5 ms·

Did Signal give solid reasoning for disallowing accounts and usage without an attached cell phone number? (I assume the question comes up frequently, but I don'

Did Signal give solid reasoning for disallowing accounts and usage without an attached cell phone number? (I assume the question comes up frequently, but I don't know the answer)

joering2 6y ago
I got $10 verizon prepaid and set up my whatsapp and signal that way.
- soohyung 6y ago
  Unfortunately in many countries even prepaid SIM cards are directly tied to government ID verification. I know this has been discussed many times, but I agree that it would be nice to be able to use Signal for secure communications without a phone number.
  - fy20 6y ago
    I find it interesting that Germany is one country which does this. A country which has strict privacy regulations and people prefer to use cash rather than cards, but they are happy to carry a device which can track their every movement and is tied to their government identification. This isn't an EU thing, there are quite a few EU countries where you can buy and activate a SIM without any ID. Have there been any cases where the people have spoken out against such regulations, and they have been reversed?
    - koheripbal 6y ago
      The history of terrorists using pre-paid SIMs/phones for both coordination and remote bomb detonation has necessitated this.
      - fy20 6y ago
        That seems kind of silly given you can easily buy a SIM card from eBay for another country that doesn't have such requirements.
      - salawat 6y ago
        Horse hockey. They'll still do the same thing, there'll just be larger networks of individuals who activate a SIM and then swap it with someone else. The terrorist excuse is no excuse at all. It's just a pragmatist's paving stone on the path to hell and tyranny.
shp0ngle 6y ago
I think it was (1) fighting spam and (2) the social graph already exists due to contact books. I think officially it’s just (2) and (1) is just a side effect, but I think it’s secretly more about (1)
- antris 6y ago
  >the social graph already exists due to contact books But you don't have to share your contacts with the app, no? In case you do, then I really don't see how Signal is considered secure. Having to share your phone number is bad enough, but uploading my whole contact list is just Orwellian.
arkadiyt 6y ago
Moxie has publicly tweeted that they're working on supporting Signal without phone numbers, e.g. here [1] and here [2]: [1]: https://twitter.com/moxie/status/1280904362999476226 https://twitter.com/moxie/status/1280904362999476226 [2]: https://twitter.com/moxie/status/1348031542606454785 https://twitter.com/moxie/status/1348031542606454785
freebuju 6y ago
From what I gather, the phone number is only used for identification of a user account. Can't exactly remember where I came across this information (probably an ama from their team on reddit) but Signal have recently said they are looking for ways to make the above not a requirement for its users. I don't see this sim lockdown being a problem unless you want to create a new account or for some reason your account has been logged out requiring 2FA. In my understanding, telegram also asks for SMS for 2FA on re-login. Though the 2FA code will be simultaneously sent to any other device you've logged the account in.
goatsi 6y ago
Using phone numbers as identifiers for encrypted messages is the core feature of Signal. It was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was literally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.
- Mediterraneo10 6y ago
  The problem is that in the years since Signal was launched like that, more and more countries around the world are requiring you to show ID to buy a SIM card, and then a copy of that ID is made and sent on to the authorities. So, the state has a one-to-one correlation between phone numbers and individuals, and so it can see who is using Signal.
  - goatsi 6y ago
    So? Signal is just a messaging client. The goal of Signal is to get it widely used by as many people as possible, so that it's a totally normal thing to have on your phone. If a country has gotten to the point that you would be targeted just for having an app installed, just changing to usernames wouldn't be enough, as users could be easily detected through network logging (thanks AWS and Google for killing domain fronting [0]). Your usecase sounds like it needs an app like Briar. [0] https://news.ycombinator.com/item?id=16970199 https://news.ycombinator.com/item?id=16970199
    - DanBC 6y ago
      > Signal is just a messaging client. It's pushed as a secure messaging client, and so when it doesn't meet the standards for that people will mention it so potential users have the information needed for a risk assessment.
      - goatsi 6y ago
        Security =/= Anonymity.
1_player 6y ago
Only phone numbers: your own contact list IS the social graph. You lose your SIM card, you lose your friends. Usernames: Signal needs to store your social graph (in a privacy preserving fashion) on a central server. So, paradoxically, phone numbers were the easiest and most secure option to start with.
- koheripbal 6y ago
  This is the core routing issue. If you don't have centralized system to locate a "user", then the only alternative is to broadcast all messages to everyone, which is not a scalable solution. Actually, there must be methods for distributed routing. How does TOR finally map a hidden service to an IP address? Maybe there can be a dynamic DNS service for user accounts on an anonymous messaging network?
  - qvtweqbvwe 6y ago
    Distributed Hash Tables

Did Signal give solid reasoning for disallowing accounts and usage without an attached cell phone number? (I assume the question comes up frequently, but I don't know the answer)

joering2 6y ago

I got $10 verizon prepaid and set up my whatsapp and signal that way.

soohyung 6y ago
Unfortunately in many countries even prepaid SIM cards are directly tied to government ID verification. I know this has been discussed many times, but I agree that it would be nice to be able to use Signal for secure communications without a phone number.
- fy20 6y ago
  I find it interesting that Germany is one country which does this. A country which has strict privacy regulations and people prefer to use cash rather than cards, but they are happy to carry a device which can track their every movement and is tied to their government identification. This isn't an EU thing, there are quite a few EU countries where you can buy and activate a SIM without any ID. Have there been any cases where the people have spoken out against such regulations, and they have been reversed?
  - koheripbal 6y ago
    The history of terrorists using pre-paid SIMs/phones for both coordination and remote bomb detonation has necessitated this.
    - fy20 6y ago
      That seems kind of silly given you can easily buy a SIM card from eBay for another country that doesn't have such requirements.
    - salawat 6y ago
      Horse hockey. They'll still do the same thing, there'll just be larger networks of individuals who activate a SIM and then swap it with someone else. The terrorist excuse is no excuse at all. It's just a pragmatist's paving stone on the path to hell and tyranny.

shp0ngle 6y ago

I think it was (1) fighting spam and (2) the social graph already exists due to contact books. I think officially it’s just (2) and (1) is just a side effect, but I think it’s secretly more about (1)

antris 6y ago
>the social graph already exists due to contact books But you don't have to share your contacts with the app, no? In case you do, then I really don't see how Signal is considered secure. Having to share your phone number is bad enough, but uploading my whole contact list is just Orwellian.

arkadiyt 6y ago

Moxie has publicly tweeted that they're working on supporting Signal without phone numbers, e.g. here [1] and here [2]: [1]: https://twitter.com/moxie/status/1280904362999476226 https://twitter.com/moxie/status/1280904362999476226 [2]: https://twitter.com/moxie/status/1348031542606454785 https://twitter.com/moxie/status/1348031542606454785

freebuju 6y ago

From what I gather, the phone number is only used for identification of a user account. Can't exactly remember where I came across this information (probably an ama from their team on reddit) but Signal have recently said they are looking for ways to make the above not a requirement for its users. I don't see this sim lockdown being a problem unless you want to create a new account or for some reason your account has been logged out requiring 2FA. In my understanding, telegram also asks for SMS for 2FA on re-login. Though the 2FA code will be simultaneously sent to any other device you've logged the account in.

goatsi 6y ago

Using phone numbers as identifiers for encrypted messages is the core feature of Signal. It was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was literally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.

Mediterraneo10 6y ago
The problem is that in the years since Signal was launched like that, more and more countries around the world are requiring you to show ID to buy a SIM card, and then a copy of that ID is made and sent on to the authorities. So, the state has a one-to-one correlation between phone numbers and individuals, and so it can see who is using Signal.
- goatsi 6y ago
  So? Signal is just a messaging client. The goal of Signal is to get it widely used by as many people as possible, so that it's a totally normal thing to have on your phone. If a country has gotten to the point that you would be targeted just for having an app installed, just changing to usernames wouldn't be enough, as users could be easily detected through network logging (thanks AWS and Google for killing domain fronting [0]). Your usecase sounds like it needs an app like Briar. [0] https://news.ycombinator.com/item?id=16970199 https://news.ycombinator.com/item?id=16970199
  - DanBC 6y ago
    > Signal is just a messaging client. It's pushed as a secure messaging client, and so when it doesn't meet the standards for that people will mention it so potential users have the information needed for a risk assessment.
    - goatsi 6y ago
      Security =/= Anonymity.

1_player 6y ago

Only phone numbers: your own contact list IS the social graph. You lose your SIM card, you lose your friends. Usernames: Signal needs to store your social graph (in a privacy preserving fashion) on a central server. So, paradoxically, phone numbers were the easiest and most secure option to start with.

koheripbal 6y ago
This is the core routing issue. If you don't have centralized system to locate a "user", then the only alternative is to broadcast all messages to everyone, which is not a scalable solution. Actually, there must be methods for distributed routing. How does TOR finally map a hidden service to an IP address? Maybe there can be a dynamic DNS service for user accounts on an anonymous messaging network?
- qvtweqbvwe 6y ago
  Distributed Hash Tables