12 ms·
Would Telegram and others please stop using phone number as a primary source of identity? It's 2018, I have a data only sim and I have no desire to have a phone
by reustle 8y ago
Would Telegram and others please stop using phone number as a primary source of identity? It's 2018, I have a data only sim and I have no desire to have a phone number.
- amaccuish 8y agoAdd signal and whatsapp (not that i use whatsapp) to that.
- jfornear 8y agoIntentionally building Chatdog (https://chat.dog https://chat.dog) to not require a phone number.
- Jtsummers 8y agoIf I could only upvote this more. I still want someone to take signal's protocol and do a BYOK approach. Let me use Keybase or something similar to handle identity management. Additionally, each device (or app instance) gets its own key. Signal and WhatsApp already do encrypted group messages. Treat each of my devices as different "users", who present with the same name. It's a tractable problem. (NB: Not necessarily keybase, but they do have a technical solution to the problem in place already.)
- saltedshiv 8y agoKeybase has chat. Available on desktop and at least Android
- craftyguy 8y agokeybase is a proprietary walled garden.. so.. no thanks.
- twr 8y agoProprietary? The backend maybe, but the keybase clients are open source. Some of the code is a little rough, and completed API docs would be nice, especially concerning KBFS, which is still missing. It's still under heavy development though, so these shortcomings should be understandable. (I personally won't use it much until I can actually develop my own non-reverse-engineered client, but that's just my requirement.) I'm guessing you meant non-decentralized?
- craftyguy 8y agoNo, the server implementation is proprietary. Therefore, it's a walled garden that relies entirely on them. Supporting federation would be going above/beyond just releasing the server implementation's source under a permissive license. As it stands today, you have no choice but to rely on their proprietary server implementation, since the clients are useless on their own.
- twr 8y agoConsidering the whole point of end-to-end encryption is to reduce or eliminate necessary trust in the middleman, this seems like a minor, but still valid concern. Open sourcing the backend code wouldn't allow you to attest to what's running on the server. If the clients also allowed you to point to a custom server URL, which I would support, then the source availability might matter.
- craftyguy 8y agoWithout the proprietary server backend, you cannot use the clients. It's a walled garden. If keybase goes away for whatever reason, you're stuck. You cannot host it yourself, others cannot host it, and even if they released binaries, you'd have no idea what it is doing with the unencrypted 'metadata'.
- twr 8y agoI didn’t dispute the description of Keybase being labeled a walled garden. I opposed it being too-broadly called proprietary, when it’s not — only the backend is. And for anyone only using the official keybase servers, that’s irrelevant from a trust perspective, which is the reason people usually (mistakenly) bring up source code availability. Now I’ll also partially dispute the accusation of it being a walled garden, since walled gardens don’t have open specifications and documented APIs for third-party client implementations. The backend source code would be good to have, for the prudent reason you pointed out, as well as for private instances, but that’s not enough: you also need client code modifications to allow configuration for custom servers. About binaries: anyone who thinks source code is required for determining program behavior probably shouldn’t be auditing software in the first place. (Often having just the source code makes it more difficult, not less.)
- Jtsummers 8y agoYes. But it doesn’t offer some of the features Signal Protocol does. I do use it though.
- swirepe 8y agoI think everyone wants phone numbers to prevent people generating billions of accounts to spam people with.
- ossguy 8y agoAgreed that such services should stop using phone numbers. In the meantime, you can get inexpensive numbers from https://jmp.chat/ https://jmp.chat/ - useful for 2FA as well.
- reustle 8y agoYeah I use Google Voice for this purpose, which isn't _really_ 2fa anyway (because it's my google account).
- deleted 8y ago[deleted]
- Hydraulix989 8y agoSome services somehow know that the phone number is VoIP (Google Voice) and disallow you from using it with TFA. IIRC, Steam is one example.
- cube2222 8y agoThat's technically not two factor if you only need to know a password to get access to the one-time code. It's two passwords, both are something you have to know, there's nothing you need to have or be (sms and biometrics respectively)
- _pdp_ 8y agoI cannot up-vote this more. Many people don't realise that they don't own their phone number! It is possible to own a phone number but it is not widely available just like domains are. Hence it is a stupid idea to use it as an identity.
- jfornear 8y agoI recently learned this the hard way. I changed my phone number after moving cities, and AT&T just leased my old number to someone else!
- Tijdreiziger 8y agoThere is a finite supply of numbers. Not recycling old numbers and just throwing them in a hole forever wouldn't be very prudent.
- toomanybeersies 8y agoThere is an infinite supply of numbers. You can just add extra digits. Mobile phone numbers used to be 8 digits in NZ, then became 9 digits when they needed more numbers.
- cbluth 8y agoNumbers aren't limited to the amount you can count, there will always be more.
- manigandham 8y agoWhat did you expect was going to happen?
- Fnoord 8y agoI'd expect it to be reused _eventually_; not right away though.
- tribler 8y agoWith a self-sovereign identity, you are in control. Our IETF draft + running code: https://tools.ietf.org/html/draft-pouwelse-trustchain-01#section-4.2 https://tools.ietf.org/html/draft-pouwelse-trustchain-01#sec... Our goverment even sponsors this work. Decentral, no need for Russian servers.
- sshb 8y agoYou are forgetting social graph embedded in phone book. No one else would give you social graph that easily.
- Klonoar 8y agoI just keep a rando Skype number for this kind of stuff. After the first login Telegram will typically ping your other active devices anyway.
- bmarquez 8y agoUsing a phone number does let the app quickly build a social graph of your friends using it. But email could do the same thing, with higher risk of fake accounts. It could be worse, an app could say "You must sign up with Facebook"
- yosito 8y agoThis is possible? Or do you technically have a phone number but just don't use it? Also, don't lots of situations require you to give a phone number? How do you handle that?
- reustle 8y agoIt's a Google Fi data only sim, so nope no real phone number. I do have a number through Google Fi and Google Voice, which usually works for 2fa but not always. The phone number goes directly to voicemail always.
- marcus_holmes 8y agoSame. I'm nomadic at the moment, and have to change sims with each country. I don't have a permanent phone number (or address). I know I'm in a minority, but still... it's like things businesses assume about people: 1: they have a phone number. 2: they have an address. 3: the country they are in at the moment is the country they live in
- cageface 8y agoProject Fi from Google has been a lifesaver for me while traveling. I get to use the same number everywhere I go and don't have to do the new SIM dance in every country I visit. It can also be very handy sometimes to have internet access minutes after hitting the tarmac. They've also expanded it to support more phones recently. I think having a Fi phone, even if it's not your primary device, makes a lot of sense for nomads.
- marcus_holmes 8y agoyeah, that looks great for Americans, I guess. Again, another thing businesses assume about people: they're American ;)
- cageface 8y agoThere are plenty of disadvantages for Americans trying to live as nomads too, believe me.
- marcus_holmes 8y agozip codes. Whenever I see a form saying "enter your zip code" I know I'm in for a terrible user experience :(
- dvfjsdhgfv 8y agoIn cases like these I usually buy a pre-paid SIM for a few cents, verify the account and throw the SIM away. I can continue to use my main data SIM then.
- crtasm 8y agoThen in the future the number gets recycled and someone else suddenly takes over your account. WhatsApp lets you set a pin number to prevent this. Can't remember if Signal does similar..?