Why Molly?
While Signal is already very good, you can make it even better by using Molly (and especially Molly-FOSS).
Back in 2018, Signal allowed the user to set a passphrase to protect a local messaging database (i.e. something that could be pulled from the phone by physically accessing it). But this option was removed with the introduction of file encryption on Android. Molly brings this option back with additional security features.
An important note would be that Molly is updated every two weeks to include the latest features and Signal bug fixes. The exception to this is security issues, which are fixed as soon as patches become available.
Also, while Signal itself is open source, it does have some proprietary blocks. Molly, like Signal, uses Google's closed code to support some features, but Molly-FOSS rejects any, even the smallest pieces of closed code.
Signal itself already encrypts everything well, and it's likely that in most cases these pieces of closed code are almost insignificant. However, they are like a seatbelt behind the wheel - most of the time you don't need it, and once in your life you thank God for wearing it that day.
If you install Molly-FOSS to opt out of Google Push (which I warmly recommend - I can separately spell out what a dump Google is), then you can install UnifiedPush for instant notifications. If you don't, you simply won't receive notifications of a new message until you open the messenger.
On a separate note, this is a client, not a full-fledged app, and you can IM through Molly just like you can IM through Signal with other Signal/Molly users. What's more, you can even install both Signal and Molly on the same device (but only under different phone numbers).
Molly Benefits:
- Data at rest encryption - protect your database with passphrase encryption.
- Secure RAM wiping (see file shredding) - securely remove sensitive data from device memory
- Automatic locking - configure the application to lock automatically under certain conditions
- Multi-device support - connect multiple devices, including Android tablets, to a single account
- Block unknown contacts - block messages and calls from unknown senders for security and spam protection.
- Expiring Call History - Clear call notifications along with expiring messages.
- Debug logs are optional - Logging can be disabled on Android
- Custom backup scheduling - Select daily or weekly interval and number of backups to be saved
- SOCKS proxy and Tor support - tunnel app network traffic through proxies and Orbot
- Molly-FOSS - Unlike Signal, does not contain any proprietary “blobs”, i.e. the source code is completely open source
Disadvantages of Molly:
- Perhaps a little less user-friendly
- Available only on Android systems (if you use any other system than safe open source like GrapheneOS, then you don't have to worry about Molly - it's a much higher priority to think about switching from iOS/android to grapheneOS/others, and installing Molly stuff there))
- Although, as already said, Molly is very sober about security, there is a small chance that it will allow some additional vulnerability that is not in the original Signal client. That chance, however, is, first of all, catastrophically negligible (given the nature of Molly's update structure for Signal); and secondly, it's likely that switching to Molly as a whole (as a ratio) will improve your security far more than not switching.
In short, a little less convenience, a little more safety. Whether you should switch to Molly is your personal decision. Need some advice? Unless you are critically lazy and have an Android based system, I would definitely advise you to do so.
Links
Molly's website: https://molly.im/
Instructions on how to quickly and painlessly roll from Signal to Molly: github/migrating-from-Signal