5 ms·

And it's a good recommendation, IMO. Still not something I'll ever use because it too slurps up contacts. I mentioned this some time ago, and the responses were

And it's a good recommendation, IMO. Still not something I'll ever use because it too slurps up contacts. I mentioned this some time ago, and the responses were interesting - from "that's not a bad thing" to "but they do it in a nice way". Claiming to be secure, and then taking what's mine away from my control is unacceptable to me.

StavrosK 11y ago
Phil Zimmermann has developed a new protocol, which Silent Phone uses, which makes it impossible (or very hard) for the server to know the contacts on your phone while doing discovery. I'm going to write up the protocol and publish a reference server I wrote in Go in a few days. I'll post it here and send it to Open Whisper Systems as well, they may want to integrate it.
- robbiep 11y ago
  Just a bookmarking comment
  - mikeash 11y ago
    Just in case you don't know, if you upvote a comment then it becomes available on your profile page under "saved comments." Obviously, if you're extremely liberal with the upvote button, this may not be useful as a bookmark....
    - EGreg 11y ago
      I think I should make a bookmarklet for HN to do additional things like this. Useful? I would call it Show.hn :-)
    - chanux 11y ago
      Why not bookmark the link to comment though?
      - mikeash 11y ago
        If you mean a browser bookmark, I personally fell out of the habit of using those ages ago, because syncing them was way too difficult.
    - robbiep 11y ago
      Thanks, I was unaware
  - StavrosK 11y ago
    Just a notification comment: https://github.com/SilentCircle/contact-discovery https://github.com/SilentCircle/contact-discovery
pmjordan 11y ago
Considering the source is available - https://github.com/WhisperSystems/ https://github.com/WhisperSystems/ - it should be reasonably straightforward to take the piece of code out that accesses your contact list? (On iOS, and by the sound of it, latest Android OS, you can also just disallow contact access via the system UI.)
sigil 11y ago
Signal doesn't upload your contacts anywhere. That was the whole point of their "Private Contact Discovery" blog post. ("How do we determine which contacts are registered with a service, without revealing the contacts to the service?") [1] A hard problem that no other messaging app has bothered to solve, AFAIK. Yes, Signal The App reads your contacts to construct the blinded signature query. Does it then do something nefarious with them? No: https://github.com/WhisperSystems https://github.com/WhisperSystems What alternative solution to the PKI key introduction problem would you rather see? You could go the iMessage central key broker route, but that means trusting that Apple won't introduce the wrong key to you (or be compelled to do so). [2] Or, you could let users exchange keys in person a la key signing parties. That's a reasonable feature request at this point, but advanced usage and not something that gets you traction with normal people. TextSecure/Signal wouldn't have gotten to where it is today with that much friction around key introduction. [1] https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ [2] http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html
- maxerickson 11y ago
  I have not carefully checked, but based on the paragraph from your contact discovery link For RedPhone, our user base is still manageable enough (for now) to use the bloom filter technique. For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out. I would expect that Signal does share contact information with the server.
  - sigil 11y ago
    I believe that comment is out of date, since there are multiple entries on the support forum about what to do if the contacts bloom filter fails to download. [1] [2] But now you've got me curious. I'll dig back into the code and find out for sure. [1] http://support.whispersystems.org/hc/en-us/articles/212743488-Why-are-my-contacts-different-colors-in-my-contact-list- http://support.whispersystems.org/hc/en-us/articles/21274348... [2] http://support.whispersystems.org/hc/en-us/articles/212476148-Who-can-I-talk-to-with-Signal-Where-are-my-contacts- http://support.whispersystems.org/hc/en-us/articles/21247614...

StavrosK 11y ago

Phil Zimmermann has developed a new protocol, which Silent Phone uses, which makes it impossible (or very hard) for the server to know the contacts on your phone while doing discovery. I'm going to write up the protocol and publish a reference server I wrote in Go in a few days. I'll post it here and send it to Open Whisper Systems as well, they may want to integrate it.

robbiep 11y ago
Just a bookmarking comment
- mikeash 11y ago
  Just in case you don't know, if you upvote a comment then it becomes available on your profile page under "saved comments." Obviously, if you're extremely liberal with the upvote button, this may not be useful as a bookmark....
  - EGreg 11y ago
    I think I should make a bookmarklet for HN to do additional things like this. Useful? I would call it Show.hn :-)
  - chanux 11y ago
    Why not bookmark the link to comment though?
    - mikeash 11y ago
      If you mean a browser bookmark, I personally fell out of the habit of using those ages ago, because syncing them was way too difficult.
  - robbiep 11y ago
    Thanks, I was unaware
- StavrosK 11y ago
  Just a notification comment: https://github.com/SilentCircle/contact-discovery https://github.com/SilentCircle/contact-discovery

pmjordan 11y ago

Considering the source is available - https://github.com/WhisperSystems/ https://github.com/WhisperSystems/ - it should be reasonably straightforward to take the piece of code out that accesses your contact list? (On iOS, and by the sound of it, latest Android OS, you can also just disallow contact access via the system UI.)

sigil 11y ago

Signal doesn't upload your contacts anywhere. That was the whole point of their "Private Contact Discovery" blog post. ("How do we determine which contacts are registered with a service, without revealing the contacts to the service?") [1] A hard problem that no other messaging app has bothered to solve, AFAIK. Yes, Signal The App reads your contacts to construct the blinded signature query. Does it then do something nefarious with them? No: https://github.com/WhisperSystems https://github.com/WhisperSystems What alternative solution to the PKI key introduction problem would you rather see? You could go the iMessage central key broker route, but that means trusting that Apple won't introduce the wrong key to you (or be compelled to do so). [2] Or, you could let users exchange keys in person a la key signing parties. That's a reasonable feature request at this point, but advanced usage and not something that gets you traction with normal people. TextSecure/Signal wouldn't have gotten to where it is today with that much friction around key introduction. [1] https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ [2] http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html

maxerickson 11y ago
I have not carefully checked, but based on the paragraph from your contact discovery link For RedPhone, our user base is still manageable enough (for now) to use the bloom filter technique. For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out. I would expect that Signal does share contact information with the server.
- sigil 11y ago
  I believe that comment is out of date, since there are multiple entries on the support forum about what to do if the contacts bloom filter fails to download. [1] [2] But now you've got me curious. I'll dig back into the code and find out for sure. [1] http://support.whispersystems.org/hc/en-us/articles/212743488-Why-are-my-contacts-different-colors-in-my-contact-list- http://support.whispersystems.org/hc/en-us/articles/21274348... [2] http://support.whispersystems.org/hc/en-us/articles/212476148-Who-can-I-talk-to-with-Signal-Where-are-my-contacts- http://support.whispersystems.org/hc/en-us/articles/21247614...