4 ms·

Signal, please stop asking for mandatory phone number to register and use Signal. This raises privacy concerns and negates all the end-to-end encryption goodn

Signal, please stop asking for mandatory phone number to register and use Signal. This raises privacy concerns and negates all the end-to-end encryption goodness you're offering.

t-writescode 5y ago
all of it? That's a bit of hyperbole. What is a more measured thought of how much of a negative impact there is? Certainly saying "I know that Janis and Nate talked on this day this many times / for this long" and "Janis and Nate had a detailed conversation covering lemons and lye" have two different levels of private information revelation; and E2E protects against the latter but not necessarily the former, so why does it negate _all_ the goodness?
webmobdev 5y ago
Yes, this is why I am very suspicious of Signal as a front for the CIA / NSA. A phone number can reveal so much information about a person because many online and offline services now ask for it.
- jokoon 5y ago
  Reveal, yes, read their message, no.
  - webmobdev 5y ago
    We have to hope so ... The message still goes through their server ...
- arminiusreturns 5y ago
  Signal is the best we have on mobile at the moment in my estimation, but after a cursory analysis of Moxy, I totally expect one day it will be revealed he has been compromised somehow. Nation state actors already have baseband roots, so as long as those arent your threat vector, you are probably, maybe, ok on signal. I find it really interesting that Bill Binney says, despite years of me hearing the opposite, that we shoild all be rolling our own crypto because its a form of decentralization. The more time goes on, the more I think hes onto something. The main problem I see is this: a future where only the hackers have privacy, and everyone else apathetically accepts their servitude and abuse. Furthermore, to maintain that privacy, hackers will have to be extremely selective in their friends, due to the invasive nature of the privacy violations from those around us, unbeknownst to them.
  - ddtaylor 5y ago
    > Signal is the best we have on mobile at the moment Matrix is pretty good.
    - nobody9999 5y ago
      >Matrix is pretty good. I run a Matrix instance on my own hardware for my extended family. I suppose that I could be served with a subpoena/warrant for the data, but the contents of any voice or video calls mediated through my Matrix server wouldn't be preserved. Likewise, any private chats on the server would remain encrypted and I wouldn't be able to decrypt them even if I wanted to do so. Since the instance isn't federated, and access is only available through invitation, only those who have access know about. As such, I'd say that private chats and voice/video calls through my Matrix instance are pretty secure.
    - arminiusreturns 5y ago
      Its been a while, Ill have to check it out again. Thanks for the suggestion.
jokoon 5y ago
That prevents the platform from being abused. Identifying users is one thing, reading their message is another. People can still deny and not answer questions. What matters is the messages being encrypted, identifying users is already being made possible through other means. So yeah, using a phone number is good enough, in my view. There is no perfect security, there is only "good enough" security. Not to mention that phone numbers are more secure, in my view, than other sorts of digital communications, and are not always monitored in all countries.
ViViDboarder 5y ago
> negates all the end-to-end encryption goodness you're offering. It literally does not. Source: the OP Using a phone number means that an agency can ask Signal if you have a Signal account, but they can’t access any other info about you.

Signal, please stop asking for mandatory phone number to register and use Signal. This raises privacy concerns and negates all the end-to-end encryption goodness you're offering.

t-writescode 5y ago

all of it? That's a bit of hyperbole. What is a more measured thought of how much of a negative impact there is? Certainly saying "I know that Janis and Nate talked on this day this many times / for this long" and "Janis and Nate had a detailed conversation covering lemons and lye" have two different levels of private information revelation; and E2E protects against the latter but not necessarily the former, so why does it negate _all_ the goodness?

webmobdev 5y ago

Yes, this is why I am very suspicious of Signal as a front for the CIA / NSA. A phone number can reveal so much information about a person because many online and offline services now ask for it.

jokoon 5y ago
Reveal, yes, read their message, no.
- webmobdev 5y ago
  We have to hope so ... The message still goes through their server ...
arminiusreturns 5y ago
Signal is the best we have on mobile at the moment in my estimation, but after a cursory analysis of Moxy, I totally expect one day it will be revealed he has been compromised somehow. Nation state actors already have baseband roots, so as long as those arent your threat vector, you are probably, maybe, ok on signal. I find it really interesting that Bill Binney says, despite years of me hearing the opposite, that we shoild all be rolling our own crypto because its a form of decentralization. The more time goes on, the more I think hes onto something. The main problem I see is this: a future where only the hackers have privacy, and everyone else apathetically accepts their servitude and abuse. Furthermore, to maintain that privacy, hackers will have to be extremely selective in their friends, due to the invasive nature of the privacy violations from those around us, unbeknownst to them.
- ddtaylor 5y ago
  > Signal is the best we have on mobile at the moment Matrix is pretty good.
  - nobody9999 5y ago
    >Matrix is pretty good. I run a Matrix instance on my own hardware for my extended family. I suppose that I could be served with a subpoena/warrant for the data, but the contents of any voice or video calls mediated through my Matrix server wouldn't be preserved. Likewise, any private chats on the server would remain encrypted and I wouldn't be able to decrypt them even if I wanted to do so. Since the instance isn't federated, and access is only available through invitation, only those who have access know about. As such, I'd say that private chats and voice/video calls through my Matrix instance are pretty secure.
  - arminiusreturns 5y ago
    Its been a while, Ill have to check it out again. Thanks for the suggestion.

jokoon 5y ago

That prevents the platform from being abused. Identifying users is one thing, reading their message is another. People can still deny and not answer questions. What matters is the messages being encrypted, identifying users is already being made possible through other means. So yeah, using a phone number is good enough, in my view. There is no perfect security, there is only "good enough" security. Not to mention that phone numbers are more secure, in my view, than other sorts of digital communications, and are not always monitored in all countries.

ViViDboarder 5y ago

> negates all the end-to-end encryption goodness you're offering. It literally does not. Source: the OP Using a phone number means that an agency can ask Signal if you have a Signal account, but they can’t access any other info about you.