6 ms·

And Signal forces you to use your phone number as your identifier, which can be traced relatively easily to a person or at least a geographical position by the

by m-p-3 5y ago

And Signal forces you to use your phone number as your identifier, which can be traced relatively easily to a person or at least a geographical position by the authorities. The content of the message might be encrypted, but metadata can provide valuable intelligence insights. At least Matrix can be used mostly anonymously through a user-generated identifier, without an email address or phone number, and can be used through Tor.

BeatLeJuce 5y ago
I recently changed my mind on this: being able to use phone numbers as identifiers also has some benefits: Last time I was on vacation, it was easy to get in touch with service providers (e.g. surf school, massage place) via WhatsApp, simply because I had their number, and everyone used WhatsApp anyways. If Signal would be more popular, I could instead contact them directly via Signal, since I only need their phone number. It allows for a more seamless transition. Matrix OTOH would have a harder time getting adopted: businesses would need to update their websites, facebook pages and flyers to add the matrix contact info. Which they wouldn't do until Matrix is more popular. Which is a chicken and egg problem.
- bilkow 5y ago
  Although optional, matrix actually has identity servers, which allow people to find you via phone number / email.
- 3np 5y ago
  Matrix still has 3pids, including phone number and email. The most common client, Element, will by default ask you for your phone number when registering with the default matrix.org homeserver and the default vector.im identity server will associate your phone number with your matrix user. So by default (changing servers and/or opting out is easy and encouraged BTW), Matrix already works like you would prefer. This is BTW a main critique in the OP since it makes vector.im a PII and metadata aggregator.
- hansel_der 5y ago
  > being able to use phone numbers as identifiers also has some benefits of course it has, but so has the ability to NOT use a phone number. different use cases
spurgu 5y ago
> The content of the message might be encrypted, but metadata can provide valuable intelligence insights. What metadata? Signal doesn't store anything about you aside the date you joined and the time of your last ping.
- bigyellow 5y ago
  > Signal doesn't store anything about you aside the date you joined and the time of your last ping. Last I checked, Signal uses AWS, Azure and GCP. All of those services are completely logged and although "Signal" may not be storing metadata, intelligence services on those networks definitely are.
- uoaei 5y ago
  Data is sent over a network, and has an origin and destination. Of course Signal wouldn't store things like that, but the network administrator wouldn't have much trouble collecting extra metadata such as that on top of what is stored.
shapefrog 5y ago
> And Signal forces you to use your phone number as your identifier Signal forces you to use "a" phone number as your identifier. It does not have to be your primary phone number, or home phone number or office phone number. Just a phone number that you have control of.
- fsflover 5y ago
  > Just a phone number that you have control of. In most parts of the world, you cannot get "just" a phone number not tied to your real identity.
  - snark42 5y ago
    Prepaid cellular phones and Google Voice aren't available in most parts of the world with a little effort?
    - fsflover 5y ago
      I was speaking about the prepaid cellular phones. Again, in most parts of the world, you cannot get an anonymous sim-card. AFAIK you also cannot create a Google account without a phone number.
      - shapefrog 5y ago
        Everyone loves to say depends on your threat model so lets define "tied to your real identity". 1. the number everyone you have met since you were 12 has in their contacts. 2. the number a few people have but you also use for you facebook account. 3. the number nobody / no tech has but you have provided your legal id to the network provider. 4. the number nobody / no tech has and you gave the network provider a burner email for. 5. the number nobody / no tech has that you paid for in cash while wearing a wig and glasses half way across town. You put into a new, paid for in cash phone, activated and used briefly while carrying no other electronic devices while disguised and avoiding cctv. 6. the inbound phone number in the lobby of the ritz carlton. Some of those are better than using 'firstname.lastname' as you identifier. 1&2 are definately public numbers 4&5&6 are not. #3 in the real world is semi-anonymous - for those with real privacy needs, they should be taking many other precautions and shouldnt be carrying a tracking device or using a single phone number or service irrespective of it being in their name or someone elses or nobody at all. For privacy LARPERS of course it is not at all anonymous.

by m-p-3 5y ago

BeatLeJuce 5y ago

I recently changed my mind on this: being able to use phone numbers as identifiers also has some benefits: Last time I was on vacation, it was easy to get in touch with service providers (e.g. surf school, massage place) via WhatsApp, simply because I had their number, and everyone used WhatsApp anyways. If Signal would be more popular, I could instead contact them directly via Signal, since I only need their phone number. It allows for a more seamless transition. Matrix OTOH would have a harder time getting adopted: businesses would need to update their websites, facebook pages and flyers to add the matrix contact info. Which they wouldn't do until Matrix is more popular. Which is a chicken and egg problem.

bilkow 5y ago
Although optional, matrix actually has identity servers, which allow people to find you via phone number / email.
3np 5y ago
Matrix still has 3pids, including phone number and email. The most common client, Element, will by default ask you for your phone number when registering with the default matrix.org homeserver and the default vector.im identity server will associate your phone number with your matrix user. So by default (changing servers and/or opting out is easy and encouraged BTW), Matrix already works like you would prefer. This is BTW a main critique in the OP since it makes vector.im a PII and metadata aggregator.
hansel_der 5y ago
> being able to use phone numbers as identifiers also has some benefits of course it has, but so has the ability to NOT use a phone number. different use cases

spurgu 5y ago

> The content of the message might be encrypted, but metadata can provide valuable intelligence insights. What metadata? Signal doesn't store anything about you aside the date you joined and the time of your last ping.

bigyellow 5y ago
> Signal doesn't store anything about you aside the date you joined and the time of your last ping. Last I checked, Signal uses AWS, Azure and GCP. All of those services are completely logged and although "Signal" may not be storing metadata, intelligence services on those networks definitely are.
uoaei 5y ago
Data is sent over a network, and has an origin and destination. Of course Signal wouldn't store things like that, but the network administrator wouldn't have much trouble collecting extra metadata such as that on top of what is stored.

shapefrog 5y ago

> And Signal forces you to use your phone number as your identifier Signal forces you to use "a" phone number as your identifier. It does not have to be your primary phone number, or home phone number or office phone number. Just a phone number that you have control of.

fsflover 5y ago
> Just a phone number that you have control of. In most parts of the world, you cannot get "just" a phone number not tied to your real identity.
- snark42 5y ago
  Prepaid cellular phones and Google Voice aren't available in most parts of the world with a little effort?
  - fsflover 5y ago
    I was speaking about the prepaid cellular phones. Again, in most parts of the world, you cannot get an anonymous sim-card. AFAIK you also cannot create a Google account without a phone number.
    - shapefrog 5y ago
      Everyone loves to say depends on your threat model so lets define "tied to your real identity". 1. the number everyone you have met since you were 12 has in their contacts. 2. the number a few people have but you also use for you facebook account. 3. the number nobody / no tech has but you have provided your legal id to the network provider. 4. the number nobody / no tech has and you gave the network provider a burner email for. 5. the number nobody / no tech has that you paid for in cash while wearing a wig and glasses half way across town. You put into a new, paid for in cash phone, activated and used briefly while carrying no other electronic devices while disguised and avoiding cctv. 6. the inbound phone number in the lobby of the ritz carlton. Some of those are better than using 'firstname.lastname' as you identifier. 1&2 are definately public numbers 4&5&6 are not. #3 in the real world is semi-anonymous - for those with real privacy needs, they should be taking many other precautions and shouldnt be carrying a tracking device or using a single phone number or service irrespective of it being in their name or someone elses or nobody at all. For privacy LARPERS of course it is not at all anonymous.