3 ms·
Sure, it makes it more usable. (Though, I use Telegram & WhatsApp with many contacts just fine without sharing my contact list with them, neither once nor the r
by gojomo 7y ago
Sure, it makes it more usable. (Though, I use Telegram & WhatsApp with many contacts just fine without sharing my contact list with them, neither once nor the repeated-uploads Signal wants.)
But Signal could still be keeping a database log of everyone who's actually ever sent a message to anyone else. (To the extent anyone's using 'sealed sender', it'd be harder – but apps like Wire could do something equivalent to 'sealed sender', too.) And that database is way more valuable to many attackers if it's keyed by the phone-numbers Signal has, compared to the aliases other systems have.
And to the extent the Signal client wants to keep re-uploading my entire contact-list, even a one-time, temporary compromise of their SGX-based system would reveal all my phone contacts.
- tptacek 7y agoThe synchronized contact list feature of other messengers requires them to keep the contract graph stored. We don't have to wonder whether they're logging it; they have to be.