3 ms·
I don't think they are shared in the same sense that it is shared with WhatsApp/Facebook etc. "Signal periodically sends truncated cryptographically hashed pho
by bennyp101 6y ago
I don't think they are shared in the same sense that it is shared with WhatsApp/Facebook etc.
"Signal periodically sends truncated cryptographically hashed phone numbers for contact discovery. Names are never transmitted, and the information is not stored on the servers. The server responds with the contacts that are Signal users and then immediately discards this information. Your phone now knows which of your contacts is a Signal user and notifies you if your contact just started using Signal. "
https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts- https://support.signal.org/hc/en-us/articles/360007061452-Do...
- sneak 6y agoThe problem is that phone numbers are a small space for brute force, and depending on how much they truncate, this could be very close to uploading one's address book.
- kevincox 6y agoYup. Hashing phone numbers is basically useless. If they truncate enough there might be plausible deniability due to possible collisions but I suspect the chance of collision is still quite low as they don't want to annoy people with false positives.
- sneak 6y agoFalse positives would be sent to the device for local comparison against full hashes; it wouldn't "annoy people" because it would not trigger a match unless the full hash matched on device. There is indeed a way to truncate enough to balance the amount of data sent to the device vs privacy.
- kevincox 6y agoGood point, that would definitely preserve some privacy. I missed that option (basically now the Google Safe Browsing API works) and the Signal page isn't clear that this is how it works.