6 ms·

What do you suggest?

by maxwell 5y ago

sam_lowry_ 5y ago
A login+password, like in IRC.
- tptacek 5y ago
  IRC tracks metadata serverside!
  - johnisgood 5y ago
    I do not think that OP was referring to implementing it the same, or even in a similar way, but to use a username/password pair. OP is free to correct me if I am wrong though. In any case, elimination of metadata done right is the way Ricochet[1] does it. The recipient can calculate the sender's contact ID based on the public key, and authenticate it by verifying the signature on the request. This proves that the sender can publish the hidden service represented by their contact ID. You can read more about it here: https://github.com/ricochet-im/ricochet/blob/master/doc/design.md https://github.com/ricochet-im/ricochet/blob/master/doc/desi...! [1] https://github.com/ricochet-im/ricochet https://github.com/ricochet-im/ricochet (maintained fork: https://github.com/blueprint-freespeech/ricochet-refresh https://github.com/blueprint-freespeech/ricochet-refresh)
zamadatix 5y ago
Signal has had standard usernames on the roadmap for years.
johnisgood 5y ago
Usernames work. You could even use UUIDs these days as QR is an increasingly common way of sharing data. But yeah, usernames would be a great improvement.
- tptacek 5y ago
  Usernames do not just work. The Signal team is not unaware of usernames and Signal is not a weird scheme to get all your phone numbers. The difference between Signal and systems that use usernames (or email addresses) is that Signal deliberately doesn't operate a serverside directory or buddy list service. By contrast, other relatively popular messengers essentially keep a plaintext database of who talks to who on their service. What phone numbers allow Signal to do is to piggyback off the contact lists people already have on their devices.
  - deleted 5y ago
    [deleted]
  - kitkat_new 5y ago
    > is that Signal deliberately doesn't operate a serverside directory or buddy list service. how do people again discover each other on Signal most of the time? Anyways, nothing prevents Signal form creating it's own contact list within the app, perhaps bootstrapped from the existing one
    - tptacek 5y ago
      They can do that, but then when you switch devices, you lose your contact list. That's not what happens with the built-in contact list. This issue has been rehashed dozens of times on HN before (use the search bar below) and has basically nothing to do with the article.
      - kitkat_new 5y ago
        actually, the contact list could include the signal identifiers
    - Moru 5y ago
      One way would be for Signal to create a hash of all your contacts phone numbers and look up if those hashes exists on the server. No contact details needed on the server, just the hash of the phone number connected to Signals user ID.

What do you suggest?

sam_lowry_ 5y ago

A login+password, like in IRC.

tptacek 5y ago
IRC tracks metadata serverside!
- johnisgood 5y ago
  I do not think that OP was referring to implementing it the same, or even in a similar way, but to use a username/password pair. OP is free to correct me if I am wrong though. In any case, elimination of metadata done right is the way Ricochet[1] does it. The recipient can calculate the sender's contact ID based on the public key, and authenticate it by verifying the signature on the request. This proves that the sender can publish the hidden service represented by their contact ID. You can read more about it here: https://github.com/ricochet-im/ricochet/blob/master/doc/design.md https://github.com/ricochet-im/ricochet/blob/master/doc/desi...! [1] https://github.com/ricochet-im/ricochet https://github.com/ricochet-im/ricochet (maintained fork: https://github.com/blueprint-freespeech/ricochet-refresh https://github.com/blueprint-freespeech/ricochet-refresh)

zamadatix 5y ago

Signal has had standard usernames on the roadmap for years.

johnisgood 5y ago

Usernames work. You could even use UUIDs these days as QR is an increasingly common way of sharing data. But yeah, usernames would be a great improvement.

tptacek 5y ago
Usernames do not just work. The Signal team is not unaware of usernames and Signal is not a weird scheme to get all your phone numbers. The difference between Signal and systems that use usernames (or email addresses) is that Signal deliberately doesn't operate a serverside directory or buddy list service. By contrast, other relatively popular messengers essentially keep a plaintext database of who talks to who on their service. What phone numbers allow Signal to do is to piggyback off the contact lists people already have on their devices.
- deleted 5y ago
  [deleted]
- kitkat_new 5y ago
  > is that Signal deliberately doesn't operate a serverside directory or buddy list service. how do people again discover each other on Signal most of the time? Anyways, nothing prevents Signal form creating it's own contact list within the app, perhaps bootstrapped from the existing one
  - tptacek 5y ago
    They can do that, but then when you switch devices, you lose your contact list. That's not what happens with the built-in contact list. This issue has been rehashed dozens of times on HN before (use the search bar below) and has basically nothing to do with the article.
    - kitkat_new 5y ago
      actually, the contact list could include the signal identifiers
  - Moru 5y ago
    One way would be for Signal to create a hash of all your contacts phone numbers and look up if those hashes exists on the server. No contact details needed on the server, just the hash of the phone number connected to Signals user ID.