3 ms·

Who are the two users in this case? How did they discover each other? From the OP: > "Very few people want to install a communication app, open the compose scr

Who are the two users in this case? How did they discover each other? From the OP: > "Very few people want to install a communication app, open the compose screen for the first time, and be met by an empty list of who they can communicate with." Signal needs to bootstrap itself automatically in order to solve this problem. Can you explain how two users doing a private set intersection of their contacts solves this bootstrapping problem?

zeveb 9y ago
The two users are two folks who wish to communicate who hold their phones back-to-back and let NFC validate who they each are. Both parties are now able to perform a private set intersection to find people whom they know in common who also use Signal, and are able to then use private set intersection with each of those people to find more. The idea is that users bootstrap via the social graph of folks they physically know (or, of course, they could fall back to manually entering keys, for experts). Users place their trust in one another, rather than in the server.
- bascule 9y ago
  So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades.
  - tveita 9y ago
    They could at least allow it. Signal is the odd one out among secure messenger apps for having no way of adding a contact in a face to face setting without uploading all your contacts to their servers.
    - bascule 9y ago
      Signal allows you to send messages to numbers which are not in your contacts, which by definition implies it can be done without uploading your contacts to your servers. In person you can also exchange "safety numbers" via QR code which provides key verification.
  - zeveb 9y ago
    > So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... I want to protect people's contact lists. What's more, Signal's current solution doesn't actually address the problem: the vast majority of people who install Signal will open up the app and see … an empty contact list. Why? Because the vast majority of the human race doesn't use Signal. So what do folks who use Signal have to do? Ask their friends to install it, and register it. Which isn't appreciably different from asking a friend to install Signal, and text/email/NFC one his contact information. Yes, once a cluster of people have installed it, the contact-sharing functionality becomes useful. So, too, would friend-of-a-friend contact sharing. > Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades. Since that's still the user experience of Signal, and Signal is pretty popular, I don't really think it's a problem. I use Signal. I like Signal, a lot. I respect Moxie Marlinspike's crypto chops. But I wish he had more respect for privacy, and didn't require us all to trust in his good intentions.
- eridius 9y ago
  The whole point is finding out which of your contacts are already on Signal. What benefit do you get out of performing set intersection on the contacts lists of 2 users? That sort of thing is done to find your "mutual friends", but I don't see why a messaging service like Signal cares about mutual friends.
  - zeveb 9y ago
    > I don't see why a messaging service like Signal cares about mutual friends. Signal doesn't care; users care about mutual friends. Here's an example: - Alice installs Signal². She has many contacts, and doesn't know which contacts also use Signal². Notably, she doesn't want to give the Signal² servers all of her contacts. - Alice asks Bob to install Signal². He does, and they trade key information (e.g. via SMS, email, NFC — whatever) and their phones use private set intersection to discover that they have Charlie, Diana & Ed in common. None of those guys has Signal² installed yet, so far as Alice or Bob know. - Alice asks Charlie to install Signal². He does, they trade key information, and they see that they have Bob, Frank & Gene in common. Charlie gets (what Alice says is) Bob's public key, without contacting Bob directly. - Charlie's phone contacts Bob's phone, and discovers that they have Alice in common; Charlie's phone validates that Bob's claim of Alice's key matches what he verified himself. - Bob asks Diana to install Signal². She already has it, so all they need to do is exchange keys and discover mutual contacts. They both know Alice & Ed — and Diana is able to give Bob Ed's public key (it turns out that, unbeknownst to Alice or Bob, he's been using Signal² for months). Bob's phone can then share Ed's public key with Alice in another round of set intersection. - Diana's phone can also share Ed's public key with Alice, now that she knows Alice's contact information. Alice's phone now has two different people attesting to Ed's public key; if they agree, that's good and if they disagree then her phone can give her a warning. She can contact Ed out-of-band if she chooses. This is an improvement on the current Signal protocol, since Alice has a chance to detect a malicious attestation without having to manually compare keys with Ed. Note the user experience: as each user starts using Signal², his social network is used to share the contact information of his circles of friends. Users are incented to be truthful, since lying will be easily detected. The Signal² servers never see users' contacts; they don't even need to know users' real-world identities. Just as in current Signal, each Signal² user is introduced to the program by a friend. Just as in the current Signal, users discover contacts who use Signal². Now, it's not identical: users won't see contacts who use Signal but have no mutual friends in common. This is indeed a cost — but it comes with the benefit of not needing to trust OWS.

zeveb 9y ago

The two users are two folks who wish to communicate who hold their phones back-to-back and let NFC validate who they each are. Both parties are now able to perform a private set intersection to find people whom they know in common who also use Signal, and are able to then use private set intersection with each of those people to find more. The idea is that users bootstrap via the social graph of folks they physically know (or, of course, they could fall back to manually entering keys, for experts). Users place their trust in one another, rather than in the server.

bascule 9y ago
So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades.
- tveita 9y ago
  They could at least allow it. Signal is the odd one out among secure messenger apps for having no way of adding a contact in a face to face setting without uploading all your contacts to their servers.
  - bascule 9y ago
    Signal allows you to send messages to numbers which are not in your contacts, which by definition implies it can be done without uploading your contacts to your servers. In person you can also exchange "safety numbers" via QR code which provides key verification.
- zeveb 9y ago
  > So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... I want to protect people's contact lists. What's more, Signal's current solution doesn't actually address the problem: the vast majority of people who install Signal will open up the app and see … an empty contact list. Why? Because the vast majority of the human race doesn't use Signal. So what do folks who use Signal have to do? Ask their friends to install it, and register it. Which isn't appreciably different from asking a friend to install Signal, and text/email/NFC one his contact information. Yes, once a cluster of people have installed it, the contact-sharing functionality becomes useful. So, too, would friend-of-a-friend contact sharing. > Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades. Since that's still the user experience of Signal, and Signal is pretty popular, I don't really think it's a problem. I use Signal. I like Signal, a lot. I respect Moxie Marlinspike's crypto chops. But I wish he had more respect for privacy, and didn't require us all to trust in his good intentions.
eridius 9y ago
The whole point is finding out which of your contacts are already on Signal. What benefit do you get out of performing set intersection on the contacts lists of 2 users? That sort of thing is done to find your "mutual friends", but I don't see why a messaging service like Signal cares about mutual friends.
- zeveb 9y ago
  > I don't see why a messaging service like Signal cares about mutual friends. Signal doesn't care; users care about mutual friends. Here's an example: - Alice installs Signal². She has many contacts, and doesn't know which contacts also use Signal². Notably, she doesn't want to give the Signal² servers all of her contacts. - Alice asks Bob to install Signal². He does, and they trade key information (e.g. via SMS, email, NFC — whatever) and their phones use private set intersection to discover that they have Charlie, Diana & Ed in common. None of those guys has Signal² installed yet, so far as Alice or Bob know. - Alice asks Charlie to install Signal². He does, they trade key information, and they see that they have Bob, Frank & Gene in common. Charlie gets (what Alice says is) Bob's public key, without contacting Bob directly. - Charlie's phone contacts Bob's phone, and discovers that they have Alice in common; Charlie's phone validates that Bob's claim of Alice's key matches what he verified himself. - Bob asks Diana to install Signal². She already has it, so all they need to do is exchange keys and discover mutual contacts. They both know Alice & Ed — and Diana is able to give Bob Ed's public key (it turns out that, unbeknownst to Alice or Bob, he's been using Signal² for months). Bob's phone can then share Ed's public key with Alice in another round of set intersection. - Diana's phone can also share Ed's public key with Alice, now that she knows Alice's contact information. Alice's phone now has two different people attesting to Ed's public key; if they agree, that's good and if they disagree then her phone can give her a warning. She can contact Ed out-of-band if she chooses. This is an improvement on the current Signal protocol, since Alice has a chance to detect a malicious attestation without having to manually compare keys with Ed. Note the user experience: as each user starts using Signal², his social network is used to share the contact information of his circles of friends. Users are incented to be truthful, since lying will be easily detected. The Signal² servers never see users' contacts; they don't even need to know users' real-world identities. Just as in current Signal, each Signal² user is introduced to the program by a friend. Just as in the current Signal, users discover contacts who use Signal². Now, it's not identical: users won't see contacts who use Signal but have no mutual friends in common. This is indeed a cost — but it comes with the benefit of not needing to trust OWS.