3 ms·

So what is to stop me from signing up for a Signal account using your phone number? It's patently obvious that to use phone numbers as identifiers you have to p

So what is to stop me from signing up for a Signal account using your phone number? It's patently obvious that to use phone numbers as identifiers you have to prove control over them at some point. That involves the telephone network. Thus any service which uses phone numbers to identify people necessarily inherits the security issues of that network. Edit: Yes, and I'm saying that the latter can actually be secure.

BugsJustFindMe 5y ago
> That involves the telephone network. No, you misunderstand me. The reason I didn't say anything about the transport mechanism is because it doesn't make a fundamental difference. People hijack domains and internet packet routes through both technological and social engineering attacks literally all the time. None of the complaints in your post have anything to do with any essential or necessary characteristics of phone numbers or phone networks or phone service operators. Email messages are routed to your domain by a gentleperson's handshake agreement between networks outside of your control plus a little bit of government regulation in exactly the same way that phone messages are routed to your phone by gentleperson's handshake agreement between networks outside of your control plus a little bit of government regulation. All possible arguments about routing trust being violated apply equally to both networks. All possible ideas about layering security on top of the network, like e.g. TLS handshakes, apply equally to both networks. > It's patently obvious that to use phone numbers as identifiers you have to prove control over them at some point. Signal doesn't ask for your phone number to prove the network path for your messages. What they're trying to assess is whether some entry in someone else's contacts list can be associated with your identity. If they wanted to, they could ask you to show up in person with a valid phone service contract and let them set up your client account directly. People just wouldn't bother to use Signal then. > So what is to stop me from signing up for a Signal account using your phone number? The same exact things that stop me from signing up for things using your email address. I could get someone to route requests for your domain to my servers if I had sufficient criminal intent.

BugsJustFindMe 5y ago

> That involves the telephone network. No, you misunderstand me. The reason I didn't say anything about the transport mechanism is because it doesn't make a fundamental difference. People hijack domains and internet packet routes through both technological and social engineering attacks literally all the time. None of the complaints in your post have anything to do with any essential or necessary characteristics of phone numbers or phone networks or phone service operators. Email messages are routed to your domain by a gentleperson's handshake agreement between networks outside of your control plus a little bit of government regulation in exactly the same way that phone messages are routed to your phone by gentleperson's handshake agreement between networks outside of your control plus a little bit of government regulation. All possible arguments about routing trust being violated apply equally to both networks. All possible ideas about layering security on top of the network, like e.g. TLS handshakes, apply equally to both networks. > It's patently obvious that to use phone numbers as identifiers you have to prove control over them at some point. Signal doesn't ask for your phone number to prove the network path for your messages. What they're trying to assess is whether some entry in someone else's contacts list can be associated with your identity. If they wanted to, they could ask you to show up in person with a valid phone service contract and let them set up your client account directly. People just wouldn't bother to use Signal then. > So what is to stop me from signing up for a Signal account using your phone number? The same exact things that stop me from signing up for things using your email address. I could get someone to route requests for your domain to my servers if I had sufficient criminal intent.