3 ms·

> it insists on me giving more permissions to Google services Can you clarify what you mean? I use Signal without Google Play Store/Services and am curious abo

by oil25 7y ago

> it insists on me giving more permissions to Google services Can you clarify what you mean? I use Signal without Google Play Store/Services and am curious about said requirement. > it relies on me a phone number as an ID I dislike this also, but what's the alternative? A phone number is (usually) a long-lived, relatively immutable identifier which is convenient, memorable and portable. It is highly usable and that may be more important than other considerations.

mattl 7y ago
An email address? A username?
- oil25 7y ago
  For most users, I think maintaining exclusive ownership of a phone number is much easier than securing their email account or a traditional username+password credential, so posit it's a natural fit for a secure mobile messenger.
  - dbrgn 7y ago
    Maybe for a secure messenger, but for a private one? It bugs me that I need to share my phone number with people that I want to contact on Signal, especially since Signal claims to focus on privacy. A private messenger should be usable anonymously, shouldn't it?
    - deleted 7y ago
      [deleted]
    - oil25 7y ago
      > A private messenger should be usable anonymously, shouldn't it? It would make a good feature, but anonymity is not a requirement for privacy. I want my connection to the bank's website to be private, but there's no need for it to be anonymous. Signal offers a lot of advantage over traditional SMS with familiar usability. It doesn't perfectly solve everyone's threat model for privacy and anonymity, and doesn't have to.
  - jen_h 7y ago
    It's not a natural fit for a secure mobile messenger if you want to stay anonymous. For some of us, security == anonymity. Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails. And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.
    - oil25 7y ago
      > For some of us, security == anonymity. I don't follow. How is security equal to anonymity? If anything, security is what enables privacy, which could enable anonymity. There are plenty of circumstances where you need security, but not anonymity - for example a message to your partner. Of course if you do need anonymity, there's a lot more involved than simply installing a "secure app" or anything of that sort. > Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails. I don't know about that in the US. I was able to open a pre-paid T-Mobile account to use with my LineageOS Android device without identity verification. Perhaps it is different elsewhere now? > And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger. That sounds troubling, is it what Signal does? Would like to read more about that - is there a Github issue for reference?
      - jen_h 7y ago
        I’ve got this crazy feeling that you’re not asking these questions in good faith, especially if you don’t understand how anonymity is important for people using secure messengers or need a Github issue to inform you about a feature long-discussed in the app.
        oil25 7y ago
        It was asked in good faith and I did explain my reasoning for why anonymity and security are different concepts. Have you got a citation for the claim that Signal "uploads entire contact lists" or was this just FUD?
h91wka 7y ago
> but what's the alternative Making phone and e-mail optional, and being a tier-1 identity. That's what Matrix does.
- maksim-m 7y ago
  Then Signal have to store your social graph on the server in plaintext. It's not what's expected from a private messenger.
  - dbrgn 7y ago
    Storing the social graph is not required at all. For example, Threema creates a random alphanumeric identity that is linked to your public key (instead of linking the phone number directly to your public key). It's possible to optionally link your hashed phone number and/or e-mail to your identity. Finding your friends can be done by comparing hashes of the data in your address book with the hashes linked to the identities. Those address book hashes never need to be persisted anywhere on the server, an in-memory comparison is sufficient, then the data can be thrown away. If you wish to stay anonymous, just ask people to add you manually by typing in your identity (or by scanning your public key QR code, which also results in verification / trust).
  - h91wka 7y ago
    Could you elaborate? I don't follow your reasoning here.
est31 7y ago
> I use Signal without Google Play Store/Services Can you talk about battery requirements? For me, it proved to be a major battery drain to the point I uninstalled Signal. I don't seem to be the only one with this issue [1]. [1]: https://github.com/signalapp/Signal-Android/issues/6898 https://github.com/signalapp/Signal-Android/issues/6898

by oil25 7y ago

mattl 7y ago

An email address? A username?

oil25 7y ago
For most users, I think maintaining exclusive ownership of a phone number is much easier than securing their email account or a traditional username+password credential, so posit it's a natural fit for a secure mobile messenger.
- dbrgn 7y ago
  Maybe for a secure messenger, but for a private one? It bugs me that I need to share my phone number with people that I want to contact on Signal, especially since Signal claims to focus on privacy. A private messenger should be usable anonymously, shouldn't it?
  - deleted 7y ago
    [deleted]
  - oil25 7y ago
    > A private messenger should be usable anonymously, shouldn't it? It would make a good feature, but anonymity is not a requirement for privacy. I want my connection to the bank's website to be private, but there's no need for it to be anonymous. Signal offers a lot of advantage over traditional SMS with familiar usability. It doesn't perfectly solve everyone's threat model for privacy and anonymity, and doesn't have to.
- jen_h 7y ago
  It's not a natural fit for a secure mobile messenger if you want to stay anonymous. For some of us, security == anonymity. Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails. And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.
  - oil25 7y ago
    > For some of us, security == anonymity. I don't follow. How is security equal to anonymity? If anything, security is what enables privacy, which could enable anonymity. There are plenty of circumstances where you need security, but not anonymity - for example a message to your partner. Of course if you do need anonymity, there's a lot more involved than simply installing a "secure app" or anything of that sort. > Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails. I don't know about that in the US. I was able to open a pre-paid T-Mobile account to use with my LineageOS Android device without identity verification. Perhaps it is different elsewhere now? > And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger. That sounds troubling, is it what Signal does? Would like to read more about that - is there a Github issue for reference?
    - jen_h 7y ago
      I’ve got this crazy feeling that you’re not asking these questions in good faith, especially if you don’t understand how anonymity is important for people using secure messengers or need a Github issue to inform you about a feature long-discussed in the app.
      - oil25 7y ago
        It was asked in good faith and I did explain my reasoning for why anonymity and security are different concepts. Have you got a citation for the claim that Signal "uploads entire contact lists" or was this just FUD?

h91wka 7y ago

> but what's the alternative Making phone and e-mail optional, and being a tier-1 identity. That's what Matrix does.

maksim-m 7y ago
Then Signal have to store your social graph on the server in plaintext. It's not what's expected from a private messenger.
- dbrgn 7y ago
  Storing the social graph is not required at all. For example, Threema creates a random alphanumeric identity that is linked to your public key (instead of linking the phone number directly to your public key). It's possible to optionally link your hashed phone number and/or e-mail to your identity. Finding your friends can be done by comparing hashes of the data in your address book with the hashes linked to the identities. Those address book hashes never need to be persisted anywhere on the server, an in-memory comparison is sufficient, then the data can be thrown away. If you wish to stay anonymous, just ask people to add you manually by typing in your identity (or by scanning your public key QR code, which also results in verification / trust).
- h91wka 7y ago
  Could you elaborate? I don't follow your reasoning here.

est31 7y ago

> I use Signal without Google Play Store/Services Can you talk about battery requirements? For me, it proved to be a major battery drain to the point I uninstalled Signal. I don't seem to be the only one with this issue [1]. [1]: https://github.com/signalapp/Signal-Android/issues/6898 https://github.com/signalapp/Signal-Android/issues/6898