8 ms·

> how we think about concepts like privacy, security, and trust I was disappointed to see that a mobile number is needed and that this number is shown by defau

by Gys 6y ago

> how we think about concepts like privacy, security, and trust I was disappointed to see that a mobile number is needed and that this number is shown by default in groups. Mobile numbers are much more trackable then email addresses in my opinion. And I do not understand at all why others should be able to see them so easily. So I now prefer Telegram because at least it hides numbers in groups by default.

harry8 6y ago
Burner sim to setup and throw away addresses this concern. Telegram, messages in plaintext on the server? Encryption that isn't open? Yeah telegram is a bit of a non-starter if you have these kinds of concerns as far as I'm aware.
- K2L8M11N2 6y ago
  In most European countries you need to submit your ID to get any sort of working SIM card.
  - fossuser 6y ago
    If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’t have encryption on by default, roll their own cryptography, or some combination of all of these things. The phone number obsession on HN seems dumb to me - a meaningless thing for people to repeat and complain about that doesn’t actually matter so they can sound like they know what they’re talking about. I don’t get it. The only real criticism I have for signal is that they’re not federated so they’re vulnerable to shutdown. I think that’s okay though because we have Matrix working on that problem and having both is probably a good thing. It’s also a thoughtful and intentional choice: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ The response from Matrix: https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom
    - K2L8M11N2 6y ago
      I feel comfortable with giving my Telegram username out to random people on the internet and posting it on my website because it doesn’t mean anything outside of Telegram. I wouldn’t post my phone number publicly.
      - fossuser 6y ago
        That’s fair, thanks - I think for secure communication with people you don’t know personally or trust, it’d be better to use something that doesn’t share your phone number.
    - est31 6y ago
      > roll their own cryptography Signal did the same thing. They invented their own cryptographic algorithms. https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm And the social graph IS sent to servers by Signal. It's protected only by hashing (trivial to circumvent) and by the Intel SGX technology (a bit harder to circumvent, but I doubt that the US govt can't do it).
      - fossuser 6y ago
        My (limited) understanding is numbers are queried to see if accounts exist, but those queries are not connected to the users sending them (and they are obscured in transit). Am I wrong? Signal’s cryptography has also gotten a ton of attention, I don’t think the same is true for competitors.
        est31 6y ago
        Transit encryption is employed by other services as well. Whether there is de-correlation on the cloud backend I don't know. Maybe there is, but you can't really verify that and it's easy to correlate them again, especially if clients use ipv6 or non-CGNAT ipv4.
      - the_why_of_y 6y ago
        Signal's crypto is an incremental improvement of existing algorithms with good reputation, OTR and SCIMP. Telegram's crypto is reportedly designed from scratch, with questionable choices such as SHA1 and MAC-then-encrypt. https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest https://www.cryptofails.com/post/70546720222/telegrams-crypt... https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
  - squarefoot 6y ago
    That wouldn't be a problem in phones where the radio part is screened from the system (Pinephone?) so that implementing encryption can be effective. The SIM might be tied with my me, but any eavesdropper would see only noise because the outgoing data is encrypted by the system before entering the radio hardware and is decrypted by the system after leaving it. They can know I generated some traffic at a certain moment, which is the same information they could get from the carrier operator, but that's about it.
  - Nursie 6y ago
    In the UK you can buy a SIM from a vending machine in the airport.
- gruez 6y ago
  Don't you have to keep paying for the sim, otherwise someone else might "steal" your account once your phone number gets reused?
  - wayoutthere 6y ago
    Signal has an option to prevent this by locking the number with your PIN. This capability introduces plausible deniability that a phone number assigned to a SIM is actually associated with the number of a Signal account. Don't know if that matters legally or not. Also the people doing shady things are generally hopping accounts regularly anyway.
    - billme 6y ago
      PIN only stops registration for a fixed amount of time, believe 7-days, then the entity controlling the number would be able to reclaim the account. If the “attacker” maintained control, new devices that add the number from their contact list would get no alert; that is, the users would have to figure out the number is controlled by someone else.
      - ikawe 6y ago
        That’s 7 days since last use. So if you continue to use the app at least once every 7 days, it will remain registration locked. Also, anyone who had communicated with you before the switch would see a “safety number changed” notification if the number became affiliated with a new device.
        billme 6y ago
        Curious, where’s the “last use” in the documentation or code? Ask because I have seen other issues with the PIN vs docs and haven’t gotten to testing the recovery mode. EDIT: Found the related docs, appears they had been edited since I lasted looked at them; for example, you can now disable PIN reminders: https://support.signal.org/hc/en-us/articles/360007059792-Signal-PINs https://support.signal.org/hc/en-us/articles/360007059792-Si... And yes, “anyone who had communicated with you before the switch would see a ‘safety number changed’ notification if the number became affiliated with a new device” is correct, though so is my statement about new numbers adding the number. To be honest, I have caused the alerts to happen before, the other user had no idea what they meant, didn’t say anything, just clicked okay.
- emptysongglass 6y ago
  Both of these rhetorical claims are misinformation. Please don't do this. Telegram messages are encrypted at rest on Telegram's servers with the keys held by Telegram the company. [1] MTProto is fully open-source. [2] Here's a FAQ of Telegram's most frequent criticisms. [3] [1] https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests [2] https://core.telegram.org/mtproto https://core.telegram.org/mtproto [3] https://telegra.ph/How-really-secure-and-private-is-Telegram-09-02 https://telegra.ph/How-really-secure-and-private-is-Telegram...
  - Legogris 6y ago
    The "encrypted at rest" claim is completely meaningless since there's no way of verifying it. If their web client can read your messages by you reverifying your phone number, so can anyone else with access to their servers.
    - emptysongglass 6y ago
      But that's not true. We can verify a Cloud Chat message is wrapped in a key generated on a user's device. You can look at the client code and prove this. We can also prove that client-server messages must be decrypted on their way back to a user's device. [1] [1] https://core.telegram.org/mtproto#authorization-and-encryption https://core.telegram.org/mtproto#authorization-and-encrypti...
  - brnt 6y ago
    I wish it was different, but it isn't. Mtproto v2 seems OK, but it is not default, so hardly used. Server side encryption protects against very little. I like Telegram, but not for security. Nobody should.
    - emptysongglass 6y ago
      You wish what was different? My rebuttal specifically corrected false claims, without opinion.
enitihas 6y ago
Because mobile numbers enable much more easier use than emails. I talk to so many people on WhatsApp who don't even know what an email is, and would certainly never use the app if it couldn't pick their contacts from Contact List. The goal of Signal has always been "privacy for the masses". The experts always had 20 solutions available.
- em-bee 6y ago
  no, we don't have 20 options available. we also need to talk to people who don't understand the problem and can't be persuaded to use one of those other options. there is a difference between enabling phonenumbers as an ID vs requiring them. signal could easily support both. (i read somewhere that they plan to support alternatives to phone numbers in the future, just haven't made it a priority. well, i'll wait. edit: actually it's mentioned here: https://news.ycombinator.com/item?id=23435050 https://news.ycombinator.com/item?id=23435050 )
- amaccuish 6y ago
  How did they install whatsapp if they didn't have an email, since you need one for the play store and app store?
correct_horse 6y ago
This is a fair concern, and I hope Signal Addresses it at some point, but Telegram is no replacement. From Telegram's Wikipedia page "The default messages and media use client-server encryption during transit.[19] This data is also encrypted at rest, but can be accessed by Telegram developers, who hold the encryption keys," and "the desktop clients (excluding macOS client) do not feature end-to-end encryption, nor is end-to-end encryption available for groups, supergroups, or channels." In addition, the Telegram server software is proprietary.
- saurik 6y ago
  It really depends on your threat model: do you trust the people you are talking to but not Signal (though in practice this doesn't even work as they are way too centralized, but whatever), or do you not trust the people you are talking to but are willing to trust Telegram? Clearly we should be able to have something where we don't trust either, as there is nothing about these phone numbers that is critical to Signal's operation (if anything, Signal is compromising basic important things to use them), but between these two choices it isn't clear to a lot of people why Signal's choice is better, given the actual use cases and threat models most people have.
  - kelnos 6y ago
    The fewer people who you're required to trust, the fewer breaches there will be, even if no one is malicious and those breaches are accidental. And ultimately even if the people you are talking to and your messaging provider are 100% trustworthy and never make mistakes, they usually cannot resist a lawful government request for data. Signal just has virtual no data available to provide them; Telegram could give them entire chat histories, and could be required to provide access to in-progress chats.
  - gdmka 6y ago
    Moxie addressed the phone number issue[0]. To save time he mentions that owning a SIM card or a smartphone with a Contacts application that holds phone numbers is a portable social network by design. Pushing his idea further it's much easier for anyone to learn the penetration of Signal by checking against existing phone numbers. I can't imagine someone with a 200+ phone numbers querying service to validate a phone number is registered with Signal. And while nicknames sound perfect in theory they lack one specific thing — validation of authenticity of a speaker. By this i mean an impersonator can claim the username and pose as someone else. Given a lot of people use transparent nicknames on the internet, it can pose a threat. So even when the nicknames roll out as a feature of Signal, it's good to facilitate somehow that a party i'm in contact with is someone genuine. Checking against phone numbers can mitigate the risk of fraud. [0] https://youtu.be/Nj3YFprqAr8 https://youtu.be/Nj3YFprqAr8
patcon 6y ago
My belief is that Telegram excels at security theatre
IvanAchlaqullah 6y ago
> Mobile numbers are much more trackable then email addresses in my opinion. And I do not understand at all why others should be able to see them so easily. This is why I refuse to have Whatsapp and Signal, especially when you live in 3rd world country. It just take ONE SCREENSHOT of you saying something controversial in group chat, that screenshot goes viral to certain radical group, then your phone get spammed death threat. Not to mention you can and will go to jail if those radical group sue you, thanks to draconian laws (UU ITE) here in Indonesia. You didn't get to jail because you said something that actually insulting someone, you get jailed because you are TRANSMITTING something that can be interpreted as an insult.
aendruk 6y ago
> a mobile number is needed They're laying the groundwork to change this. Part of the purpose of the PINs rolled out last month is to enable centralizing some data to allow for other addressing schemes.
lliamander 6y ago
As I understand it, the purpose of using telephone numbers is that it can use the contact list stored on your phone without having to store contact lists on their servers. Contact lists can be useful information for an attacker. If Signal doesn't have it, it can't be taken from them.
- em-bee 6y ago
  how does having phone numbers help with storing contacts in the client? they could store any other contact id just as well. the only thing that phone numbers help with is discovability of signal users among your existing phone contact list. that is something i explicitly do not want. ever. telegram and wechat allow to block being found via phone numbers.
- Legogris 6y ago
  There's nothing inherent in phone numbers here. Both iOS and Android also allows you to add e-mail addresses (and other identifiers) to your local contacts. I'm yet to hear an argument as to why e-mail addresses or other identifiers can't be used in addition to phone numbers, or why it would be a complicating factor.
searchableguy 6y ago
Try https://getsession.org/ https://getsession.org/ which doesn't require phone numbers and is a fork of signal. It is still very early stage and discoverability/groups are half backed (can't add people to group after creating it with 10 being the limit) but it solves the centralisation problem of signal.
Krasnol 6y ago
They're working on the phone number issue: > PINs will also help facilitate new features like addressing that isn’t based exclusively on phone numbers, since the system address book will no longer be a viable way to maintain your network of contacts. https://signal.org/blog/signal-pins/ https://signal.org/blog/signal-pins/
gdmka 6y ago
Telegram isn't really a subject to compare to Signal. I own a cellphone number for an Eastern European provider and had been using Telegram solely for news reader purposes. None of the people i communicate knows the number. Much to my surprise i learned that Telegram cooperates with local authorities, i would never found it out if not for COVID-19. The messages i got were addressing the precautions and regulations during the pandemic. While i appreciate the effort, i feel like it's a clear overreach on Telegram's part. How do i know it was Telegram rather than the authorities themselves? The sender information clearly stated the sender was Telegram (same as a chatbox created to inform on What's new), i've got a push notification even though push notifications were app level turned off. Can't imagine Signal compromising the trust of it's userbase by sending any sort of material that comes from the healthcare department of whatever country my phone number would be from.
- Gys 6y ago
  As mentioned elsewhere it all about the threatmodel. I have a group where others like to be anonymous, at least to ppl they do not know (yet). They will very likely not care about authorities to see our messages as they have nothing to hide from that perspective.
  - gdmka 6y ago
    >They will very likely not care about authorities to see our messages as they have nothing to hide from that perspective. `Nothing to hide` isn't the point of my message but the willingness of Telegram to collaborate with 3rd parties be that for a good or bad cause is what concerned me. I already own a tool to get unsolicited messages — email.

by Gys 6y ago

harry8 6y ago

Burner sim to setup and throw away addresses this concern. Telegram, messages in plaintext on the server? Encryption that isn't open? Yeah telegram is a bit of a non-starter if you have these kinds of concerns as far as I'm aware.

K2L8M11N2 6y ago
In most European countries you need to submit your ID to get any sort of working SIM card.
- fossuser 6y ago
  If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’t have encryption on by default, roll their own cryptography, or some combination of all of these things. The phone number obsession on HN seems dumb to me - a meaningless thing for people to repeat and complain about that doesn’t actually matter so they can sound like they know what they’re talking about. I don’t get it. The only real criticism I have for signal is that they’re not federated so they’re vulnerable to shutdown. I think that’s okay though because we have Matrix working on that problem and having both is probably a good thing. It’s also a thoughtful and intentional choice: https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ The response from Matrix: https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom https://matrix.org/blog/2020/01/02/on-privacy-versus-freedom
  - K2L8M11N2 6y ago
    I feel comfortable with giving my Telegram username out to random people on the internet and posting it on my website because it doesn’t mean anything outside of Telegram. I wouldn’t post my phone number publicly.
    - fossuser 6y ago
      That’s fair, thanks - I think for secure communication with people you don’t know personally or trust, it’d be better to use something that doesn’t share your phone number.
  - est31 6y ago
    > roll their own cryptography Signal did the same thing. They invented their own cryptographic algorithms. https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm And the social graph IS sent to servers by Signal. It's protected only by hashing (trivial to circumvent) and by the Intel SGX technology (a bit harder to circumvent, but I doubt that the US govt can't do it).
    - fossuser 6y ago
      My (limited) understanding is numbers are queried to see if accounts exist, but those queries are not connected to the users sending them (and they are obscured in transit). Am I wrong? Signal’s cryptography has also gotten a ton of attention, I don’t think the same is true for competitors.
      - est31 6y ago
        Transit encryption is employed by other services as well. Whether there is de-correlation on the cloud backend I don't know. Maybe there is, but you can't really verify that and it's easy to correlate them again, especially if clients use ipv6 or non-CGNAT ipv4.
    - the_why_of_y 6y ago
      Signal's crypto is an incremental improvement of existing algorithms with good reputation, OTR and SCIMP. Telegram's crypto is reportedly designed from scratch, with questionable choices such as SHA1 and MAC-then-encrypt. https://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest https://www.cryptofails.com/post/70546720222/telegrams-crypt... https://eprint.iacr.org/2015/1177.pdf https://eprint.iacr.org/2015/1177.pdf
- squarefoot 6y ago
  That wouldn't be a problem in phones where the radio part is screened from the system (Pinephone?) so that implementing encryption can be effective. The SIM might be tied with my me, but any eavesdropper would see only noise because the outgoing data is encrypted by the system before entering the radio hardware and is decrypted by the system after leaving it. They can know I generated some traffic at a certain moment, which is the same information they could get from the carrier operator, but that's about it.
- Nursie 6y ago
  In the UK you can buy a SIM from a vending machine in the airport.
gruez 6y ago
Don't you have to keep paying for the sim, otherwise someone else might "steal" your account once your phone number gets reused?
- wayoutthere 6y ago
  Signal has an option to prevent this by locking the number with your PIN. This capability introduces plausible deniability that a phone number assigned to a SIM is actually associated with the number of a Signal account. Don't know if that matters legally or not. Also the people doing shady things are generally hopping accounts regularly anyway.
  - billme 6y ago
    PIN only stops registration for a fixed amount of time, believe 7-days, then the entity controlling the number would be able to reclaim the account. If the “attacker” maintained control, new devices that add the number from their contact list would get no alert; that is, the users would have to figure out the number is controlled by someone else.
    - ikawe 6y ago
      That’s 7 days since last use. So if you continue to use the app at least once every 7 days, it will remain registration locked. Also, anyone who had communicated with you before the switch would see a “safety number changed” notification if the number became affiliated with a new device.
      - billme 6y ago
        Curious, where’s the “last use” in the documentation or code? Ask because I have seen other issues with the PIN vs docs and haven’t gotten to testing the recovery mode. EDIT: Found the related docs, appears they had been edited since I lasted looked at them; for example, you can now disable PIN reminders: https://support.signal.org/hc/en-us/articles/360007059792-Signal-PINs https://support.signal.org/hc/en-us/articles/360007059792-Si... And yes, “anyone who had communicated with you before the switch would see a ‘safety number changed’ notification if the number became affiliated with a new device” is correct, though so is my statement about new numbers adding the number. To be honest, I have caused the alerts to happen before, the other user had no idea what they meant, didn’t say anything, just clicked okay.
emptysongglass 6y ago
Both of these rhetorical claims are misinformation. Please don't do this. Telegram messages are encrypted at rest on Telegram's servers with the keys held by Telegram the company. [1] MTProto is fully open-source. [2] Here's a FAQ of Telegram's most frequent criticisms. [3] [1] https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests [2] https://core.telegram.org/mtproto https://core.telegram.org/mtproto [3] https://telegra.ph/How-really-secure-and-private-is-Telegram-09-02 https://telegra.ph/How-really-secure-and-private-is-Telegram...
- Legogris 6y ago
  The "encrypted at rest" claim is completely meaningless since there's no way of verifying it. If their web client can read your messages by you reverifying your phone number, so can anyone else with access to their servers.
  - emptysongglass 6y ago
    But that's not true. We can verify a Cloud Chat message is wrapped in a key generated on a user's device. You can look at the client code and prove this. We can also prove that client-server messages must be decrypted on their way back to a user's device. [1] [1] https://core.telegram.org/mtproto#authorization-and-encryption https://core.telegram.org/mtproto#authorization-and-encrypti...
- brnt 6y ago
  I wish it was different, but it isn't. Mtproto v2 seems OK, but it is not default, so hardly used. Server side encryption protects against very little. I like Telegram, but not for security. Nobody should.
  - emptysongglass 6y ago
    You wish what was different? My rebuttal specifically corrected false claims, without opinion.

enitihas 6y ago

Because mobile numbers enable much more easier use than emails. I talk to so many people on WhatsApp who don't even know what an email is, and would certainly never use the app if it couldn't pick their contacts from Contact List. The goal of Signal has always been "privacy for the masses". The experts always had 20 solutions available.

em-bee 6y ago
no, we don't have 20 options available. we also need to talk to people who don't understand the problem and can't be persuaded to use one of those other options. there is a difference between enabling phonenumbers as an ID vs requiring them. signal could easily support both. (i read somewhere that they plan to support alternatives to phone numbers in the future, just haven't made it a priority. well, i'll wait. edit: actually it's mentioned here: https://news.ycombinator.com/item?id=23435050 https://news.ycombinator.com/item?id=23435050 )
amaccuish 6y ago
How did they install whatsapp if they didn't have an email, since you need one for the play store and app store?

correct_horse 6y ago

This is a fair concern, and I hope Signal Addresses it at some point, but Telegram is no replacement. From Telegram's Wikipedia page "The default messages and media use client-server encryption during transit.[19] This data is also encrypted at rest, but can be accessed by Telegram developers, who hold the encryption keys," and "the desktop clients (excluding macOS client) do not feature end-to-end encryption, nor is end-to-end encryption available for groups, supergroups, or channels." In addition, the Telegram server software is proprietary.

saurik 6y ago
It really depends on your threat model: do you trust the people you are talking to but not Signal (though in practice this doesn't even work as they are way too centralized, but whatever), or do you not trust the people you are talking to but are willing to trust Telegram? Clearly we should be able to have something where we don't trust either, as there is nothing about these phone numbers that is critical to Signal's operation (if anything, Signal is compromising basic important things to use them), but between these two choices it isn't clear to a lot of people why Signal's choice is better, given the actual use cases and threat models most people have.
- kelnos 6y ago
  The fewer people who you're required to trust, the fewer breaches there will be, even if no one is malicious and those breaches are accidental. And ultimately even if the people you are talking to and your messaging provider are 100% trustworthy and never make mistakes, they usually cannot resist a lawful government request for data. Signal just has virtual no data available to provide them; Telegram could give them entire chat histories, and could be required to provide access to in-progress chats.
- gdmka 6y ago
  Moxie addressed the phone number issue[0]. To save time he mentions that owning a SIM card or a smartphone with a Contacts application that holds phone numbers is a portable social network by design. Pushing his idea further it's much easier for anyone to learn the penetration of Signal by checking against existing phone numbers. I can't imagine someone with a 200+ phone numbers querying service to validate a phone number is registered with Signal. And while nicknames sound perfect in theory they lack one specific thing — validation of authenticity of a speaker. By this i mean an impersonator can claim the username and pose as someone else. Given a lot of people use transparent nicknames on the internet, it can pose a threat. So even when the nicknames roll out as a feature of Signal, it's good to facilitate somehow that a party i'm in contact with is someone genuine. Checking against phone numbers can mitigate the risk of fraud. [0] https://youtu.be/Nj3YFprqAr8 https://youtu.be/Nj3YFprqAr8

patcon 6y ago

My belief is that Telegram excels at security theatre

IvanAchlaqullah 6y ago

> Mobile numbers are much more trackable then email addresses in my opinion. And I do not understand at all why others should be able to see them so easily. This is why I refuse to have Whatsapp and Signal, especially when you live in 3rd world country. It just take ONE SCREENSHOT of you saying something controversial in group chat, that screenshot goes viral to certain radical group, then your phone get spammed death threat. Not to mention you can and will go to jail if those radical group sue you, thanks to draconian laws (UU ITE) here in Indonesia. You didn't get to jail because you said something that actually insulting someone, you get jailed because you are TRANSMITTING something that can be interpreted as an insult.

aendruk 6y ago

> a mobile number is needed They're laying the groundwork to change this. Part of the purpose of the PINs rolled out last month is to enable centralizing some data to allow for other addressing schemes.

lliamander 6y ago

As I understand it, the purpose of using telephone numbers is that it can use the contact list stored on your phone without having to store contact lists on their servers. Contact lists can be useful information for an attacker. If Signal doesn't have it, it can't be taken from them.

em-bee 6y ago
how does having phone numbers help with storing contacts in the client? they could store any other contact id just as well. the only thing that phone numbers help with is discovability of signal users among your existing phone contact list. that is something i explicitly do not want. ever. telegram and wechat allow to block being found via phone numbers.
Legogris 6y ago
There's nothing inherent in phone numbers here. Both iOS and Android also allows you to add e-mail addresses (and other identifiers) to your local contacts. I'm yet to hear an argument as to why e-mail addresses or other identifiers can't be used in addition to phone numbers, or why it would be a complicating factor.

searchableguy 6y ago

Try https://getsession.org/ https://getsession.org/ which doesn't require phone numbers and is a fork of signal. It is still very early stage and discoverability/groups are half backed (can't add people to group after creating it with 10 being the limit) but it solves the centralisation problem of signal.

Krasnol 6y ago

They're working on the phone number issue: > PINs will also help facilitate new features like addressing that isn’t based exclusively on phone numbers, since the system address book will no longer be a viable way to maintain your network of contacts. https://signal.org/blog/signal-pins/ https://signal.org/blog/signal-pins/

gdmka 6y ago

Telegram isn't really a subject to compare to Signal. I own a cellphone number for an Eastern European provider and had been using Telegram solely for news reader purposes. None of the people i communicate knows the number. Much to my surprise i learned that Telegram cooperates with local authorities, i would never found it out if not for COVID-19. The messages i got were addressing the precautions and regulations during the pandemic. While i appreciate the effort, i feel like it's a clear overreach on Telegram's part. How do i know it was Telegram rather than the authorities themselves? The sender information clearly stated the sender was Telegram (same as a chatbox created to inform on What's new), i've got a push notification even though push notifications were app level turned off. Can't imagine Signal compromising the trust of it's userbase by sending any sort of material that comes from the healthcare department of whatever country my phone number would be from.

Gys 6y ago
As mentioned elsewhere it all about the threatmodel. I have a group where others like to be anonymous, at least to ppl they do not know (yet). They will very likely not care about authorities to see our messages as they have nothing to hide from that perspective.
- gdmka 6y ago
  >They will very likely not care about authorities to see our messages as they have nothing to hide from that perspective. `Nothing to hide` isn't the point of my message but the willingness of Telegram to collaborate with 3rd parties be that for a good or bad cause is what concerned me. I already own a tool to get unsolicited messages — email.