3 ms·

Signal leaks your telephone number to everyone with whom you communicate, which is a privacy disaster before you even send your first message. (Please don't tak

Signal leaks your telephone number to everyone with whom you communicate, which is a privacy disaster before you even send your first message. (Please don't take this as implicit approval for Telegram's approach to secure messaging, but at least they managed not to cock up in such a basic way.)

jolux 6y ago
This has been explained on HN ad nauseam. It leaks less metadata than anything else, the phone number is the only metadata that it leaks (only to people you’re messaging, mind), and they’re working on a solution to that problem right now. It works that way because the developers wanted to avoid holding a central server with metadata for their entire user base. Instead it uses your local contact list to discover other users. I would say that being unencrypted by default and having a centralized metadata directory in plaintext is more of a cock-up in secure messaging than taking a rigorous and cautious approach to metadata leakage.
- qhwudbebd 6y ago
  The constant repetition is indeed nauseating. It's also nonsense. There is another unique identifier that's stored in the local contact list: email addresses. Use either email address or a phone number as an identifier, and you've no longer built a offensively privacy-violating service but have exactly the same distributed property.
  - jolux 6y ago
    You can use any phone number to sign up, it doesn’t have to be the one on your SIM. The rationale is that people typically text using phone numbers, and they wanted to make it easier to text people securely. It’s not nonsense, it makes perfect sense, and again, they’re working on it: https://signal.org/blog/signal-pins/ https://signal.org/blog/signal-pins/ If you only have access to one phone number and not giving it out is critical, then Signal might not be the right choice for you. But you won’t find a more secure channel that collects less metadata anywhere else.
    - qhwudbebd 6y ago
      People typically email using email addresses, and text using phone numbers. They're both messaging identifiers that might be easily be repurposed for Signal. There's no property of the latter that makes them a better choice than the former, but the existing ecosystem makes a disposable or role email address a much easier thing to obtain, and in general leaking an email address a far-less-damaging privacy violation than leaking a phone number, which can so easily be used to harass and directly track you. In many parts of the world, disposable mobile numbers are very definitely not a practical thing. The correct starting point here is to use either an email or a telephone number as an external ID. It's still not perfect, but at least it's not a complete disaster any more. Alas they've been 'working on it' for a very long time now, and are likely to fail because of this painfully slow progress. Perhaps if they'd pissed around less with trivia like cryptographically secure stickers, they might have increased their chances of becoming a useful product before they end up surrendering the space to an inferior product which gains too much market share to overcome before they're even properly off the starting blocks. I criticise Signal here because I like the design and hate their botched execution, not because I dislike the protocol. On the contrary, I dearly want something that competent to succeed, but fear we're rapidly losing the chance of that happening because they have launched a privacy-disaster product and most of the potential market will have seen that, dismissed it and forgotten about it before they pull their finger out and fix it.
      - jolux 6y ago
        Yeah but even with the phone number “leaking” (only to the recipient) nothing else even comes close to it. If your standard calls Signal a privacy disaster, what kind of product would you expect people to use? Everything else either involves storing comprehensive metadata in plaintext or worse durable logs of all conversation and interaction. Prepaid SIMs are pretty cheap and outside the US most phones are unlocked. Emails are too easy to fake and generally abuse. Nobody has solved this problem yet.

jolux 6y ago

This has been explained on HN ad nauseam. It leaks less metadata than anything else, the phone number is the only metadata that it leaks (only to people you’re messaging, mind), and they’re working on a solution to that problem right now. It works that way because the developers wanted to avoid holding a central server with metadata for their entire user base. Instead it uses your local contact list to discover other users. I would say that being unencrypted by default and having a centralized metadata directory in plaintext is more of a cock-up in secure messaging than taking a rigorous and cautious approach to metadata leakage.

qhwudbebd 6y ago
The constant repetition is indeed nauseating. It's also nonsense. There is another unique identifier that's stored in the local contact list: email addresses. Use either email address or a phone number as an identifier, and you've no longer built a offensively privacy-violating service but have exactly the same distributed property.
- jolux 6y ago
  You can use any phone number to sign up, it doesn’t have to be the one on your SIM. The rationale is that people typically text using phone numbers, and they wanted to make it easier to text people securely. It’s not nonsense, it makes perfect sense, and again, they’re working on it: https://signal.org/blog/signal-pins/ https://signal.org/blog/signal-pins/ If you only have access to one phone number and not giving it out is critical, then Signal might not be the right choice for you. But you won’t find a more secure channel that collects less metadata anywhere else.
  - qhwudbebd 6y ago
    People typically email using email addresses, and text using phone numbers. They're both messaging identifiers that might be easily be repurposed for Signal. There's no property of the latter that makes them a better choice than the former, but the existing ecosystem makes a disposable or role email address a much easier thing to obtain, and in general leaking an email address a far-less-damaging privacy violation than leaking a phone number, which can so easily be used to harass and directly track you. In many parts of the world, disposable mobile numbers are very definitely not a practical thing. The correct starting point here is to use either an email or a telephone number as an external ID. It's still not perfect, but at least it's not a complete disaster any more. Alas they've been 'working on it' for a very long time now, and are likely to fail because of this painfully slow progress. Perhaps if they'd pissed around less with trivia like cryptographically secure stickers, they might have increased their chances of becoming a useful product before they end up surrendering the space to an inferior product which gains too much market share to overcome before they're even properly off the starting blocks. I criticise Signal here because I like the design and hate their botched execution, not because I dislike the protocol. On the contrary, I dearly want something that competent to succeed, but fear we're rapidly losing the chance of that happening because they have launched a privacy-disaster product and most of the potential market will have seen that, dismissed it and forgotten about it before they pull their finger out and fix it.
    - jolux 6y ago
      Yeah but even with the phone number “leaking” (only to the recipient) nothing else even comes close to it. If your standard calls Signal a privacy disaster, what kind of product would you expect people to use? Everything else either involves storing comprehensive metadata in plaintext or worse durable logs of all conversation and interaction. Prepaid SIMs are pretty cheap and outside the US most phones are unlocked. Emails are too easy to fake and generally abuse. Nobody has solved this problem yet.