going to some random-ass website that explains nothing but gives me a bullshit ambiguous hCaptcha that takes several tries to solve, and then tries to open a "signalcaptcha" URL in my OS.

     And now Signal Desktop shows me a QR code that I can't copy, which means I'll have to screenshot it, save that to disk, install *another* application (QtQR) to decode it, open the file, and get a sgnl:// URL.