3 ms·

So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party...

So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades.

tveita 9y ago
They could at least allow it. Signal is the odd one out among secure messenger apps for having no way of adding a contact in a face to face setting without uploading all your contacts to their servers.
- bascule 9y ago
  Signal allows you to send messages to numbers which are not in your contacts, which by definition implies it can be done without uploading your contacts to your servers. In person you can also exchange "safety numbers" via QR code which provides key verification.
zeveb 9y ago
> So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... I want to protect people's contact lists. What's more, Signal's current solution doesn't actually address the problem: the vast majority of people who install Signal will open up the app and see … an empty contact list. Why? Because the vast majority of the human race doesn't use Signal. So what do folks who use Signal have to do? Ask their friends to install it, and register it. Which isn't appreciably different from asking a friend to install Signal, and text/email/NFC one his contact information. Yes, once a cluster of people have installed it, the contact-sharing functionality becomes useful. So, too, would friend-of-a-friend contact sharing. > Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades. Since that's still the user experience of Signal, and Signal is pretty popular, I don't really think it's a problem. I use Signal. I like Signal, a lot. I respect Moxie Marlinspike's crypto chops. But I wish he had more respect for privacy, and didn't require us all to trust in his good intentions.

tveita 9y ago

They could at least allow it. Signal is the odd one out among secure messenger apps for having no way of adding a contact in a face to face setting without uploading all your contacts to their servers.

bascule 9y ago
Signal allows you to send messages to numbers which are not in your contacts, which by definition implies it can be done without uploading your contacts to your servers. In person you can also exchange "safety numbers" via QR code which provides key verification.

zeveb 9y ago

> So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... I want to protect people's contact lists. What's more, Signal's current solution doesn't actually address the problem: the vast majority of people who install Signal will open up the app and see … an empty contact list. Why? Because the vast majority of the human race doesn't use Signal. So what do folks who use Signal have to do? Ask their friends to install it, and register it. Which isn't appreciably different from asking a friend to install Signal, and text/email/NFC one his contact information. Yes, once a cluster of people have installed it, the contact-sharing functionality becomes useful. So, too, would friend-of-a-friend contact sharing. > Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades. Since that's still the user experience of Signal, and Signal is pretty popular, I don't really think it's a problem. I use Signal. I like Signal, a lot. I respect Moxie Marlinspike's crypto chops. But I wish he had more respect for privacy, and didn't require us all to trust in his good intentions.