3 ms·
Android [1] and iOS [2] both have APIs and UI to associate a custom instant messenger protocol entry, e.g. "Signal": "signalusername" with a real contact. SVR i
by lunixbochs 6y ago
Android [1] and iOS [2] both have APIs and UI to associate a custom instant messenger protocol entry, e.g. "Signal": "signalusername" with a real contact. SVR is thus not required to store Signal handles in my phone native contact list, so why do Moxie and others keep saying this is somehow necessary?
[1] https://developer.android.com/reference/android/provider/ContactsContract.CommonDataKinds.Im https://developer.android.com/reference/android/provider/Con...
[2] https://developer.apple.com/documentation/contacts/cncontactinstantmessageaddresseskey https://developer.apple.com/documentation/contacts/cncontact...
- tptacek 6y agoPeople expect a consistent "buddy list" of Signal contacts on all the platforms they use, and across reinstalls.
- ThePowerOfFuet 6y agoWhy wouldn't contact syncing also solve this? It's just another CardDAV field, no?
- anigbrowl 6y agoSome people do. While this makes makes things much more convenient for cross-platform use or the case where someone loses their phone and doesn't want to lose access to all their signal data, it lowers security (conceivably) and trust (definitely) when they're forced to store the contact information through the requirement of a PIN.
- tptacek 6y agoThough the article would (I guess unintentionally?) lead you to believe otherwise, you are not in fact forced to store your contact information with Signal. The word "some" is doing an interesting amount of work in your comment, incidentally, since every other mainstream messenger just stores this stuff in something like a serverside SQL database.
- anigbrowl 6y agoI based that belief not on the article but the fact that Signal threw up a modal dialog the other day and forced me to add a PIN which I had been postponing doing due to misgivings about the SGX thing. The word "some" is doing an interesting amount of work in your comment, incidentally, since every other mainstream messenger just stores this stuff in something like a serverside SQL database. It's only doing the work of disagreeing with your blanket assertion. I'm not now and nor have I ever gone about telling people they need to get off Signal and use [something else], so it's unclear to me why you'd read that into my comment.
- tptacek 6y agoI'm reacting to the "lowered trust" in your comment. I take exception to the idea that Signal has spent down any of their accumulated trust on this. What's especially galling to me is that this is Signal taking steps to resolve the biggest complaint nerds have about the platform, and then getting attacked for it.
- lunixbochs 6y agoIt's unclear if Signal is already storing contact lists serverside or not with the pin change, and not having clear messaging around that is part of the problem. Also Moxie suggested in the twitter thread that even if you disable the pin you'll end up with a device-generated key and contacts will still sync.
- tptacek 6y agoThey spent the last 6 years making people use phone numbers instead of usernames in order to avoid storing contact lists serverside, and now you think they're doing it just for the hell of it?
- anigbrowl 6y agoThe lowered trust is not relative to other platforms, just a reaction to being forced into particular configurations. I'm just sharing the the reaction from the very security-conscious non-nerd communities I know which tend to have a less is more' approach.