5 ms·

Why Signal is marketed as a "private" application when in order to even evaluate it, users needs to give away their phone number, which can be considered as one

Why Signal is marketed as a "private" application when in order to even evaluate it, users needs to give away their phone number, which can be considered as one of the most private things that a person can have? They even share the phone number with some unspecified thirdparties, according to the privacy policy: > Third Parties. We work with third parties to provide some of our Services. For example, our Third-Party Providers send a verification code to your phone number when you register for our Services. I would be grateful for explanation.

Arnt 6y ago
I think the answer to that question is in the wording of the question itself. "One of the most private things." Make a list of those most private things and then evaluate the various messenger apps. Count the number of things on your list that are sent to each app's servers. I don't know what's on your list, but I know what's on mine, and no other messenger apps I've looked at gets below 1 item. What that item is varies. Which suggests to me that getting below 1 is difficult and that it might even be impossible.
- self_awareness 6y ago
  I have a private Jabber server (ejabberd) on my own VPS and my friends are using it to contact me. And before this, I was using IRC, so the server got my IP address and nothing more. My phone number is way more private than my IP address, which is dynamic anyway. I see lots of options that doesn't require giving up anything of importance.
  - Arnt 6y ago
    That jabber server presents no problems for you since you're the server operator, but your friends are giving you a complete list of their contacts, and metadata about their messages too. You take your own privacy seriously and ignore that of your friends. (Relevant anecdote: I know a case where a such a server admin discovered that his SO and a friend were messaging from the same residential IP address before breakfast.) If you don't give your friends access to your server, this issue is removed, of course. But then you don't market anything and have raised a giant usability obstacle to actually using the server for communicating.
    - self_awareness 6y ago
      Even if we drop all the facts about technicalities about this server (stored on an encrypted container, doesn't log, uses ssl, etc), I fail to see how a telephone number can be compared to a contact list in the privacy scale. The first one is probably top 3, where the second one could probably be maybe on 10th place (it's probably much higher if the user is doing something illegal though). You probably might argue that the privacy scale varies for different people, and of course this is true, but the telephone number is always more private than the contact list given that it's impossible -- in some countries -- to buy a SIM card that isn't tied to the citizen ID. So, Signal ties its accounts to my tax reports in a way. How's that private? But even if it can be compared in some way, then Signal requires both (phone + list), when I require just one (list), plus it's possible to set up different accounts on my server to diffuse the contact list if needed, what isn't possible on Signal. IP address requirement can't be removed, so I'm skipping it completely. Well, unless your comment wasn't about comparing Jabber to Signal, but just to point out privacy issues on my Jabber server, then OK. I understand and I agree that I don't follow every privacy standard (I don't have a privacy policy for example), but since I know exactly what's going on, I'm 100% sure that even my light take on the privacy protocols, my server is way more private than Signal ;).

Arnt 6y ago

I think the answer to that question is in the wording of the question itself. "One of the most private things." Make a list of those most private things and then evaluate the various messenger apps. Count the number of things on your list that are sent to each app's servers. I don't know what's on your list, but I know what's on mine, and no other messenger apps I've looked at gets below 1 item. What that item is varies. Which suggests to me that getting below 1 is difficult and that it might even be impossible.

self_awareness 6y ago
I have a private Jabber server (ejabberd) on my own VPS and my friends are using it to contact me. And before this, I was using IRC, so the server got my IP address and nothing more. My phone number is way more private than my IP address, which is dynamic anyway. I see lots of options that doesn't require giving up anything of importance.
- Arnt 6y ago
  That jabber server presents no problems for you since you're the server operator, but your friends are giving you a complete list of their contacts, and metadata about their messages too. You take your own privacy seriously and ignore that of your friends. (Relevant anecdote: I know a case where a such a server admin discovered that his SO and a friend were messaging from the same residential IP address before breakfast.) If you don't give your friends access to your server, this issue is removed, of course. But then you don't market anything and have raised a giant usability obstacle to actually using the server for communicating.
  - self_awareness 6y ago
    Even if we drop all the facts about technicalities about this server (stored on an encrypted container, doesn't log, uses ssl, etc), I fail to see how a telephone number can be compared to a contact list in the privacy scale. The first one is probably top 3, where the second one could probably be maybe on 10th place (it's probably much higher if the user is doing something illegal though). You probably might argue that the privacy scale varies for different people, and of course this is true, but the telephone number is always more private than the contact list given that it's impossible -- in some countries -- to buy a SIM card that isn't tied to the citizen ID. So, Signal ties its accounts to my tax reports in a way. How's that private? But even if it can be compared in some way, then Signal requires both (phone + list), when I require just one (list), plus it's possible to set up different accounts on my server to diffuse the contact list if needed, what isn't possible on Signal. IP address requirement can't be removed, so I'm skipping it completely. Well, unless your comment wasn't about comparing Jabber to Signal, but just to point out privacy issues on my Jabber server, then OK. I understand and I agree that I don't follow every privacy standard (I don't have a privacy policy for example), but since I know exactly what's going on, I'm 100% sure that even my light take on the privacy protocols, my server is way more private than Signal ;).