4 ms·
Signal is not a social network, and it's the cross-platform replacement for SMS that you want it to be. Essentially RCS in that it requires a data network, but
by Sunspark 6y ago
Signal is not a social network, and it's the cross-platform replacement for SMS that you want it to be. Essentially RCS in that it requires a data network, but is better designed.
I don't think it's an issue that it uses your contact list. Why should that be a concern? It doesn't upload them into a database like other services.
Signal is a privacy app, not an anonymity app.
I see people expressing their concern about seeing their boss using the app, etc. and I just cannot relate. Is their argument that they prefer to use insecure SMS with their boss instead? What's the point? Both parties _already have_ each other's phone number as a unique identifier.
I only have a limited # of people I can use Signal with because I don't post my phone number everywhere, though I am old enough that I remember telephone books back when people used to give out their phone number and address and nobody thought anything of it.
- electriclove 6y agoWhy is it a concern that an app wants to use my contact list? Really??
- Sunspark 6y agoGiven that it isn't uploaded into a database, it shouldn't be a concern for you, and if it is, you better stop using your smartphone because you're already sharing it with Google.
- electriclove 6y agoI use Signal and don't like that it wants access to my contact list. I want a better way and if my little voice adds to a call for a better way, great. Don't tell me I shouldn't care.
- Sunspark 6y agoYou got the better way already. It's not being uploaded into a database.
- hunter2_ 6y agoIf a delivery pipeline is compromised such that the APK received through automatic updates in the Play Store no longer matches the published source code, the Contacts permission we already granted allows the app to start exfiltrating our contact lists. People who build from source (or regularly compare Play Store APKs to vetted builds before installing/updating) are the only ones who really have the assurance you're describing. (Substitute other OSes as able.)
- XorNot 6y agoAnd if the same thing happened to your banking app, or a root level CA... At some point it's a problem I'd like someone to be working on, but taking on a huge amount of individual burden for a low probability scenario isn't anyway to live life. Heck, switching to Signal wasn't high on my agenda list until the Whatsapp TC change suddenly made my entire Facebook Messenger contact list worry about these things - and now I'm completely off Messenger, but it took collective engagement.
- hunter2_ 6y agoI agree completely and I give Signal permission to use my contacts without the due diligence I wrote about. Just treating this more like a logic problem than an advice column, FWIW which isn't much I suppose.
- oarsinsync 6y agoIt’s fully functional without access to your contact list. You just lose auto discovery of contacts, and need to enter their numbers manually. It’s kinda like being back on ICQ, only without the additional contact search functions. The way I see it, you have three options: 1. Apps that upload your contact list to their server to contact match (like WhatsApp, and others) 2. Apps that use your contact list locally to match (like Signal, and others) 3. Apps that work without your contact list and let you do it manually (like Signal, and others) Are you looking for a fourth option? If so, what is it?
- Klwohu 6y agoHow can I make sure of this? In practical fact, I can't.
- lrvick 6y agoBeyond the KYC requirements in 200 countries that make phone number based systems useless for those in high risk situations... They have other less obvious problems. Today with a phone number you can: 1. Port it, steal 2FA and password resets, take over critical accounts that don't allow alternate 2FA (happened to two friends of mine) 2. Pay first party or shady second party bounty hunter cell carrier APIs to get current GPS location on a number. I do not even have a cell carrier anymore for these reasons, social consequences be damned.
- Forbo 6y agoYou can set a PIN in Signal to protect against SIM swap attacks.
- lrvick 6y agoThat won't stop contacts that now know your phone number from swapping you anyway to compromise other services that use SMS for 2FA. My whole point is revealing cell numbers you rely on to strangers is a bad call. Being forced to do it by baking them into a chat protocol is idiotic.
- gojomo 6y agoCan you prove to me it doesn't upload your contacts into a permanent database, without relying on trust of Intel SGX® brand DRM?
- cdprojektdead 6y ago> I see people expressing their concern about seeing their boss using the app, etc. and I just cannot relate. Here's a situation I ran into: I have a stalker ex with whom I went no-contact ages ago. Years have gone by, I've been lucky enough to not hear from them in a while, it finally seems like the nightmare is over. They forgot about me and moved on to other things. Then, they sign up for Signal. The app, for no discernable reason, sends them a message informing them that I'm also using it. Now I'm back in their head. I blocked their number on Signal, but I'm seeing "X viewed your profile" messages on LinkedIn, so it looks like the stalking frenzy might start again, all because Signal wants to be Whatsapp. Why? It's one thing to let any signal user message me, it's another to actively remind people that I'm still around and reachable using it. SMS does not do this.
- galfarragem 6y ago> Both parties _already have_ each other's phone number as a unique identifier. Do both parties need to have each other's phone number or is enough that one party has the other's phone number for the contact suggestion? I couldn't find it clearly stated in the article. Practical example: someone has a spam list of phone numbers in his contact list. Will Signal suggest passively profiles that match that numbers?
- hunter2_ 6y agoLet your "someone" be Bob and anyone on his "spam list" be Alice, and you've made it a given that Bob's contacts include Alice. If Alice installs Signal and Alice's contacts include Bob, then yes both parties will see the other suggested in their Signal app. Else no. In the past Alice could assume Bob is capable of receiving phone calls and SMS, and now Alice could assume Bob is capable of receiving phone calls and SMS and Signal messages. Is it too revealing for people to be able to know this 1 extra thing when they already knew 2 extremely similar things?