5 ms·

Next problem: Signal will not work without a phone number... I'd vote for https://riot.im/ https://riot.im/ instead.

by unicornporn 10y ago

mirimir 10y ago
Couldn't the phone somehow "pretend" to have a phone number?
- bubblethink 10y ago
  I think it needs the phone number for verification. The phone number is the identity in Signal (and a lot of other apps these days).
  - mirimir 10y ago
    Verification of what, to whom/what? If you're using WiFi, there's no "phone" anything involved. Or at least, I don't get why there would need to be.
    - Paul-ish 10y ago
      Your messages still go through OWS servers. I believe signal routes messages via phone #. Signal client is open source though, so maybe this is easy to work around.
      - gjjrfcbugxbhf 10y ago
        OWS has specifically said they won't accept federation...
        Paul-ish 10y ago
        I was more suggesting a separate centralized service that doesn't use phone #s, but true that you still wouldn't be able to use it with standard Signal users.
    - bubblethink 10y ago
      It's not a technical limitation, just a design decision. Everyone on Signal's network is known by their phone numbers. You cannot pick a username, as such. The phone number is the username.
      - mirimir 10y ago
        I really don't get the point of that. I mean, sure one can get more-or-less anonymous phone numbers. But why create the need for that? There are things like keys for verification :)
        JumpCrisscross 10y ago
        > I really don't get the point of that To prevent spam and promote discovery. Finding someone on WhatsApp or Signal is easier than on WeChat as with the latter someone might be using a screen name, or an email address or a phone number.
        yorwba 10y ago
        Why is it is easier to find someone when you can only use one identifier to find them, instead of several? Note that WeChat also uses phone numbers to limit spam, so you can find anyone if you know their number. (But exchanging QR codes is the preferred method of sharing contact information, to the point where I couldn't call most of my contacts except through WeChat.)
        colordrops 10y ago
        Discovery and preventing spam should not take precedence over privacy for an app that supposedly has privacy as its number one priority.
        mirimir 10y ago
        Indeed. So one must conclude that privacy isn't the top priority.
        10y ago
  - iank10 10y ago
    You can use Signal with a VOIP number. Do the one-time registration and that's it. Or you can get yourself an anonymous disposable SIM (unless illegal in your country), register the number and keep hold of the SIM if you need to re-register the number in the future.
  - dheera 10y ago
    I use Twilio when I need to verify phone numbers for stupid apps. Mainly because a great deal of the time don't actually carry a phone around (especially if I am carrying something more computationally powerful than a phone). And I can verify my Twilio phone numbers from anywhere in any country. Can't we kill phones already, please? Identify people by e-mail addresses, which are easier to remember and not tied to countries.
  - squarefoot 10y ago
    > ... The phone number is the identity in Signal (and a lot of other apps these days). Which to me is an incredibly dumb idea since it leaves out WiFi only terminals such as el cheapo tablets but also small embedded boards etc. I know some of these messaging apps can be used on WiFi only devices, but never in an immediate way and I believe you can't use them at the same time, which is very dumb. This also kills any IoT use for instance, where you could make N copies of a Linux image that boots a node, connects through the same user and sends the data available to its IO pins, or accepts commands to drive them in order to turn on or off other appliances.
    - bubblethink 10y ago
      Signal only works on phones and chrome desktop right now. So other devices are anyway out of question. Their goal has always been secure messaging for the masses, and not necessarily secure messaging for everyone and everything under the sun. I think it's a fair trade-off if it helps them get the user base by keeping it simple and similar to WhatsApp. Even in its current form, it's incredible difficult to get people to use it. It would be much worse if it were any more complex UI-wise.
      - ReverseCold 10y ago
        Yes, chat needs to not be just basic texting or no one will use it. iOS users get iMessage which is great, but there's no cross platform version. Telegram + Encrypted by default and in groups would be best, but they have some (invalid) reason for keeping it unencrypted.
        Anon1096 10y ago
        There's a lot of features Telegram offers that can't be used with e2e encryption. Stuff like link previews and many bot functionalities are things that come to mind that my group uses very frequently.
      - a_imho 10y ago
        I'm sure they would not mind a whatsapp like buyout offer, at least as an option. That, and secure messaging for the masses.
deleted 10y ago
[deleted]
newman314 10y ago
I said this several times but will repeat it here again. I would love a Ricochet/Rio+Signal+Burner combo.
- ReverseCold 10y ago
  But none of those are fun to use, let's throw telegram/slack into the mix! Wire is doing a pretty good job of making a fun to use chat interface, but it has its own problems in privacy and speed.
chc4 10y ago
Does matrix even support end-to-end encryption? Last I checked it didn't have /any/, except maybe server-to-server and even that wasn't enabled. I also seem to remember going over their homebrewed cryptographic rachet and it didn't properly HMAC. EDIT: Apparently riot.im supports E2E, but it's not a part of the Matrix protocol and it's not encrypted by default. The Olm rachet was also audited by NCC, so that's nice.
- jdkfree 10y ago
  They have e2e on all devices now.
  - feld 10y ago
    But still no way to enforce or enable as default.
- Arathorn 10y ago
  E2E /is/ part of the Matrix protocol - it's just still in beta. The spec PRs haven't landed yet (http://matrix.org/speculator/spec/drafts%252Fe2e/client_server/unstable.html#end-to-end-encryption http://matrix.org/speculator/spec/drafts%252Fe2e/client_serv...). Once out of beta it'll be turned on everywhere by default.

Next problem: Signal will not work without a phone number... I'd vote for https://riot.im/ https://riot.im/ instead.

mirimir 10y ago

Couldn't the phone somehow "pretend" to have a phone number?

bubblethink 10y ago
I think it needs the phone number for verification. The phone number is the identity in Signal (and a lot of other apps these days).
- mirimir 10y ago
  Verification of what, to whom/what? If you're using WiFi, there's no "phone" anything involved. Or at least, I don't get why there would need to be.
  - Paul-ish 10y ago
    Your messages still go through OWS servers. I believe signal routes messages via phone #. Signal client is open source though, so maybe this is easy to work around.
    - gjjrfcbugxbhf 10y ago
      OWS has specifically said they won't accept federation...
      - Paul-ish 10y ago
        I was more suggesting a separate centralized service that doesn't use phone #s, but true that you still wouldn't be able to use it with standard Signal users.
  - bubblethink 10y ago
    It's not a technical limitation, just a design decision. Everyone on Signal's network is known by their phone numbers. You cannot pick a username, as such. The phone number is the username.
    - mirimir 10y ago
      I really don't get the point of that. I mean, sure one can get more-or-less anonymous phone numbers. But why create the need for that? There are things like keys for verification :)
      - JumpCrisscross 10y ago
        > I really don't get the point of that To prevent spam and promote discovery. Finding someone on WhatsApp or Signal is easier than on WeChat as with the latter someone might be using a screen name, or an email address or a phone number.
        yorwba 10y ago
        Why is it is easier to find someone when you can only use one identifier to find them, instead of several? Note that WeChat also uses phone numbers to limit spam, so you can find anyone if you know their number. (But exchanging QR codes is the preferred method of sharing contact information, to the point where I couldn't call most of my contacts except through WeChat.)
        colordrops 10y ago
        Discovery and preventing spam should not take precedence over privacy for an app that supposedly has privacy as its number one priority.
        mirimir 10y ago
        Indeed. So one must conclude that privacy isn't the top priority.
        10y ago
- iank10 10y ago
  You can use Signal with a VOIP number. Do the one-time registration and that's it. Or you can get yourself an anonymous disposable SIM (unless illegal in your country), register the number and keep hold of the SIM if you need to re-register the number in the future.
- dheera 10y ago
  I use Twilio when I need to verify phone numbers for stupid apps. Mainly because a great deal of the time don't actually carry a phone around (especially if I am carrying something more computationally powerful than a phone). And I can verify my Twilio phone numbers from anywhere in any country. Can't we kill phones already, please? Identify people by e-mail addresses, which are easier to remember and not tied to countries.
- squarefoot 10y ago
  > ... The phone number is the identity in Signal (and a lot of other apps these days). Which to me is an incredibly dumb idea since it leaves out WiFi only terminals such as el cheapo tablets but also small embedded boards etc. I know some of these messaging apps can be used on WiFi only devices, but never in an immediate way and I believe you can't use them at the same time, which is very dumb. This also kills any IoT use for instance, where you could make N copies of a Linux image that boots a node, connects through the same user and sends the data available to its IO pins, or accepts commands to drive them in order to turn on or off other appliances.
  - bubblethink 10y ago
    Signal only works on phones and chrome desktop right now. So other devices are anyway out of question. Their goal has always been secure messaging for the masses, and not necessarily secure messaging for everyone and everything under the sun. I think it's a fair trade-off if it helps them get the user base by keeping it simple and similar to WhatsApp. Even in its current form, it's incredible difficult to get people to use it. It would be much worse if it were any more complex UI-wise.
    - ReverseCold 10y ago
      Yes, chat needs to not be just basic texting or no one will use it. iOS users get iMessage which is great, but there's no cross platform version. Telegram + Encrypted by default and in groups would be best, but they have some (invalid) reason for keeping it unencrypted.
      - Anon1096 10y ago
        There's a lot of features Telegram offers that can't be used with e2e encryption. Stuff like link previews and many bot functionalities are things that come to mind that my group uses very frequently.
    - a_imho 10y ago
      I'm sure they would not mind a whatsapp like buyout offer, at least as an option. That, and secure messaging for the masses.

deleted 10y ago

[deleted]

newman314 10y ago

I said this several times but will repeat it here again. I would love a Ricochet/Rio+Signal+Burner combo.

ReverseCold 10y ago
But none of those are fun to use, let's throw telegram/slack into the mix! Wire is doing a pretty good job of making a fun to use chat interface, but it has its own problems in privacy and speed.

chc4 10y ago

Does matrix even support end-to-end encryption? Last I checked it didn't have /any/, except maybe server-to-server and even that wasn't enabled. I also seem to remember going over their homebrewed cryptographic rachet and it didn't properly HMAC. EDIT: Apparently riot.im supports E2E, but it's not a part of the Matrix protocol and it's not encrypted by default. The Olm rachet was also audited by NCC, so that's nice.

jdkfree 10y ago
They have e2e on all devices now.
- feld 10y ago
  But still no way to enforce or enable as default.
Arathorn 10y ago
E2E /is/ part of the Matrix protocol - it's just still in beta. The spec PRs haven't landed yet (http://matrix.org/speculator/spec/drafts%252Fe2e/client_server/unstable.html#end-to-end-encryption http://matrix.org/speculator/spec/drafts%252Fe2e/client_serv...). Once out of beta it'll be turned on everywhere by default.