Why is Molly considered better than Signal?

farbenfisch

Hi everyone, I mainly use Signal on my Pixel 9. I’ve heard and read in a few places that Molly is supposed to be more secure or basically a “better” version of Signal, but I’m not sure what that claim is based on.

Can someone explain what Molly actually does better than the official Signal app in real-world use, and what “more secure” means in this context? I’d really appreciate a clear explanation of the main differences and why someone would choose Molly over the official Signal client.

Thanks!

grayway2

farbenfisch Molly encrypts Signal database with a predefined password set by the user. Molly also clear the ram once the app is closed.

wuseman

This is up basically weekly. Did you consider searching? The advantages are straight up listed on their GitHub.

Eirikr70

Molly-FOSS also runs an alternative to Google Play notification system (UnifiedPush).

DeletedUser735

Nobody here will give you a good complete answer as it's too technical and too much to write. I see that 2/3 replies above me are already wrong. The only major difference that makes Molly "better" in this particular community is that it doesn't depend on Google services unlike Signal. That's it. If it was strictly better, the Signal team would have already integrated its features.

Xtreix

farbenfisch This is mainly because Molly consumes less battery than Signal on GrapheneOS, is available on Accrescent, which is the app store primarily recommended by the GrapheneOS project, and supports Unified Push, rather than because of these additional security features, which are always welcome.

monozygote

DeletedUser735 I see that 2/3 replies above me are already wrong. The only major difference that makes Molly "better" in this particular community is that it doesn't depend on Google services unlike Signal. That's it. If it was strictly better, the Signal team would have already integrated its features.

I had also wondered about the benefits of molly over signal.

Part about clearing RAM:

firstly is this a practical benefit? If someone can reach that far isn't it game over already?
GOS already implements clearing freed memory from applications + all app memory when app exits. At-least that's what I made of this GOS post: https://discuss.grapheneos.org/d/10462-what-information-can-forensic-tools-recover-from-an-afu-gos-phone/21
Without OS help can a JVM + GC-integrated apps truly free memory anyway? The UI layer can cache strings, buffers in multiple places, GC can copy things around behind your back and so on - none of these an app will even know about leave alone deal with it. Sure once it crosses JNI boundary over to a systems language you have more control, but isn't the game already lost by then?

I'm happy to be educated but so far it seems more gimmicky than having practical consequence.

Part about on-disk encryption:

Why? The OS already encrypts everything at rest. Unless you are sending data over the wire, further encryption isn't practically useful. Note "practically" - "heoretically everything can be shown to be useful in some way or the other.

Part about Google-services:

I run Signal got via GitHub directly and without any play services etc in the profile and get push notifications just fine. Do you mean Signal communicates with some Google-services online? Or does it use some closed source Google library and is thus sketchy?

plolock

How come Signal works just fine för me without Google services installed?

Norman

plolock it works without Google services but will start up a websocket that handles notifications. This is a very inefficient way to handle notifications and will use up a ton of battery.

You can't use Signal with the notification handling alternative UnifiedPush. Molly allows you to use it as an alternative to websocket / FCM.

Onlyfun

monozygote firstly is this a practical benefit? If someone can reach that far isn't it game over already

In general such scenario should be considered as deep shit. But imo definition of game over can still be very wide in such context and consequences of someone reaching that far will even more depend on messenger's content availability.

for the rest part I second the questions and as well would like to know !

NetRunner88

monozygote
At least these functionalities are available for other Android devices too..

Elysium

Norman This is a very inefficient way to handle notifications and will use up a ton of battery.

I do wonder if this is still correct. I use Signal with restricted battery+background data allowed, but do still get notifications in a somewhat timely manner. I usually was under the assumption that after 1 minute these apps, if unused/restricted, will turn off completely.
I do sometimes have to open Signal to get messages, but when I am on a different profile than where Signal is installed, for some reason I get the notifications more reliable. It is quite odd.

Regarding Molly, it might have advantages, but at the same time you are trusting a second party to not get compromised.

Molly has unique features compared to Signal:

Data encryption at rest - Protect your app database with passphrase encryption

Secure RAM wiper - Securely shred sensitive data from device memory

Automatic lock - Lock the app automatically under user-defined conditions

Multi-device support - Link multiple devices to a single Signal account, including Android tablets

UnifiedPush - Receive push notifications without Google through the UnifiedPush protocol

Block unknown contacts - Block messages and calls from unknown senders for security and anti-spam

Disappearing call history - Clear call logs together with expiring messages

Custom backup scheduling - Set daily or weekly interval and the number of backups to retain

SOCKS proxy and Tor support - Tunnel app network traffic via proxy and Orbot

Debug logs are optional - Android logging can be disabled

I think the main points would be encryption at rest and notification handling. The lock function exists in Signal too, but simpler. Multi-Account is possible with multiple profiles too. Backup scheduling exists too in simpler form. Traffic to some domains could be blocked with a DNS app.

If you use GOS and have Signal besides not many risky apps installed, it is already very secure I guess... An app breaking GOS sandbox to extract Signal data, you probably have bigger issues to worry about then... I would argue it makes more sense installing on stock Android. And on GOS it's 50:50 where you want to put your trust.
But I am no expert.

DeletedUser735

Xtreix What is your source and proof for Molly consuming less batter than Signal on GOS?

DeletedUser735

Elysium Yes, it is still correct. The big difference is that the Signal/Molly websocket will send keepalive messages every 30 seconds which is wasteful and is really only meant for foreground app use. It was much heavier on my pixel 8's battery life vs UnifiedPush (which is 60 sec keepalive via Sunup).

Signal/Molly don't need unrestricted battery on GOS. Signal/Molly track the time difference between the sent/received of your messages as seen under message "Info". If that time difference gets too big, it'll show a "megaphone" banner for you to disable battery restrictions.

uthunku

One new, major reason to use Molly and database encryption is to prevent app from confirming that you've received any message. And by using UnifiedPush you're still getting a notification, you're just not informing Signal server that you received it on your device.

Explanation:

https://www.reddit.com/r/cybersecurity/comments/1pgmvtk/how_almost_any_phone_number_can_be_tracked_via/

https://www.reddit.com/r/cybersecurity/comments/1pi4l4h/update_for_how_almost_any_phone_number_can_be/

schklom

DeletedUser735

What is your source and proof for Molly consuming less batter than Signal on GOS?

If you setup UP, the UP app keeps the connection open, not Molly, so Molly barely uses any battery.
It's the same if you use Google's FCM, Signal doesn't open a connection but piggybacks Google's connection

If you don't rely on UP or FCM, then Molly uses its own connection like Signal without FCM, that uses the same extra battery.

DeletedUser735

schklom Yes, so you're just proving my point that there is no battery-usage difference between Signal and Molly. They function the same in relying on some bg notification provider where they can.
You're also not entirely correct. Signal/Molly do open a direct (websocket) connection to Signal servers when the app is in the foreground and up to 2 minutes after when it's in the background. This is done for notification speed. You're welcome to read their open sourced code if you don't believe me.

Novaliss

DeletedUser735 So, is Polly different from these?

DeletedUser735

Novaliss No, Polly is my personal fork to clean up the Molly UI and remove some dead code for modern phones. I would not attempt to change any real functionality as I think it's already ideal.

uthunku One new, major reason to use Molly and database encryption is to prevent app from confirming that you've received any message. And by using UnifiedPush you're still getting a notification, you're just not informing Signal server that you received it on your device.

This doesn't make sense to me. Signal/Molly has to confirm that you received the message otherwise the server will think that you're not getting notifications and will keep on retrying with exponential backoff. As the reddit OP highlighted, the best way to work around this particular issue is to disallow unknown users from messaging you.

Novaliss

DeletedUser735 got it. Trying it right now. 😉