5 ms·

I don't get how it's a hard problem. For many years we got by without using phone numbers as identifiers to communicate online. Why not usernames? Or any other

by orisho 7y ago

I don't get how it's a hard problem. For many years we got by without using phone numbers as identifiers to communicate online. Why not usernames? Or any other one of the myriad of phone number alternatives

afuchs 7y ago
Signal's developers don't want to store contact lists on their servers because of their concerns about privacy. They also worry about ease of use for non-technical users. Their solution is to use the end user's address book as a contact list with users' phone numbers acting as identifiers. The identifiers are mapped to endpoints with some method that is supposed to protect the end user's privacy. The app could encrypt a list of usernames and store it on a server, but that would affect usability for non-technical users.
- orisho 7y ago
  It could store usernames locally on the phone and use the same method to psedonymize them. It seems to me that Signal devs just have a strong preference for the convenience of using phone numbers. That's okay, but does not make the change hard to make.
- balladeer 7y ago
  They already have the solution and you’ve mentioned it.
oneplane 7y ago
Because you downgrade identity that way. With phone numbers you know it has to be connected to physical device and most of the times a person. With generic usernames you have nothing. This practically means you have to do some sort identity verification in meatspace beforehand.
- grawprog 7y ago
  >With phone numbers you know it has to be connected to physical device and most of the times a person. That's not true. TextNow, and i'm sure others, will just give you a phone number through their app from whatever location you want that you can change nearly at any time. You can use it from a web browser, it doesn't need to be tied to a phone or anything else. I've personally used it responding to ads and things I'd rather not give my actual number for and a friend of mine used it on a phone for a year or so as their personal phone number when they couldn't afford to pay for regular phone service. That friend actually used one of those numbers to authenticate some other messaging service.
  - oneplane 7y ago
    Just because it's attached to TextNow doesn't mean it's not attached anywhere. But yes, things like number-as-ID or email based identity is flawed and has been manipulated and abused plenty of times. I'm not saying identity is a must or that it's either good or bad, I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. Also, depending on your jurisdiction it might be illegal to provide a number that isn't yours (varying from spam laws to identity theft), just as it might violate the EULA and suspend service from whoever wanted that number in the first place. Generally, if you want to circumvent doxing yourself there are plenty of methods, but we're talking about mass-market here. The rest uses Jabber with OTR or some form of the signal protocol or maybe plain PGP/GPG crypto. But if we go down the rabbit hole of niches we would have a completely different context to work from.
    - grawprog 7y ago
      >I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. The market's only like that because there's a lack of alternatives. 'The market' isn't an abstract entity that came into existence out of nowhere. Companies make the choice to provide only that option, people never chose this. Removing the ability to chat with people using a username and password is the downgrade, that existed long before SMS and phone verification and tying those services to what is essentially an epehemeral number not ever actually owned by you, but the company that provides it. There's plenty of places in the world where having a consistent phone number isn't really the norm. I've got friends i've saved multiple phone numbers for because they signed up to this or that messenger with different phone numbers. Phone numbers are useless as an identification method. I pointed this out in another comment, but because whatsapp and signal use this system, there are random people in my contacts list, whose profile pictures and status updates I can see, but I have no idea who they are because the people that used to have those phone numbers no longer have them and they were reassigned to someone else.
- JoshTriplett 7y ago
  Why do you need to know anything about identity? The only important question is whether you control the keys used to initially register that identity. There's potentially value in having the option to link two identifiers together, so that people can find you on Signal via phone number or email address. But only as an option.
  - oneplane 7y ago
    Because you want to know who you're talking to. Generally, the mass market uses phone numbers or email addressees to 'find' and 'identify' each other.
    - em-bee 7y ago
      i find usernames much more convenient. the only time a phone number is useful is when it is already in my contact list. but this assumes that on first contact people still exchange phonenumbers. i stopped giving out my phone number years ago. when i meet someone, i give them my username on the communication service that we both choose. the phonenumber adds absolutely no value here. on the contrary, my username is easier to remember than any number. you don't even need to write it down.
- HenryBemis 7y ago
  So we didn't do this back in the day of ICQ? Or any IRC/telnet chats? Or emails?
  - oneplane 7y ago
    We did, but then we upgraded to (semi-)fixed identities using phone numbers. And losing something that was perceived as a gained feature is much harder.
- m-p-3 7y ago
  > you have to do some sort identity verification in meatspace beforehand In fact they still recommend doing a physical verification by comparing the safety number.

by orisho 7y ago

afuchs 7y ago

Signal's developers don't want to store contact lists on their servers because of their concerns about privacy. They also worry about ease of use for non-technical users. Their solution is to use the end user's address book as a contact list with users' phone numbers acting as identifiers. The identifiers are mapped to endpoints with some method that is supposed to protect the end user's privacy. The app could encrypt a list of usernames and store it on a server, but that would affect usability for non-technical users.

orisho 7y ago
It could store usernames locally on the phone and use the same method to psedonymize them. It seems to me that Signal devs just have a strong preference for the convenience of using phone numbers. That's okay, but does not make the change hard to make.
balladeer 7y ago
They already have the solution and you’ve mentioned it.

oneplane 7y ago

Because you downgrade identity that way. With phone numbers you know it has to be connected to physical device and most of the times a person. With generic usernames you have nothing. This practically means you have to do some sort identity verification in meatspace beforehand.

grawprog 7y ago
>With phone numbers you know it has to be connected to physical device and most of the times a person. That's not true. TextNow, and i'm sure others, will just give you a phone number through their app from whatever location you want that you can change nearly at any time. You can use it from a web browser, it doesn't need to be tied to a phone or anything else. I've personally used it responding to ads and things I'd rather not give my actual number for and a friend of mine used it on a phone for a year or so as their personal phone number when they couldn't afford to pay for regular phone service. That friend actually used one of those numbers to authenticate some other messaging service.
- oneplane 7y ago
  Just because it's attached to TextNow doesn't mean it's not attached anywhere. But yes, things like number-as-ID or email based identity is flawed and has been manipulated and abused plenty of times. I'm not saying identity is a must or that it's either good or bad, I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. Also, depending on your jurisdiction it might be illegal to provide a number that isn't yours (varying from spam laws to identity theft), just as it might violate the EULA and suspend service from whoever wanted that number in the first place. Generally, if you want to circumvent doxing yourself there are plenty of methods, but we're talking about mass-market here. The rest uses Jabber with OTR or some form of the signal protocol or maybe plain PGP/GPG crypto. But if we go down the rabbit hole of niches we would have a completely different context to work from.
  - grawprog 7y ago
    >I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade. The market's only like that because there's a lack of alternatives. 'The market' isn't an abstract entity that came into existence out of nowhere. Companies make the choice to provide only that option, people never chose this. Removing the ability to chat with people using a username and password is the downgrade, that existed long before SMS and phone verification and tying those services to what is essentially an epehemeral number not ever actually owned by you, but the company that provides it. There's plenty of places in the world where having a consistent phone number isn't really the norm. I've got friends i've saved multiple phone numbers for because they signed up to this or that messenger with different phone numbers. Phone numbers are useless as an identification method. I pointed this out in another comment, but because whatsapp and signal use this system, there are random people in my contacts list, whose profile pictures and status updates I can see, but I have no idea who they are because the people that used to have those phone numbers no longer have them and they were reassigned to someone else.
JoshTriplett 7y ago
Why do you need to know anything about identity? The only important question is whether you control the keys used to initially register that identity. There's potentially value in having the option to link two identifiers together, so that people can find you on Signal via phone number or email address. But only as an option.
- oneplane 7y ago
  Because you want to know who you're talking to. Generally, the mass market uses phone numbers or email addressees to 'find' and 'identify' each other.
  - em-bee 7y ago
    i find usernames much more convenient. the only time a phone number is useful is when it is already in my contact list. but this assumes that on first contact people still exchange phonenumbers. i stopped giving out my phone number years ago. when i meet someone, i give them my username on the communication service that we both choose. the phonenumber adds absolutely no value here. on the contrary, my username is easier to remember than any number. you don't even need to write it down.
HenryBemis 7y ago
So we didn't do this back in the day of ICQ? Or any IRC/telnet chats? Or emails?
- oneplane 7y ago
  We did, but then we upgraded to (semi-)fixed identities using phone numbers. And losing something that was perceived as a gained feature is much harder.
m-p-3 7y ago
> you have to do some sort identity verification in meatspace beforehand In fact they still recommend doing a physical verification by comparing the safety number.