3 ms·
Signal doesn't upload your contacts anywhere. That was the whole point of their "Private Contact Discovery" blog post. ("How do we determine which contacts are
by sigil 11y ago
Signal doesn't upload your contacts anywhere. That was the whole point of their "Private Contact Discovery" blog post. ("How do we determine which contacts are registered with a service, without revealing the contacts to the service?") [1] A hard problem that no other messaging app has bothered to solve, AFAIK.
Yes, Signal The App reads your contacts to construct the blinded signature query. Does it then do something nefarious with them? No: https://github.com/WhisperSystems https://github.com/WhisperSystems
What alternative solution to the PKI key introduction problem would you rather see? You could go the iMessage central key broker route, but that means trusting that Apple won't introduce the wrong key to you (or be compelled to do so). [2] Or, you could let users exchange keys in person a la key signing parties. That's a reasonable feature request at this point, but advanced usage and not something that gets you traction with normal people. TextSecure/Signal wouldn't have gotten to where it is today with that much friction around key introduction.
[1] https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/
[2] http://blog.quarkslab.com/imessage-privacy.html http://blog.quarkslab.com/imessage-privacy.html
- maxerickson 11y agoI have not carefully checked, but based on the paragraph from your contact discovery link For RedPhone, our user base is still manageable enough (for now) to use the bloom filter technique. For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out. I would expect that Signal does share contact information with the server.
- sigil 11y agoI believe that comment is out of date, since there are multiple entries on the support forum about what to do if the contacts bloom filter fails to download. [1] [2] But now you've got me curious. I'll dig back into the code and find out for sure. [1] http://support.whispersystems.org/hc/en-us/articles/212743488-Why-are-my-contacts-different-colors-in-my-contact-list- http://support.whispersystems.org/hc/en-us/articles/21274348... [2] http://support.whispersystems.org/hc/en-us/articles/212476148-Who-can-I-talk-to-with-Signal-Where-are-my-contacts- http://support.whispersystems.org/hc/en-us/articles/21247614...
- maxerickson 11y agoRedphone was only on IOS and there are not similar entries under Android->Signal. It'd be nice to figure it out, but I guess it isn't that important, Signal still leaks lots of metadata, so anyone that would be burned by sharing their contacts isn't gaining much by using it (or any other mobile comm...).