6 ms·
I trust Signal's end-to-end encryption promise, but I have a problem with the application not offering anonymity or privacy. By demanding users to provide a cel
by daneel_w 6y ago
I trust Signal's end-to-end encryption promise, but I have a problem with the application not offering anonymity or privacy. By demanding users to provide a cell phone number to enable their accounts, they are connecting actual people to the Signal accounts and consequently also allowing them (or someone else) to visualize social networks; in intelligence gathering, data such as who speaks to whom, at what hours, with what message frequency etc. is highly valuable. It's also important that users ask themselves how Signal manages to finance all the SMS costs and the infrastructure when the application is gratis and free from ads.
- daneel_w 6y agoJust to add... yes, I know it's possible to register a Signal account with a disposable VLN, but how many Signal users can be expected to be "tech literate" to this level? Practically none.
- msy 6y agoGiven the demographic Signal attracts that seems like an unsafe assumption.
- Shared404 6y agoI would guess that a significant portion of Signal's users are non-technical people dragged there by their technical friends that couldn't get them onto Matrix. I would still guess that none is a bad assumption, however. Edit: Spelling
- daneel_w 6y agoPractically none. I think it's safe to assume it's not even 1 in 1000 who have registered with a VLN, or even know what one is.
- Shared404 6y agoYou raise a valid point. I would think that probably more than 1 in 1000 would know, but suspect you are right about how many actually would do it.
- tptacek 6y agoThe exact opposite privacy thing is happening with Signal. They use your phone number because your phone links it to your contacts, which Signal uses as its "buddy list". By repurposing your contacts as a buddy list, Signal avoids storing any of that information itself. Virtually every other competing service stores a plaintext buddy list serverside, where it can be subpoena'd and NSL'd. The data in that buddy list is of equal value to state-level adversaries as the contents of the messages themselves. I think --- I have no special knowledge here --- that nobody wants to do away with phone numbers more than Signal itself. That's what the "secure value storage" drama is about: using SGX to optionally vouchsafe an encrypted contact database, which would allow Signal to operate with opaque identifiers rather than contacts.
- ddevault 6y agoAh, yes, because it's impossible to store a contact list client-side. Or to encrypt arbitrary data like that to store server-side! Glad Moxie's looking out for us.
- tptacek 6y agoPlease point to the mainstream secure messenger other than Signal that doesn't store a database of contacts serverside.
- ddevault 6y agohttps://en.wikipedia.org/wiki/Whataboutism https://en.wikipedia.org/wiki/Whataboutism
- tptacek 6y agoI don't understand. You just claimed that it was easy for messengers to store contact databases clientside. Of course, it isn't, or everyone would. Asking you to provide evidence for your argument isn't "whataboutism". Not only that, but you're commenting on a thread about Signal's phone number requirement. You can't inject snark into a thread and then assume some kind of moral high ground when you faceplant.