> So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party...

> So you want to completely punt on the "open the app to an empty contact list" problem and force people to perform what's effectively a GPG keysigning party... I want to protect people's contact lists. What's more, Signal's current solution doesn't actually address the problem: the vast majority of people who install Signal will open up the app and see … an empty contact list. Why? Because the vast majority of the human race doesn't use Signal. So what do folks who use Signal have to do? Ask their friends to install it, and register it. Which isn't appreciably different from asking a friend to install Signal, and text/email/NFC one his contact information. Yes, once a cluster of people have installed it, the contact-sharing functionality becomes useful. So, too, would friend-of-a-friend contact sharing. > Call me crazy, but I think that'd be a bad user experience of the sort that held back encrypted messaging for decades. Since that's still the user experience of Signal, and Signal is pretty popular, I don't really think it's a problem. I use Signal. I like Signal, a lot. I respect Moxie Marlinspike's crypto chops. But I wish he had more respect for privacy, and didn't require us all to trust in his good intentions.