4 ms·

The guerilla growth marketers working for Signal would probably be unable to resist the viral temptation of spamming all your email address list who have alread

The guerilla growth marketers working for Signal would probably be unable to resist the viral temptation of spamming all your email address list who have already joined signal to "let them know" about your newly installed contact channel. I was super-annoyed when two people from my distant past started trying to contact me via Signal purely because of the unwanted and un-asked for behaviour of vacuum-and-spam notification of my phone contact list (which had accumulated from before 2000) who were in the subset of already-Signal-members. In particular one huckster I lost $22k to, and who I came close to being liable for taking illegal action on behalf, through his fraudulent lack of full disclosure, who I had thoroughly removed from all my social media, plus filtered his email straight to trash, and permanently blocked from calling my phone. Because his phone number was in my address book (so I could block him) Signal thought it had the right to let him know he can now contact me. Poor form there Signal...

egberts1 5y ago
write a big report?
- wizzwizz4 5y ago
  They already know about the problem; they've known for years now.
egberts1 5y ago
i am going to stop you there. The mere fact that you had a phone number in your address book is what made your locally client-side Signal app made the notification… locally. This newly discovered mechanism does not alert the remote Signal app. Just the mere fact that you allowed Signal app access to your local address book and actually ran all numbers against the central server is not clearly stated in their type of service (TOS). This is the primary reason why i never let Signal app have access to my Contacts/address-book. This is why we have no idea what else Signal is doing with remote phone numbers found in our address book. I was able to ascertain between two phones of this one-sided aspect (but for how long)?
- mmerlin 5y ago
  Yes! I expect any app or service to at least warn me first before they instigate unsolicited actions on my behalf. Signal has no doubt already legally covered their ass with regards to me giving this consent. However in reality I never would have allowed this if I was asked or even given a fraction of a hint as to what was about to happen once I gave them the requested permissions to be installed.
  - charrondev 5y ago
    One of the things I quite enjoy about the legal system in Quebec is our strong consumer protection laws. Additionally it is not possible for a consumer to “wave” any rights provided in our consumer protection act. That along with numerous parts of the law defining exactly what can be a binding contract create a system (with ample case law and precedent to back it up) where most company’s terms and conditions are not valid contracts in Quebec. If someone here were able to show harm and have standing in a case they would likely be able to bring a solid case forward.
  - tialaramex 5y ago
    They didn't take "unsolicited actions on [your] behalf" to drive this feature. The other person's phone looked at their address book and asked if it can reach you over Signal, which it can. It chooses to do this (it's a config option, on their phone). The "unsolicited action on your behalf" is that given access to your contacts your phone will provide your contacts with some information over Signal, such as a Signal name and profile picture you've set - if they ask for it, unless you've blocked them. So if you set your name in Signal to "Barry is God" as a joke, that might be awkward if your very religious parents get Signal, but then that's also probably true if the name outside your dorm says "Barry is God" or if that's what the name says next to your apartment buzzer or on Facebook... Likewise if the profile photo is of a marijuana leaf which was funny for two close friends on Signal but then your very straight boss gets Signal and they know your phone number... Signal doesn't want to be another niche app that you only use to send encryption nerd stuff to other nerds who also installed the nerd app. It wants to be for everybody for everything, because there is safety in numbers. If there are six encrypted messages sent in Iran, the secret police really could just track down, arrest and torture everybody who sent or received an encrypted message just in case. But if it's six million messages that's just not practical.
tialaramex 5y ago
> Because his phone number was in my address book (so I could block him) Signal thought it had the right to let him know he can now contact me. Nope. Because your number was in his address book, his device periodically asks Signal "Hey, can I use Signal to message this contact?" and once you use Signal it says "Yes". The fact he's in your contacts means, by default, your phone thinks you know each other and it should provide information like your preferred name and photo if asked. Of course if you've got the number in there "so I could block him" you should... block him. In Signal too. Having blocked him, your phone won't provide your information and he can't contact you on Signal. Under the hood if you do this, your phone ignores Signal messages from this number but it also mints fresh "postage stamps" for Signal's anonymous sender capability, it won't give the new ones to the newly blocked person and the old ones no longer work, so your actual friends can get new stamps and send you messages without even Signal being able to tell who sent them, but blocked people can't waste the service's time sending messages you won't even see. This capability is necessary for Signal to function as something more than a fun "secret decoder ring" for a small circle of nerds. Without it for example, the ex-colleague I suddenly needed to contact a month ago wouldn't have been reached over Signal, he had no reason to tell me, a person he rarely talks to, that he's got Signal since we last met, but since his phone does have Signal, and my phone checked my contact list, it knew that Signal would work and it transparently used Signal for the conversation.
- mmerlin 5y ago
  Yeah good point on the program logic there. I uninstalled Signal instead of blocking him

egberts1 5y ago

write a big report?

wizzwizz4 5y ago
They already know about the problem; they've known for years now.

egberts1 5y ago

i am going to stop you there. The mere fact that you had a phone number in your address book is what made your locally client-side Signal app made the notification… locally. This newly discovered mechanism does not alert the remote Signal app. Just the mere fact that you allowed Signal app access to your local address book and actually ran all numbers against the central server is not clearly stated in their type of service (TOS). This is the primary reason why i never let Signal app have access to my Contacts/address-book. This is why we have no idea what else Signal is doing with remote phone numbers found in our address book. I was able to ascertain between two phones of this one-sided aspect (but for how long)?

mmerlin 5y ago
Yes! I expect any app or service to at least warn me first before they instigate unsolicited actions on my behalf. Signal has no doubt already legally covered their ass with regards to me giving this consent. However in reality I never would have allowed this if I was asked or even given a fraction of a hint as to what was about to happen once I gave them the requested permissions to be installed.
- charrondev 5y ago
  One of the things I quite enjoy about the legal system in Quebec is our strong consumer protection laws. Additionally it is not possible for a consumer to “wave” any rights provided in our consumer protection act. That along with numerous parts of the law defining exactly what can be a binding contract create a system (with ample case law and precedent to back it up) where most company’s terms and conditions are not valid contracts in Quebec. If someone here were able to show harm and have standing in a case they would likely be able to bring a solid case forward.
- tialaramex 5y ago
  They didn't take "unsolicited actions on [your] behalf" to drive this feature. The other person's phone looked at their address book and asked if it can reach you over Signal, which it can. It chooses to do this (it's a config option, on their phone). The "unsolicited action on your behalf" is that given access to your contacts your phone will provide your contacts with some information over Signal, such as a Signal name and profile picture you've set - if they ask for it, unless you've blocked them. So if you set your name in Signal to "Barry is God" as a joke, that might be awkward if your very religious parents get Signal, but then that's also probably true if the name outside your dorm says "Barry is God" or if that's what the name says next to your apartment buzzer or on Facebook... Likewise if the profile photo is of a marijuana leaf which was funny for two close friends on Signal but then your very straight boss gets Signal and they know your phone number... Signal doesn't want to be another niche app that you only use to send encryption nerd stuff to other nerds who also installed the nerd app. It wants to be for everybody for everything, because there is safety in numbers. If there are six encrypted messages sent in Iran, the secret police really could just track down, arrest and torture everybody who sent or received an encrypted message just in case. But if it's six million messages that's just not practical.

tialaramex 5y ago

> Because his phone number was in my address book (so I could block him) Signal thought it had the right to let him know he can now contact me. Nope. Because your number was in his address book, his device periodically asks Signal "Hey, can I use Signal to message this contact?" and once you use Signal it says "Yes". The fact he's in your contacts means, by default, your phone thinks you know each other and it should provide information like your preferred name and photo if asked. Of course if you've got the number in there "so I could block him" you should... block him. In Signal too. Having blocked him, your phone won't provide your information and he can't contact you on Signal. Under the hood if you do this, your phone ignores Signal messages from this number but it also mints fresh "postage stamps" for Signal's anonymous sender capability, it won't give the new ones to the newly blocked person and the old ones no longer work, so your actual friends can get new stamps and send you messages without even Signal being able to tell who sent them, but blocked people can't waste the service's time sending messages you won't even see. This capability is necessary for Signal to function as something more than a fun "secret decoder ring" for a small circle of nerds. Without it for example, the ex-colleague I suddenly needed to contact a month ago wouldn't have been reached over Signal, he had no reason to tell me, a person he rarely talks to, that he's got Signal since we last met, but since his phone does have Signal, and my phone checked my contact list, it knew that Signal would work and it transparently used Signal for the conversation.

mmerlin 5y ago
Yeah good point on the program logic there. I uninstalled Signal instead of blocking him