6 ms·
Huge respect for Moxie, but the requirement of a phone number really is a dealkiller. 1. Phone number requires a service provider 2. Service provider owns
by vox_mollis 11y ago
Huge respect for Moxie, but the requirement of a phone number really is a dealkiller.
1. Phone number requires a service provider
2. Service provider owns the baseband and root of your phone.
3. $government makes a "lawful request" of Verizon et. al.
to install keyloggers/screenshotters on your phone.
4. Your "secure" commms are compromised.
Signal needs to work on comprehensively rooted devices connected only via wifi for the above threat model to go away.
- moxie 11y agoIf we were going to rank our priorities, they would be in this order: 1) Make mass surveillance impossible. 2) Stop targeted attacks against crypto nerds. It's not that we don't find #2 laudable, but optimizing for #1 takes precedence when we're making decisions. It's totally possible for you to install Signal on an iPod touch with a VoIP number, for instance, but that takes more effort than the common case we're designing for.
- blub 11y agoAny chance of not requiring access to the whole contact list? I think there are pickers that allow selecting one contact - or better yet, one could allow adding contacts inside Signal.
- finnn 11y agoProbably not because they check that against the list of people who have Signal installed so they can send encrypted messages to the people who support it. They talk more about how they try to do this privately in [0]. [0]: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
- gcb0 11y agowhich is silly. that should be fine for people already advertising their contact list for facebook, wasapp, etc. but there should have been a isolated account setup for people not doing so
- junto 11y agoI had a problem where one of my contracts uninstalled Textsecure, and went back to the vanilla SMS app. Now all the messages he received from me are garbled. Somehow they need a way to disassociate phones AFTER the app has been uninstalled.
- perucoder 11y agoWouldn't that be a huge security flaw? Someone with access to your phone could uninstall the app then read all the messages.
- horusx 11y agoYou can ask your contact to use the unregister app here https://whispersystems.org/textsecure/unregister/ https://whispersystems.org/textsecure/unregister/ Apple offer a similar tool when leaving iOS https://selfsolve.apple.com/deregister-imessage https://selfsolve.apple.com/deregister-imessage
- Splines 11y agoThis is one of the reasons why they don't do encrypted SMS anymore: https://whispersystems.org/blog/goodbye-encrypted-sms/ https://whispersystems.org/blog/goodbye-encrypted-sms/
- newjersey 11y agoIt is a little inconvenient but I have registered for Signal using Google Voice. Much more easily done on iOS than on Android though.
- newman314 11y agomoxie, Please consider my suggestions here. https://news.ycombinator.com/item?id=10501636 https://news.ycombinator.com/item?id=10501636 I would argue that an identifier is just that: an identifier. It does not need to be a number nor does it have to be for an indefinite amount of time. Lastly, please consider disabling the debug log by default
- unfamiliar 11y agoPlus it still leaves people open to metadata analysis. The phone number has to be verified, meaning a text message is sent from Signal HQ to your device, clearly marking you as a Signal user.
- portoperope 11y agoNitpick: Currently the verification text messages are sent via Twilio.
- anonbanker 11y agoThis is why I still don't own a cellphone in 2015.
- unicornporn 11y agoI'd say only being available on Google Play is an even greater dealkiller. Telegram (which is, to be honest, not quite comparable) is on F-droid, that I like.
- whyever 11y agoTextSecure used to be on F-droid, but Moxie wanted them to take it down, because it was not him signing the packages (a disadvantage to Google Play).
- nly 11y ago> 2. Service provider owns the baseband and root of your phone. My service provider doesn't own my baseband. They own the SIM I put in my phone, and that likely gives them a lot of access to my device, but I doubt it can be used to perform key or screen logging. (Nexus 4, bought SIM free)