4 ms·

My understanding is that it's not an architecture thing, but an authentication thing: SIM/# as ID is just too practical for both dev and user and they have no p

My understanding is that it's not an architecture thing, but an authentication thing: SIM/# as ID is just too practical for both dev and user and they have no plans on changing that. You're closest hope for a skype replacement that runs equally on all platforms is tox, which requires managing your key.

NikolaNovak 7y ago
I don't believe it's "SIM as ID" - I believe it's SIM as complete authentication (i.e. userID+password in traditional systems). (I have my thoughts on THAT as well, you'll be surprised, when it comes to security... we're nerding out about obtuse and obscure end-to-end encryption, meanwhile, majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging :-/ )
- TheSpiceIsLife 7y ago
  > majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging They still have in-transit protection due to end-to-end encryption, so no protection isn't necessarily true.
grawprog 7y ago
>SIM/# as ID is just too practical for both dev and user In what way is that practical for a user? Once i've chosen an ID and password for a service I can easily type that in using literally anything that can connect to the service and spew out some characters. An id linked to a SIM/# is is a real pain in the ass when you need to change your SIM/#, hence why i've got a bunch of old contact numbers for people stored on my phone alongside new ones so I can talk to them on whatsapp or signal and have it show me their name still after they change numbers. I've also got a bunch of whatsapp contacts that aren't even people I know any more because their numbers no longer belong to them. People who's pictures and updates I can see who I don't recognize or know. SIM/#'s are ephemeral in a lot of places, I know people that change them fairly regularly, having that linked as some kind of identifier is not good for users.
- maxerickson 7y ago
  In what way is that practical for a user? This is just me making an assertion, so take it for what you will, but the typical user cares a lot more about contact discovery than everything you mentioned, so an authentication system that makes that work more goodly is quite practical for them.
  - grawprog 7y ago
    >contact discovery In both situations I have to have a contact's information already to find them. For a ID/password, you need your contact's ID to find them, for a SIM/# system, you need their phone number, every person I talk to on whatsapp or signal have given me their phone number, or vice versa, so we can communicate through those platforms. I had some friends that used Kik before, they had to give me their username. These two scenarios are exactly the same, in both cases I still need info from my contact before finding them. Only, an ID is more secure, because it can be used only with one service if you so choose, with a SIM/# you have to give your contact your phone number, allowing them to contact you through any other service you use that number with, whether you like it or not. I cannot see any benefits of that system for the user that you don't get from a ID/password and some cons that personally, I find unacceptable, such as the afore mentioned, seeing stranger's pictures and info just because they have a number my friend used to have, that's downright creepy and makes me wonder how many people who've saved my number can watch me on whatsapp and see when I'm online or check my profile out. Even people I do know, I don't necessarily want to see on there, employers, numbers i've saved for looking at places to rent, my ex landlord, clients i've had for work i've done. I don't need or want to have all these people automatically added to every chat program I install they also happen to have.
    - maxerickson 7y ago
      >typical user My argument isn't that you are wrong about your wants and needs, it's that you aren't a typical user.
      - grawprog 7y ago
markovbot 7y ago
> they have no plans on changing that I think you might be wrong on that, based some of the code changes made to Signal over the last few months. They are internally moving to have users be identified by a UUID and phone number. I suspect they will eliminate the requirement for phone number identifiers when they introduce other identifier options.
kick 7y ago
Moxie said at his C63C talk that they were planning on getting rid of it as soon as a practical solution was found.

NikolaNovak 7y ago

I don't believe it's "SIM as ID" - I believe it's SIM as complete authentication (i.e. userID+password in traditional systems). (I have my thoughts on THAT as well, you'll be surprised, when it comes to security... we're nerding out about obtuse and obscure end-to-end encryption, meanwhile, majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging :-/ )

TheSpiceIsLife 7y ago
> majority of those 2bil users don't have a lock on their phone, and now they also have no protection on their messaging They still have in-transit protection due to end-to-end encryption, so no protection isn't necessarily true.

grawprog 7y ago

>SIM/# as ID is just too practical for both dev and user In what way is that practical for a user? Once i've chosen an ID and password for a service I can easily type that in using literally anything that can connect to the service and spew out some characters. An id linked to a SIM/# is is a real pain in the ass when you need to change your SIM/#, hence why i've got a bunch of old contact numbers for people stored on my phone alongside new ones so I can talk to them on whatsapp or signal and have it show me their name still after they change numbers. I've also got a bunch of whatsapp contacts that aren't even people I know any more because their numbers no longer belong to them. People who's pictures and updates I can see who I don't recognize or know. SIM/#'s are ephemeral in a lot of places, I know people that change them fairly regularly, having that linked as some kind of identifier is not good for users.

maxerickson 7y ago
In what way is that practical for a user? This is just me making an assertion, so take it for what you will, but the typical user cares a lot more about contact discovery than everything you mentioned, so an authentication system that makes that work more goodly is quite practical for them.
- grawprog 7y ago
  >contact discovery In both situations I have to have a contact's information already to find them. For a ID/password, you need your contact's ID to find them, for a SIM/# system, you need their phone number, every person I talk to on whatsapp or signal have given me their phone number, or vice versa, so we can communicate through those platforms. I had some friends that used Kik before, they had to give me their username. These two scenarios are exactly the same, in both cases I still need info from my contact before finding them. Only, an ID is more secure, because it can be used only with one service if you so choose, with a SIM/# you have to give your contact your phone number, allowing them to contact you through any other service you use that number with, whether you like it or not. I cannot see any benefits of that system for the user that you don't get from a ID/password and some cons that personally, I find unacceptable, such as the afore mentioned, seeing stranger's pictures and info just because they have a number my friend used to have, that's downright creepy and makes me wonder how many people who've saved my number can watch me on whatsapp and see when I'm online or check my profile out. Even people I do know, I don't necessarily want to see on there, employers, numbers i've saved for looking at places to rent, my ex landlord, clients i've had for work i've done. I don't need or want to have all these people automatically added to every chat program I install they also happen to have.
  - maxerickson 7y ago
    >typical user My argument isn't that you are wrong about your wants and needs, it's that you aren't a typical user.
    - grawprog 7y ago

markovbot 7y ago

> they have no plans on changing that I think you might be wrong on that, based some of the code changes made to Signal over the last few months. They are internally moving to have users be identified by a UUID and phone number. I suspect they will eliminate the requirement for phone number identifiers when they introduce other identifier options.

kick 7y ago

Moxie said at his C63C talk that they were planning on getting rid of it as soon as a practical solution was found.