5 ms·
I installed Signal recently, but was flabbergasted when it advised me to connect with someone they found in my phone contacts who has recently joined Signal. WT
by amenod 6y ago
I installed Signal recently, but was flabbergasted when it advised me to connect with someone they found in my phone contacts who has recently joined Signal. WTF? If I knew that my contacts were being shared with a 3rd party (Signal), I would never have signed up.
Still, better Signal than Facebook, I guess. :-/
P.S.: if I'm missing something and the check was done in privacy-conscious way, I would love to be corrected.
- draugadrotten 6y agohttps://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do... "Signal periodically sends truncated cryptographically hashed phone numbers for contact discovery. Names are never transmitted, and the information is not stored on the servers. The server responds with the contacts that are Signal users and then immediately discards this information. Your phone now knows which of your contacts is a Signal user and notifies you if your contact just started using Signal. "
- deleted 6y ago[deleted]
- chopin 6y agoIt's done via hashes which is why it might need some time that contacts on your phone are recognized that they are on Signal. Afaik, Signal servers have no information who your contacts are.
- tchalla 6y ago> If I knew that my contacts were being shared with a 3rd party (Signal), I would never have signed up. I think, you should read up a bit on how Signal manages contacts/address books. https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- bennyp101 6y agoI don't think they are shared in the same sense that it is shared with WhatsApp/Facebook etc. "Signal periodically sends truncated cryptographically hashed phone numbers for contact discovery. Names are never transmitted, and the information is not stored on the servers. The server responds with the contacts that are Signal users and then immediately discards this information. Your phone now knows which of your contacts is a Signal user and notifies you if your contact just started using Signal. " https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
- sneak 6y agoThe problem is that phone numbers are a small space for brute force, and depending on how much they truncate, this could be very close to uploading one's address book.
- kevincox 6y agoYup. Hashing phone numbers is basically useless. If they truncate enough there might be plausible deniability due to possible collisions but I suspect the chance of collision is still quite low as they don't want to annoy people with false positives.
- sneak 6y agoFalse positives would be sent to the device for local comparison against full hashes; it wouldn't "annoy people" because it would not trigger a match unless the full hash matched on device. There is indeed a way to truncate enough to balance the amount of data sent to the device vs privacy.
- kevincox 6y agoGood point, that would definitely preserve some privacy. I missed that option (basically now the Google Safe Browsing API works) and the Signal page isn't clear that this is how it works.
- deleted 6y ago[deleted]