4 ms·

Signal is actively working on removing the phone number requirement. It's a hard identity problem.

orisho 7y ago
I don't get how it's a hard problem. For many years we got by without using phone numbers as identifiers to communicate online. Why not usernames? Or any other one of the myriad of phone number alternatives
- afuchs 7y ago
  Signal's developers don't want to store contact lists on their servers because of their concerns about privacy. They also worry about ease of use for non-technical users. Their solution is to use the end user's address book as a contact list with users' phone numbers acting as identifiers. The identifiers are mapped to endpoints with some method that is supposed to protect the end user's privacy. The app could encrypt a list of usernames and store it on a server, but that would affect usability for non-technical users.
  - orisho 7y ago
    It could store usernames locally on the phone and use the same method to psedonymize them. It seems to me that Signal devs just have a strong preference for the convenience of using phone numbers. That's okay, but does not make the change hard to make.
  - balladeer 7y ago
    They already have the solution and you’ve mentioned it.
- oneplane 7y ago
  Because you downgrade identity that way. With phone numbers you know it has to be connected to physical device and most of the times a person. With generic usernames you have nothing. This practically means you have to do some sort identity verification in meatspace beforehand.
  - grawprog 7y ago
    >With phone numbers you know it has to be connected to physical device and most of the times a person. That's not true. TextNow, and i'm sure others, will just give you a phone number through their app from whatever location you want that you can change nearly at any time. You can use it from a web browser, it doesn't need to be tied to a phone or anything else. I've personally used it responding to ads and things I'd rather not give my actual number for and a friend of mine used it on a phone for a year or so as their personal phone number when they couldn't afford to pay for regular phone service. That friend actually used one of those numbers to authenticate some other messaging service.
    - oneplane 7y ago
      Just because it's attached to TextNow doesn't mean it's not attached anywhere. But yes, things like number-as-ID or email based identity is flawed and has been manipulated and abused plenty of times. I'm not saying identity is a must or that it's either good or bad, I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. Also, depending on your jurisdiction it might be illegal to provide a number that isn't yours (varying from spam laws to identity theft), just as it might violate the EULA and suspend service from whoever wanted that number in the first place. Generally, if you want to circumvent doxing yourself there are plenty of methods, but we're talking about mass-market here. The rest uses Jabber with OTR or some form of the signal protocol or maybe plain PGP/GPG crypto. But if we go down the rabbit hole of niches we would have a completely different context to work from.
      - grawprog 7y ago
        >I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. The market's only like that because there's a lack of alternatives. 'The market' isn't an abstract entity that came into existence out of nowhere. Companies make the choice to provide only that option, people never chose this. Removing the ability to chat with people using a username and password is the downgrade, that existed long before SMS and phone verification and tying those services to what is essentially an epehemeral number not ever actually owned by you, but the company that provides it. There's plenty of places in the world where having a consistent phone number isn't really the norm. I've got friends i've saved multiple phone numbers for because they signed up to this or that messenger with different phone numbers. Phone numbers are useless as an identification method. I pointed this out in another comment, but because whatsapp and signal use this system, there are random people in my contacts list, whose profile pictures and status updates I can see, but I have no idea who they are because the people that used to have those phone numbers no longer have them and they were reassigned to someone else.
squarefoot 7y ago
That would be a huge step forward, and would make me seriously reconsider Signal. I know this would create the identification problem in contexts where one actually wants to give proof of his/hers identity by pairing the client to a personal piece of hardware, but I believe/hope there are better ways to accomplish this without tying the account to a phone number (==cellphone). Also, old netbooks can be purchased literally for the cost of a pizza at flea markets, and they're much much better platforms for building secure communications terminals; a lot more reliable and trustworthy than cellphones and tablets with their closed operating systems.
2J0 7y ago
Skype uses Signal protocol and allows call records deletion. AFAICR a email address registration will suffice instead of a phone number

I don't get how it's a hard problem. For many years we got by without using phone numbers as identifiers to communicate online. Why not usernames? Or any other one of the myriad of phone number alternatives

afuchs 7y ago
Signal's developers don't want to store contact lists on their servers because of their concerns about privacy. They also worry about ease of use for non-technical users. Their solution is to use the end user's address book as a contact list with users' phone numbers acting as identifiers. The identifiers are mapped to endpoints with some method that is supposed to protect the end user's privacy. The app could encrypt a list of usernames and store it on a server, but that would affect usability for non-technical users.
- orisho 7y ago
  It could store usernames locally on the phone and use the same method to psedonymize them. It seems to me that Signal devs just have a strong preference for the convenience of using phone numbers. That's okay, but does not make the change hard to make.
- balladeer 7y ago
  They already have the solution and you’ve mentioned it.
oneplane 7y ago
Because you downgrade identity that way. With phone numbers you know it has to be connected to physical device and most of the times a person. With generic usernames you have nothing. This practically means you have to do some sort identity verification in meatspace beforehand.
- grawprog 7y ago
  >With phone numbers you know it has to be connected to physical device and most of the times a person. That's not true. TextNow, and i'm sure others, will just give you a phone number through their app from whatever location you want that you can change nearly at any time. You can use it from a web browser, it doesn't need to be tied to a phone or anything else. I've personally used it responding to ads and things I'd rather not give my actual number for and a friend of mine used it on a phone for a year or so as their personal phone number when they couldn't afford to pay for regular phone service. That friend actually used one of those numbers to authenticate some other messaging service.
  - oneplane 7y ago
    Just because it's attached to TextNow doesn't mean it's not attached anywhere. But yes, things like number-as-ID or email based identity is flawed and has been manipulated and abused plenty of times. I'm not saying identity is a must or that it's either good or bad, I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. Also, depending on your jurisdiction it might be illegal to provide a number that isn't yours (varying from spam laws to identity theft), just as it might violate the EULA and suspend service from whoever wanted that number in the first place. Generally, if you want to circumvent doxing yourself there are plenty of methods, but we're talking about mass-market here. The rest uses Jabber with OTR or some form of the signal protocol or maybe plain PGP/GPG crypto. But if we go down the rabbit hole of niches we would have a completely different context to work from.
    - grawprog 7y ago
      >I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. The market's only like that because there's a lack of alternatives. 'The market' isn't an abstract entity that came into existence out of nowhere. Companies make the choice to provide only that option, people never chose this. Removing the ability to chat with people using a username and password is the downgrade, that existed long before SMS and phone verification and tying those services to what is essentially an epehemeral number not ever actually owned by you, but the company that provides it. There's plenty of places in the world where having a consistent phone number isn't really the norm. I've got friends i've saved multiple phone numbers for because they signed up to this or that messenger with different phone numbers. Phone numbers are useless as an identification method. I pointed this out in another comment, but because whatsapp and signal use this system, there are random people in my contacts list, whose profile pictures and status updates I can see, but I have no idea who they are because the people that used to have those phone numbers no longer have them and they were reassigned to someone else.

squarefoot 7y ago

That would be a huge step forward, and would make me seriously reconsider Signal. I know this would create the identification problem in contexts where one actually wants to give proof of his/hers identity by pairing the client to a personal piece of hardware, but I believe/hope there are better ways to accomplish this without tying the account to a phone number (==cellphone). Also, old netbooks can be purchased literally for the cost of a pizza at flea markets, and they're much much better platforms for building secure communications terminals; a lot more reliable and trustworthy than cellphones and tablets with their closed operating systems.

2J0 7y ago

Skype uses Signal protocol and allows call records deletion. AFAICR a email address registration will suffice instead of a phone number