6 ms·

Why is this downvoted?

eximius 7y ago
Contact Discovery is not seen as privacy invasive, I guess. It says, X has Signal, but that's it. So I see how it is, strictly speaking, broadcasting 'private' information, but it is hard to care terribly. I'm far more concerned by the privacy of my conversations than the fact I at one point installed signal.
- seemslegit 7y ago
  See, there's an apparently archaic concept in software called user preference - they could ask people upon joining if they want to be contact-discoverable or not.
  - eximius 7y ago
    And that's fair! It's not perfect. And, ignorantly, I would assume it'd be easy to add, so they probably should. But I can understand why this is a trade-off they'd make in terms of your comfort level (relatively rare to care about this) vs. massive use-ability and onboarding gains.
    - seemslegit 7y ago
      What you call "comfort level" is in fact the primary value proposition of a tool like signal and the fact that they have chosen to compromise on it to drive adoption is symptomatic of the many things wrong with the setting in which this decision was made. Not unlike calling out the EARNIT senators on using child abuse justifications in bad faith to promote the agenda of censorship and surveillance.
- ape4 7y ago
  But it means they have slurped all your contacts. How are they stored? Who are they shared with? etc
  - ajconway 7y ago
    It's really not a secret https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
  - propinquity 7y ago
    The Signal App, which is open source, periodically sends truncated cryptographically hashed phone numbers to the Signal server, which is also open source. The server does not store the truncated hashes that the app sends to the server. So, they only temporarily have partial hashes which they do not store or share with anyone.
  - eximius 7y ago
    The DO NOT slurp your contacts. They invented a way to do contact discovery in a secure way: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/. From the article: "Using this service, Signal clients will be able to efficiently and scalably determine whether the contacts in their address book are Signal users without revealing the contacts in their address book to the Signal service." This is why Signal gets so much benefit of the doubt from the cryptography/security/privacy community. Their default approach to these problems is conservative in favor of the user until they can invent the technology needed to support a feature with security/privacy.
    - ape4 7y ago
      Thanks. That's actually great, I was wrong.
    - lonelappde 7y ago
      > They invented a way to do contact discovery in a secure way: Their solution is to run contact discovery on a DRM Secure Enclave system. Ironic that their privacy solution is to use a technology that privacy advocates say is the spawn of Satan because it hands over control of your machine to Intel.
clarkevans 7y ago
Perhaps the parent is downvoted not because of the underlying content of the message, but because of the black/white framing. Every tool has a barrier to use, and even with a strong commitment to security/privacy, Signal seems to have decided that it's more beneficial for their users know which one of their friends are on Signal, than there is potential for abuse. Further, there may come a time where this calculus changes, for example, if spammers arrive on the Signal platform and start decreasing usability.
- rapnie 7y ago
  > Signal seems to have decided that it's more beneficial for their users know which one of their friends are on Signal I feel the reason might be more as a way to promote more widespread use of Signal itself, rather than directly serving their users.
  - dublinben 7y ago
    The creators of Signal surely believe that 'promoting the more widespread use of Signal itself' benefits their users. They're not for-profit company that exists for some other purpose.
  - nabnob 7y ago
    Signal relies on the user's contact list so that they don't have to store signal users in their servers.
dublinben 7y ago
It's off topic of the submitted article.
deleted 7y ago
[deleted]
saurik 7y ago
(Four hours after your comment and it wasn't just downvoted: it has now been flagged, marked dead, and is unavailable for anyone not logged in and you can no longer reply to it.)
- seemslegit 7y ago
  Seems quite lively now

Contact Discovery is not seen as privacy invasive, I guess. It says, X has Signal, but that's it. So I see how it is, strictly speaking, broadcasting 'private' information, but it is hard to care terribly. I'm far more concerned by the privacy of my conversations than the fact I at one point installed signal.

seemslegit 7y ago
See, there's an apparently archaic concept in software called user preference - they could ask people upon joining if they want to be contact-discoverable or not.
- eximius 7y ago
  And that's fair! It's not perfect. And, ignorantly, I would assume it'd be easy to add, so they probably should. But I can understand why this is a trade-off they'd make in terms of your comfort level (relatively rare to care about this) vs. massive use-ability and onboarding gains.
  - seemslegit 7y ago
    What you call "comfort level" is in fact the primary value proposition of a tool like signal and the fact that they have chosen to compromise on it to drive adoption is symptomatic of the many things wrong with the setting in which this decision was made. Not unlike calling out the EARNIT senators on using child abuse justifications in bad faith to promote the agenda of censorship and surveillance.
ape4 7y ago
But it means they have slurped all your contacts. How are they stored? Who are they shared with? etc
- ajconway 7y ago
  It's really not a secret https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
- propinquity 7y ago
  The Signal App, which is open source, periodically sends truncated cryptographically hashed phone numbers to the Signal server, which is also open source. The server does not store the truncated hashes that the app sends to the server. So, they only temporarily have partial hashes which they do not store or share with anyone.
- eximius 7y ago
  The DO NOT slurp your contacts. They invented a way to do contact discovery in a secure way: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/. From the article: "Using this service, Signal clients will be able to efficiently and scalably determine whether the contacts in their address book are Signal users without revealing the contacts in their address book to the Signal service." This is why Signal gets so much benefit of the doubt from the cryptography/security/privacy community. Their default approach to these problems is conservative in favor of the user until they can invent the technology needed to support a feature with security/privacy.
  - ape4 7y ago
    Thanks. That's actually great, I was wrong.
  - lonelappde 7y ago
    > They invented a way to do contact discovery in a secure way: Their solution is to run contact discovery on a DRM Secure Enclave system. Ironic that their privacy solution is to use a technology that privacy advocates say is the spawn of Satan because it hands over control of your machine to Intel.

clarkevans 7y ago

Perhaps the parent is downvoted not because of the underlying content of the message, but because of the black/white framing. Every tool has a barrier to use, and even with a strong commitment to security/privacy, Signal seems to have decided that it's more beneficial for their users know which one of their friends are on Signal, than there is potential for abuse. Further, there may come a time where this calculus changes, for example, if spammers arrive on the Signal platform and start decreasing usability.

rapnie 7y ago
> Signal seems to have decided that it's more beneficial for their users know which one of their friends are on Signal I feel the reason might be more as a way to promote more widespread use of Signal itself, rather than directly serving their users.
- dublinben 7y ago
  The creators of Signal surely believe that 'promoting the more widespread use of Signal itself' benefits their users. They're not for-profit company that exists for some other purpose.
- nabnob 7y ago
  Signal relies on the user's contact list so that they don't have to store signal users in their servers.

dublinben 7y ago

It's off topic of the submitted article.

deleted 7y ago

[deleted]

saurik 7y ago

(Four hours after your comment and it wasn't just downvoted: it has now been flagged, marked dead, and is unavailable for anyone not logged in and you can no longer reply to it.)

seemslegit 7y ago
Seems quite lively now