3 ms·

Signal tried to avoid uploading contacts by downloading an encrypted bloom filter to match contacts on the device instead. Unfortunately this doesn't work out w

Signal tried to avoid uploading contacts by downloading an encrypted bloom filter to match contacts on the device instead. Unfortunately this doesn't work out with many users (causing large downloads), so they ditched the feature. Reference and more details: https://whispersystems.org/blog/contact-discovery/ https://whispersystems.org/blog/contact-discovery/ Commit that removes bloom filters (unreleased, will be in version 2.4): https://github.com/WhisperSystems/Signal-iOS/commit/26f9207cab06e4df4af3dc9c02deca3d250eb4ae https://github.com/WhisperSystems/Signal-iOS/commit/26f9207c...

newman314 11y ago
Wait, are you saying that encrypted contact discovery has been removed because it's "hard to do"?? I would think that's a pretty big change to be announced other than a blog post. I reread the post and the only mention is "For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out". That's pretty WTF to me. Disabling access to contacts now and back to wishing for my unicorn messaging app.
- StavrosK 11y ago
  No, it was removed because it "used 5MB for every change". I also wish for an app that would defy reality, but, until then, telling a server who your friends are so it can check, without telling it who your friends are, is a hard problem to solve.
  - tveita 11y ago
    There is nothing reality defying about meeting up and exchanging keys in person. Unfortunately, that's a use case the Signal UI goes out of its way to discourage. It's not like they don't know how, copying Threema's UI would be a massive improvement. Hell, even Snapchat lets you add a friend by scanning their screen, it's not like it's some user hostile ivory tower feature.
    - StavrosK 11y ago
      Signal does too. We're talking about contact discovery, not key verification. Contact discovery is the problem of, given a list of contacts, returning the ones that are on the service. Contact discovery without the server seeing the list of contacts is hard.
      - newman314 11y ago
        Given that the way Signal presents contacts is suboptimal too (contacts showing up irregardless if they have Signal installed only someone else uploaded said contact), I'd rather have a mode where I have to manually exchange contact info until such time secure contact exchange is solved.
        StavrosK 11y ago
        Isn't that easily achieved by not giving Signal access to your contacts?
        newman314 11y ago
        Try it with the current version. If you disable access to contacts, all it does is complain about access with no way to bypass.

newman314 11y ago

Wait, are you saying that encrypted contact discovery has been removed because it's "hard to do"?? I would think that's a pretty big change to be announced other than a blog post. I reread the post and the only mention is "For TextSecure, however, we’ve grown beyond the size where that remains practical, so the only thing we can do is write the server such that it doesn’t store the transmitted contact information, inform the user, and give them the choice of opting out". That's pretty WTF to me. Disabling access to contacts now and back to wishing for my unicorn messaging app.

StavrosK 11y ago
No, it was removed because it "used 5MB for every change". I also wish for an app that would defy reality, but, until then, telling a server who your friends are so it can check, without telling it who your friends are, is a hard problem to solve.
- tveita 11y ago
  There is nothing reality defying about meeting up and exchanging keys in person. Unfortunately, that's a use case the Signal UI goes out of its way to discourage. It's not like they don't know how, copying Threema's UI would be a massive improvement. Hell, even Snapchat lets you add a friend by scanning their screen, it's not like it's some user hostile ivory tower feature.
  - StavrosK 11y ago
    Signal does too. We're talking about contact discovery, not key verification. Contact discovery is the problem of, given a list of contacts, returning the ones that are on the service. Contact discovery without the server seeing the list of contacts is hard.
    - newman314 11y ago
      Given that the way Signal presents contacts is suboptimal too (contacts showing up irregardless if they have Signal installed only someone else uploaded said contact), I'd rather have a mode where I have to manually exchange contact info until such time secure contact exchange is solved.
      - StavrosK 11y ago
        Isn't that easily achieved by not giving Signal access to your contacts?
        newman314 11y ago
        Try it with the current version. If you disable access to contacts, all it does is complain about access with no way to bypass.