9 ms·

This is basically a question of "should e2ee services allow users to auto-discover/discover each other or not?" Whatsapp just has a plaintext metadata mapping

This is basically a question of "should e2ee services allow users to auto-discover/discover each other or not?" Whatsapp just has a plaintext metadata mapping of the global social graph and each user's social graph. Signal has every user upload their address book into a secure enclave so that they can at least somewhat plausibly resist a subpoena for a user's social graph. This does not stop a determined attacker from making a list of all phone numbers/usernames on the service and discovering who is using the service (IE the former being an individual's social graph, which is hidden, vs the graph of all users which is discoverable). I don't think I've ever seen Signal say this, so this opinion is mine and not theirs, but I don't think Signal can actually protect who uses the service, only what they say on the service and who is in their social graph. A determined attacker, even if they didn't have this address book lookup tool, could correlate IP logs and learn a lot if they had an omniscient view of user traffic. The core question is this: should e2ee systems have any user growth/discovery tools or not? On some level the real question is "does Signal need to grow at all?". I think the answer is "yes" but that's not particularly grounded in any dogma other than people want to work on growing products. In summary, I don't think Signal hides who uses the service, only what their users say on the service (and who is in whom's address book). In this way Signal conceals each user's individual social graph but not the total social graph of who is using the service.

leptons 6y ago
>The core question is this: should e2ee systems have any user growth/discovery tools or not? On some level the real question is "does Signal need to grow at all?". I'm still VERY pissed off that Signal scanned my contacts without even asking me (I don't actually remember giving the app permission to do that). That was a big red flag for me.
- josh2600 6y ago
  I don't think it's possible for a non-apple/google app to access your address book on iOS or Android without you explicitly giving permission. Please correct me if I am wrong.
  - billiam 6y ago
    If we're seriously arguing in HN over whether something as fundamental as this is going on , imagine the confusion among potential users of Signal.
    - tialaramex 6y ago
      The fact users can become confused of something doesn't affect whether it's a fact or not. An insistence upon truths that contradict the facts works just fine except for the practical implications which are stubbornly unchanged. During WW2 there was tremendous innovation in the field of electronics and radio. Some way through the war, both sides began fitting relatively small radio transmitters to aircraft, which enables an equipped aircraft to actively transmit. So one obvious idea is to transmit "Hey I'm friendly" and then you know not to send up interceptors. So there's a nice switch on your bomber aeroplane that activates this fancy new "I'm friendly" transmitter, you are trained to switch it on as you return to base, and the chap fitting it seems damn sure it's important to switch it off when leaving. Which is odd right? I mean, it prevents getting shot down, stands to reason you'd turn it on all the time. And so, despite the urging of those who understood how it works, leaving it switched on was indeed common practice, and commanders would defend their crews for doing this, arguing that the perceived safety of the "Don't shoot me down" transmitter allowed them to press home attacks in conditions where it might otherwise be prudent to withdraw. Which is funny because of course the reason to switch off the transmitter is that it's a free homing beacon for enemy fighters and anti-aircraft weapons, so in choosing to do this they were actually significantly increasing their danger of death.
  - blendergeek 6y ago
    On Android at least, the apps have to ask for permission to see your contacts.
  - bosswipe 6y ago
    Before Android Marshmallow the contact permission wasn't explicitly requested. Marshmallow became widely available in 2016.
- dylan604 6y ago
  When I first installed it however many yearss ago that was, I nearly stopped because the first thing it did was ask for access to my contacts. I can't see that request for contacts access changing, so you have to be not remembering it. Then again, I'm on iPhone, so I can't speak to what Android does/doesn't do.
- bigiain 6y ago
  Signal has always asked for contact reading permission (I'm 99% certain), but it still does not do a good enough job of telling you "Once you grant this permission, we will notify every other Signal user in your contacts list that you are also now a Signal user". I still get pissed when it does that to friends of mine (and less pissed, but still unhappy when it does it to co workers, ex colleagues, work clients, government employees, taxi drivers, pizza delivers, and all the other random numbers my phone has saved in it's contact list over the last decade or so...)
tetha 6y ago
Hm. It's weird to dump growth and discovery into one pot, unless growth has a specific meaning there. You need to be able to add new users to a service... otherwise it's kind of empty, which defeats the point of a messaging service. Discovery I agree is a trade-off of security vs usability / service attractiveness. I'm fairly certain you could create something very hard if you assume 2 users meet in person once to exchange long identifiers and keys via QR-code scans. Add in burner phones and/or public WIFI and tracking that stops being feasible and you'd rather follow the human. However, that'd be very inconvenient and maybe impossible for many - and you'd be back at empty. And possible to target entirely.
nullc 6y ago
OTR solves auto-discover without any leaky central database by adding small amounts of coded whitespace to plain text messages you send which the other side recognizes. The far side can then initiate the OTR handshake.

leptons 6y ago

>The core question is this: should e2ee systems have any user growth/discovery tools or not? On some level the real question is "does Signal need to grow at all?". I'm still VERY pissed off that Signal scanned my contacts without even asking me (I don't actually remember giving the app permission to do that). That was a big red flag for me.

josh2600 6y ago
I don't think it's possible for a non-apple/google app to access your address book on iOS or Android without you explicitly giving permission. Please correct me if I am wrong.
- billiam 6y ago
  If we're seriously arguing in HN over whether something as fundamental as this is going on , imagine the confusion among potential users of Signal.
  - tialaramex 6y ago
    The fact users can become confused of something doesn't affect whether it's a fact or not. An insistence upon truths that contradict the facts works just fine except for the practical implications which are stubbornly unchanged. During WW2 there was tremendous innovation in the field of electronics and radio. Some way through the war, both sides began fitting relatively small radio transmitters to aircraft, which enables an equipped aircraft to actively transmit. So one obvious idea is to transmit "Hey I'm friendly" and then you know not to send up interceptors. So there's a nice switch on your bomber aeroplane that activates this fancy new "I'm friendly" transmitter, you are trained to switch it on as you return to base, and the chap fitting it seems damn sure it's important to switch it off when leaving. Which is odd right? I mean, it prevents getting shot down, stands to reason you'd turn it on all the time. And so, despite the urging of those who understood how it works, leaving it switched on was indeed common practice, and commanders would defend their crews for doing this, arguing that the perceived safety of the "Don't shoot me down" transmitter allowed them to press home attacks in conditions where it might otherwise be prudent to withdraw. Which is funny because of course the reason to switch off the transmitter is that it's a free homing beacon for enemy fighters and anti-aircraft weapons, so in choosing to do this they were actually significantly increasing their danger of death.
- blendergeek 6y ago
  On Android at least, the apps have to ask for permission to see your contacts.
- bosswipe 6y ago
  Before Android Marshmallow the contact permission wasn't explicitly requested. Marshmallow became widely available in 2016.
dylan604 6y ago
When I first installed it however many yearss ago that was, I nearly stopped because the first thing it did was ask for access to my contacts. I can't see that request for contacts access changing, so you have to be not remembering it. Then again, I'm on iPhone, so I can't speak to what Android does/doesn't do.
bigiain 6y ago
Signal has always asked for contact reading permission (I'm 99% certain), but it still does not do a good enough job of telling you "Once you grant this permission, we will notify every other Signal user in your contacts list that you are also now a Signal user". I still get pissed when it does that to friends of mine (and less pissed, but still unhappy when it does it to co workers, ex colleagues, work clients, government employees, taxi drivers, pizza delivers, and all the other random numbers my phone has saved in it's contact list over the last decade or so...)

tetha 6y ago

Hm. It's weird to dump growth and discovery into one pot, unless growth has a specific meaning there. You need to be able to add new users to a service... otherwise it's kind of empty, which defeats the point of a messaging service. Discovery I agree is a trade-off of security vs usability / service attractiveness. I'm fairly certain you could create something very hard if you assume 2 users meet in person once to exchange long identifiers and keys via QR-code scans. Add in burner phones and/or public WIFI and tracking that stops being feasible and you'd rather follow the human. However, that'd be very inconvenient and maybe impossible for many - and you'd be back at empty. And possible to target entirely.

nullc 6y ago

OTR solves auto-discover without any leaky central database by adding small amounts of coded whitespace to plain text messages you send which the other side recognizes. The far side can then initiate the OTR handshake.