26 ms·

You can change your number

651 points by feross 5y ago

Karsteski 5y ago
Great update. Patiently waiting until the day I can decouple my phone number from my Signal "account" though.
- crossroadsguy 5y ago
  I seriously doubt it’ll be a decoupling. They might come up with a coupling like Telegram - having both at once.
Katherine1212 5y ago
Vinnl 5y ago
> We built Change Number using the foundation of more exciting features to come. Surely this is referring to the ability to use a non-phone number ID, which they've hinted at before [1]. Looking forward to that, only because I know many others are! [1] https://www.reddit.com/r/technology/comments/kt91qk/comment/giks8hv/?context=3 https://www.reddit.com/r/technology/comments/kt91qk/comment/...
- viccuad 5y ago
  Oh, I'm surprised, after a decade stating that phone numbers were great for ID.
  - killingtime74 5y ago
    It shows they have an open mind I guess
    - fartcannon 5y ago
      To me, it shows that whatever agent is pushing signal adoption has seen the writing on the wall and is trying to get ahead before the tide changes and they have to hit some other developers with wrenches. ;)
    - tibyat 5y ago
      well, the ceo did step down last month..
  - tptacek 5y ago
    They're great compared to the alternative of simply storing a plaintext register of every pair of communicating parties on the server, which is how other messengers work. What's "good" about phone numbers is that they're tied clientside to a "buddy list" that everyone already keeps --- their contact list. They don't want phone numbers on the merits of phone numbers.
    - charcircuit 5y ago
      I've never used a contact list for my "buddies." We just have each other added on Discord.
      - caslon 5y ago
        Discord keeps your friend information on their servers. This is, like tptacek said, exactly what Signal is trying to prevent. If servers get seized by the Feds, they don't want to needlessly reveal who's contacting who for everyone. It's about storing as little personal information as they can.
        theamk 5y ago
        Question: do you use Signal? If yes, are you backing up/syncing your contact list? If yes, are you worried about Feds coming for your backup/sync provider?
        stjohnswarts 5y ago
        Isn't your contact list encrypted? I mean wouldn't they have to hack my password (good luck) to do that?
        crtasm 5y ago
        When you backup to/sync via Apple or Google? No.
        caslon 5y ago
  - root_axis 5y ago
    Signal was built as an alternative to SMS so that design makes sense with that goal in mind.
    - phaer 5y ago
      TextSecure, Signals name before re-branding started out doing only SMS encryption. Sending messages over data started earlier if I remember correctly. I think that must have been almost 10 years ago
  - stjohnswarts 5y ago
    I would much prefer a one time randomly generated GUID myself that can be used to transfer to new phones or just trash if you want a full reset on your signal contacts. Obviously 2FA like TOTP or similar to change it.
  - raspyberr 5y ago
    They mainly used numbers so they could leverage the social graph of phone contact lists. That way they didn't need to store any social graphs on their systems.
- wyager 5y ago
  Based on the whole "mobilecoin" pump and dump scam they tried to pull, I unfortunately expect this to be tied to some kind of identity shitcoin.
  - 0xdeadb00f 5y ago
    I'd laugh then probably cry.
- gaius_baltar 5y ago
  > Surely this is referring to the ability to use a non-phone number ID, They are promising this for years and years, I hope this time is real. Specially if we don't need a phone number to create an account: that's just incompatible with privacy.
- godelski 5y ago
  I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). I took a poll on reddit[0][1] to see what people wanted. I was rather surprised at how many wanted strong anonymity. I expected that the top choice would be the weak anonymity, where people just have an alternative to phone numbers. But I think if that's what Signal was rolling out then it would have been here already. So I hope they make anonymous communication available to everyone. I don't expect strong anonymity in the initial rollout, but I hope that is what they are working towards. As I see it, there are three aspects to protected communication: privacy (no one sees what you're saying), anonymity (no one sees who's communication), and censorship prevention (no one can shut down communication). If we get strong anonymity in Signal then that is 2/3 and would be a great leap forward for free speech _everywhere_. I expect censorship prevention to be the hardest of these to tackle, even with decentralization. [0] https://www.reddit.com/r/signal/comments/skoaf6/poll_why_do_you_want_usernames/ https://www.reddit.com/r/signal/comments/skoaf6/poll_why_do_... [1] Yes, I realize there are issues with the poll. Polling is hard.
  - gst 5y ago
    > I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800cbdb3afa01a67390b6efa2fc91be6/app/src/main/java/org/thoughtcrime/securesms/util/UsernameUtil.java https://github.com/signalapp/Signal-Android/blob/a5e5a735800...
    - crossroadsguy 5y ago
      It is unfortunate that they seem to be going for user created username. I’d rather have something like ~hkopy-vnhyt randomly generated and given to users with option to try for another randomly generated username if they didn’t like the first.
      - 5y ago
- FunnyLookinHat 5y ago
  I'm hoping to reclaim my ICQ number!
- crossroadsguy 5y ago
  I hope they don’t implement it broken like Telegram’s. If a person has your number in the contacts then your username and phone number are automatically merged together even if you were conversing to that person using your username from your perspective. That’s such a safety nightmare.
throwaway22032 5y ago
That's cool. Can I not use a number? Would it be so hard to add a username field? That the default is phone-number based for discovery is a savvy and logical move for adoption. So add it as an optional feature. The conclusion that I immediately arrive to is that this software must be a honeypot of some sort because it makes no sense. Literally zero.
- deleted 5y ago
  [deleted]
- Trias11 5y ago
  Exactly. Honeypot developed by spying entity. Otherwise anonymous usernames + passwords would perfectly do.
rvz 5y ago
How about no phone number at all?
- jokowueu 5y ago
  You can use wire instead
  - rvz 5y ago
    Exactly. Why on earth is it so hard or difficult for Signal to do just that? Regardless, I don't know why they are pushing in a somewhat unregulated, volatile cryptocurrency that will be used by extremists, terrorists and the like who in no doubt will not only use it to fund their activities and will be sitting in their group chats but now they can change their phone numbers to hide even further? The road to hell is been paved with good intentions. Hasn't it? But at least Wire does not still require a phone number, nor does it have silly cryptocurrencies in their product for pump and dump purposes.
    - UncleMeat 5y ago
      This has been discussed literally 1000 times. The alternative is having the server know who is talking to whom. Further, phone numbers provide a valuable bootstrap to connect with people. Other secure messengers have chosen a different design than Signal. This means you can choose the one you prefer.
      - SailingSperm 5y ago
        How about no ph number and only UUIDs- You send a msg that only personA can decrypt - but you broadcast the encrypted message to all contacts /+ random UUIDs ... So signal doesn't know who it was intended for exactly, and only personA gets the information. Of course you'd want the app to only alert users getting the broadcast once a received comm is successfully decrypted, otherwise discard. It's clearly a lot higher data overhead, but that'd acheive phone numberless accounts without signal knowing 100% A is talking to B.... Only that 'A' might be talking to 'B'..Or C..or D.. Or sending decoy msgs intended for nobody. Settling for phone numbers on a privacy based messenger because it's too hard to do an alternative implem is a cop out I feel. What do you think of the above proposal?
SecurityLagoon 5y ago
Can people please choose an appropriate title when posting. "You can change your number" makes sense in the context of signal.org but makes little sense on the front page of HN. The RSS feed doesn't even include the domain for context.
- nsajko 5y ago
  HN guidelines forbid changing the title. I proposed changing this once, but the post didn't get traction. There was more traction for that years ago though. https://news.ycombinator.com/item?id=26300126 https://news.ycombinator.com/item?id=26300126
  - deleted 5y ago
    [deleted]
  - slyall 5y ago
    I often change titles on submissions. Making them shorter for instance. I also do change some to provide more context that the original source didn't. An article has only 15 minutes in /new to attract enough votes. Sticking with a crappy title nobody will click on wastes everyone's time. Obviously don't go full clickbaity. Sometimes the HN mods change them back.
  - dang 5y ago
    > HN guidelines do not forbid changing the title. It's more nuanced than that. See https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html: "Please use the original title, unless it is misleading or linkbait; don't editorialize."
- saurik 5y ago
  This website has an extremely awkward policy about titles that makes it so if you don't use the original title people get angry. The policy though just doesn't make sense, sadly, as the concept of titles is audience-specific (and even movies or books, which might feel more organized, sometimes have different audiences in different markets). FWIW, I did connect it together as I saw "(signal.org)" and that was sufficient for me in this specific case.
usea 5y ago
How can I use this without a phone or phone number at all? If I am concerned about privacy, why would I give them that access and information when it's not necessary for the service? Surely they are only trying to gather information on their users. Whether it's being sold, breached, or used for ad targeting, I am not interested. It comes across as a scam. I cannot take seriously any claims made by the company or its employees / owners. None of it can be used as evidence of their goodwill or what they do with my data. They have an interest in deceiving me.
- colordrops 5y ago
  This is for proctecting your data from other end users. Signal still needs your number to provide to three letter agencies.
  - sa1 5y ago
    On the contrary, they started out with phone numbers so that they could avoid storing user data on their servers. The whole plan to finally have usernames comes down to their use of Intel SGX.
    - colordrops 5y ago
      What does being tied to a phone number have to do with avoiding storing data on their servers or SGX?
      - sa1 5y ago
        With a phone number, the contact graph can be on the phone. With usernames, the contact graph has to be stored on their servers. They were forced to store (encrypted) information on servers anyway, since client-side contact matching didn't end up scaling, which is why stuff like this and usernames are now being developed. Their new security strategy now relies on decryption being done by client-attested code on SGX enclaves, so that the server still doesn't have access to the plain-text contact graph. All of this took a huge amount of time to come up with, and you can see the progress if you read their blogs or forums.
YaBomm 5y ago
Not sure why you need a phone number? besides government and/or ad tracking. This is why I use Matrix/Element
- deleted 5y ago
  [deleted]
- _joel 5y ago
  What's a universal thing to the portable device that everyone has got in their pocket? I agree it's sucky and really there could be better ways, should be something none trackable and perhaps offer opt-in discovery via phone book. Have the option of decoupling it entirely from the phone. The government can track you a lot easier than pinging via signal btw. A lot easier!
  - YaBomm 5y ago
    > What's a universal thing to the portable device that everyone has got in their pocket? All phones have internet connectivity... The phone number is completely useless to talk via the internet anyways... > The government can track you a lot easier than pinging via signal btw. A lot easier! I think that it is easier to connect a real-world identity to an internet account when they also have your phone number associated with the account...
    - YaBomm 5y ago
mlissner 5y ago
This is fine, but signal still doesn't tell you when the person you're sending to has uninstalled signal. Instead, your messages go into ether and you think the person is ignoring you. It blows my mind they haven't prioritized this. https://github.com/signalapp/Signal-Android/issues/11164 https://github.com/signalapp/Signal-Android/issues/11164
- stavros 5y ago
  This shows a single check mark, no? Ie it tells you that the user hasn't received the message.
  - jessriedel 5y ago
    Yea, it seems like this is the most information they could give you without violating the addressee's privacy by revealing whether they have uninstalled the app. I suppose it could be worth it if, when the message remains undelivered for a while, Signal added an explicit note to that effect so the sender doesn't misunderstand.
    - mlissner 5y ago
      Yes, exactly this. All that's needed is to tell senders when a message wasn't received after X hours. You don't have to figure out if the user uninstalled. This also happens if they get a new phone and don't re-install on it, so relying on uninstalls wouldn't work anyway.
    - not2b 5y ago
      How can they tell that a user has uninstalled the app? Does uninstalling send a notification to signal.org?
      - jessriedel 5y ago
        I dunno. It's true they might not even have that information.
      - 5y ago
stavros 5y ago
This is a great feature, well done for adding it! However, I'm a bit puzzled as to why seemingly easy bug fixes aren't addressed. There's a longstanding issue with Signal not recognizing that the phone is in a landscape orientation when taking photos, so they're rotated by 90 degrees. I opened an issue[1] and it got closed with a related-but-not-exact workaround. This impacts everyone who takes photos on Android with Signal, it's not a niche problem. It seems like an easy fix, and I'm perplexed that it doesn't get prioritized. Ah well, can't complain too much about a free product. [1] https://github.com/signalapp/Signal-Android/issues/9641 https://github.com/signalapp/Signal-Android/issues/9641
- Waterluvian 5y ago
  Signal is eating up 11GB of my iOS space. There is no way to clear it without completely uninstalling and reinstalling. And then the problem just resets and grows again. It’s a ridiculously consequential bug and they don’t seem motivated to even comment. Pretty sad.
  - grlass 5y ago
    Signal keeps all downloaded media locally until you delete it. They don't have the resources to store files on the cloud, even encrypted, and don't appear to have taken WhatsApp's approach of backing up unencrypted media and messages on user's third-party cloud services like Google Drive and iCloud. You can mitigate this by having disappearing chats (current longest self-destruct time is 4 weeks), or by going to Settings->Data and Storage->Review Storage and deleting the largest files. This isn't a great UX design, as users are not informed there is a problem, or how to solve it.
    - Waterluvian 5y ago
      I don’t want them keeping my data. I don’t want restoring data. I want the ability to purge 11gigs off my device. When you select “delete all message history” it should free up the disk.
    - nottorp 5y ago
asiachick 5y ago
How about no need for a number at all!?!??
- deleted 5y ago
  [deleted]
yusmary 5y ago
All that is cool, but I don't want Signal to advertise my presence to anybody that has my phone number when I first log in after a fresh install. I have only a handful of people that know and we negotiated that face to face prior, Signal breaks that trust
- advisedwang 5y ago
  Can you explain this a bit more? Am I correct in understanding that you feel it hurts you when your contacts find out that you have signal installed, hence why signal shouldn't do it? What is the impact of someone who has your phone number knowing you are available over Signal? Are there communities out there where someone being on signal is a red flag?
  - valleyer 5y ago
    This is just a shade away from the typical "nothing to hide, nothing to fear" argument, and is in my opinion equally invalid. Let people decide for themselves what in their lives is OK to share with others. You don't need to know the reason why.
    - samatman 5y ago
      Either you don't understand how Signal works vis a vis phone numbers, or you're expecting something unreasonable. The behavior which is reliably objected to by someone on HN, every time Signal is mentioned, is that the app sends a user an alert when someone in their contacts list is on Signal. Phone numbers are the only resolution mechanism in Signal. Should that change? Separate question. Having someone's phone number is by definition a way to contact them. Registering for Signal is by definition agreeing that anyone who searches for your phone number can send you a message on Signal. What is the privacy violation in pushing awareness of that affordance? What about pull-only is better? Signal does what I want it to here, and my trouble understanding why someone would be ok with everything about Signal except the push notification on join to people who have your number is genuine. It's easy for me to understand why people don't like that a phone number is inherent to Signal, don't much care for it myself. But it's unrelated.
rckt 5y ago
Wow, so many discussions about removing the phone number completely and now that's what we get instead.
scotty79 5y ago
Why would supposedly secure communicator use actual phone number as identifier is beyond me. And everybody does that, either phone number or email. The only software I could find for anonymous communication was old Polish communicator http://gg.pl http://gg.pl which uses arbitrary numbers as identifiers I understand that startups are scared that they won't be able to build up userbase from scratch but come on! Discord and Slack did it.
- palata 5y ago
  Two words: threat model.
  - scotty79 5y ago
    I don't get it. I find my interlocutor knowing my phone number a severe threat to my privacy.
    - bt1a 5y ago
      Sure - that's why Signal is for secure communication between individuals who have some level of trust. There's nothing stopping your interlocutor from leaking all of the messages you send to them, what's the big issue with them having your number?
      - scotty79 5y ago
        > Sure - that's why Signal is for secure communication between individuals who have some level of trust. If I have this level of trust with someone they are about at level of adding them as a friend on Facebook. Who knows, I even might invite them on Facebook sooner than I decide to give them my phone number. > what's the big issue with them having your number? Seriously? With my number you can harass me endlessly with phonecalls, text messagers, registering for various services that will harass me basically forcing me to abandon this phone number and notify all of my valuable contacts of the number change. Hell, they might even plaster town with my number with advert saying "Win 50$ in Chewbaca noise contest by subitting your best attempt at that number." as one creative asshole did to some poor girl. > There's nothing stopping your interlocutor from leaking all of the messages you send to them That way less of a problem if I haven't doxed myself in those conversations. All he will publish is some conversations he had with someone.
smm11 5y ago
Signal installs via the app store, and you all are freaking out that it might reveal your phone number? Okay, then.
- netizen-936824 5y ago
  Signal hosts an apk for download on their website. App stores are not the only place to get applications
- Vinnl 5y ago
  Not necessarily, at least on Android: https://signal.org/android/apk/ https://signal.org/android/apk/
- deleted 5y ago
  [deleted]
- palata 5y ago
  To be fair, you can build it from sources, and I'm pretty sure they provide an apk (they used to, at least).
Trias11 5y ago
STOP asking for my phone number to use your "secure" app. I don't want to disclose my phone number to any user, platform or any app. Just please STOP.
- deleted 5y ago
  [deleted]
rcarback 5y ago
It is early stage, but there is now an alternative to Signal that doesn't use phone numbers at all: https://xx.network/messenger/ https://xx.network/messenger/ While you can add your number to be searchable by others, it doesn't let strangers with your number know you signed up automatically, either. Full disclosure: I work on the infrastructure behind it.
- TacticalCoder 5y ago
  Yup. For those who don't know that is David Chaum's quantum-resistant messenger and he's an OG cryptographer (and he's mentioned in Bitcoin's original whitepaper, funnily enough). > Full disclosure: I work on the infrastructure behind it. Oh cool... I ran a node for many months during the beta (from home, fiber optic at home). I'm busy atm so I'm not running anything anymore but I do really hope that a real secure messenger that doesn't leak metadata left and right, and which uses advanced cryptography, shall eventually prevail.
- pomian 5y ago
  Can you use this to send texts via SMS to regular phone numbers? How does this differ from Linphone?
  - rcarback 5y ago
    No it can't use SMS as a transport. It protects metadata using a mixnet and the E2E encryption for authenticated channels uses post quantum cryptography(SIDH) to establish symmetric keys. The infrastructure is run by 3rd party node runners and there's an open source API for other applications in addition to the messenger being open source.
- wolverine876 5y ago
  We see many apps that promise to be secure. With due respect, why would someone trust this one?
  - TacticalCoder 5y ago
    > With due respect, why would someone trust this one? It's the project of David Chaum: https://en.wikipedia.org/wiki/David_Chaum https://en.wikipedia.org/wiki/David_Chaum Which makes that messenger very interesting. It's also quantum-resistant from the get go. I think the beta just went live.
alfiedotwtf 5y ago
It would be nice if it didn't require a phone number. My daughter doesn't have a phone, but I would still like to use Signal with her when she's on a wifi-connected iPad.
- wolverine876 5y ago
  Regarding your specific issue: You could get your daughter a VOIP number, which can run as an app on the iPad. VOIP numbers can process text messages too, which should enable Signal's confirmation message.
  - pomian 5y ago
    Do you have any suggestions on where/how would be best to get a VoIP number?
    - wolverine876 5y ago
      It's very easy; you could have it up and running in an hour, possibly. Here are market leaders for small business, and I presume they would handle consumer accounts. In my very limited experience, I had the best experience with RingCentral. * RingCentral: Softphones only (i.e., applications on a computer), IIRC - no hardware handsets. * Nextiva: In my one experience, the sales culture as a bit of a hustle, but it worked out. * 8x8 * Star2Star: Don't know much about them; maybe medium-to-large business only.
  - alfiedotwtf 5y ago
    Oh! Thanks, I never actually thought of that. Awesome
HNSucksAss 5y ago
renewiltord 5y ago
It would be neat if my .eth was a valid message source/target on Signal.
gardnr 5y ago
Can I sign up without a number? Why does Signal require an identifier that is very difficult and perhaps illegal to make anonymous?
- __MatrixMan__ 5y ago
  Signal stores your contact list on your phone (and not on their servers). Unlike other devices, people typically only have one active phone at any time, which means that your contact list on your phone can be your contact list on any linked device (its primary, they're secondary). If they didn't anchor to something that they knew you only had one of, then it's not clear which of your devices should be authoritative. The alternative is to store your contact list on their servers, but they don't do that because they aren't confident that they could do so in a way that keeps your contacts hidden from somebody who gained access to their servers. Often, letting an adversary know who you associate with is just as dangerous as letting them know what you say to those people. Having your phone number be the key means that metadata security comes down to whether you lock your phone instead of whether the bad guys can get a warrant to compromise Signal's servers. It's a worse user experience, but I can understand not wanting to be responsible for the bad things that happen when bad guys map a target's social network.
  - pseudalopex 5y ago
    Mobile telephone subscriptions passed global population 7 years ago.[1] More than 1 phone is not so unusual. End to end encrypted messages are harder than end to end encrypted contacts. Using phone numbers encourages people to use their phone's contacts app. Most people have theirs connected to Google or Apple. If they have other devices especially. [1] https://archive.fo/6je9z https://archive.fo/6je9z
    - __MatrixMan__ 5y ago
      To your first point, if you have two phone numbers then you're probably keeping them separate for a reason, and so their contacts should be kept separate by the app too. As for your second: what are the "ends" you're taking about with this "end to end encrypted contacts" idea? Certainly, a contact list has to be visible at the device--otherwise it's useless. Where else would you want it to be visible?
SSLy 5y ago
So, Android ↔ iOS transfer when?
welder 5y ago
With SIM swapping, does using a phone number mean someone can takeover your Signal account?
- slowbdotro 5y ago
  You can turn on Registration Lock which requires the PIN if you "re-register" with signal again.
  - mort96 5y ago
    So, for most people, who wouldn't think to take extra precautions for Signal specifically, the answer would be yes?
NullPrefix 5y ago
>If you’re getting a new phone, but keeping your old number, you can use our end-to-end encrypted device-to-device transfer on Android or iOS to carry your contacts and chat history over to your new device Is there a way to export chat history into HTML or other file? I want to re read my chat sometime later.
mmaunder 5y ago
Thought this was about you not negotiating against yourself every time an employer asks your current salary.
seany 5y ago
Now let us get rid of it, and not use a phone at all
Amfy 5y ago
Oh Thank you!
wolverine876 5y ago
Can users choose an arbitrary number?
legalcorrection 5y ago
It's been promised for years, but you still can't use a second phone as a linked/secondary device. As a result, it is literally impossible to have the same signal account on two iPhones. Since they already support using an iPad as a linked device, this would require little more than changing a flag and a recompilation. Maybe they have their reasons, but all they keep saying is 'soon'.
- BugsJustFindMe 5y ago
  > but you still can't use a second phone as a linked/secondary device. As a result, it is literally impossible to have the same signal account on two iPhones. I use my google voice number on multiple phones.
  - legalcorrection 5y ago
    That's not how that works. If you sign up for Signal with the same number on multiple iPhones, for example, only the last one will still be connected. The iPhone app only supports being the primary device. There can only be one primary device per account.
- lkxijlewlf 5y ago
  This is the feature I want most. I have my EDC and then I have a "if I drop it in the ocean, oops" phone.
  - gefhfffh 5y ago
    You could bridge Signal with Matrix and then use two Matrix clients. Quite a workaround, but should work ;-)
    - zaik 5y ago
      Bridges break end-to-end encryption.
      - 5y ago
snowgrove 5y ago
I stopped using Signal, along with my adult tech-oriented friends, when we all had bad experiences migrating our accounts to new phones. That plus the phone number requirement, intrusive contacts integration, and the weird crypto side projects killed my interest in Signal entirely. My friends and I use Discord now.
- sneak 5y ago
  Discord is not end to end encrypted, and Discord, along with whoever buys them, will receive the complete plaintext message history of all of your conversations with those friends.
  - enlyth 5y ago
    So some algorithm somewhere will eventually try to parse five years of shitposts and memes between me and my friends and try to figure out what it can advertise to me based on it, I can't say I'm even mad
    - sneak 5y ago
      https://en.m.wikipedia.org/wiki/Third-party_doctrine https://en.m.wikipedia.org/wiki/Third-party_doctrine
    - berkes 5y ago
      Ah, the old 'I don't need privacy because I have nothing to hide' fallacy.
      - enlyth 5y ago
        I have nothing to hide because I recognize the intentions and limitations of different platforms. Discord is a gaming chat platform and I post and act accordingly there. I don't understand why I should be entitled to privacy on a free chat platform hosted with someone else's money.
        5y ago
NaturalPhallacy 5y ago
Signal is more valuable to democracy than CNN and Fox News combined.
NaturalPhallacy 5y ago
Not being able to use the same account on my phone and ipad is retarded.
YaBomm 5y ago
erenw 5y ago
"I use Signal every day." - Edward Snowden Okay, im in
antman 5y ago
This is an important addition. My request list would be from easier to harder: - Strong anonymity - Offline and cloud encrypted backups that can be imported to the new IDs (also potential monetization source) - Secondary IDs per user and one off IDs, with the nature of said IDs communicated to the other party (primary, secondary permanent, one off). Of course it could create problems but with a proper blocking mechanism within signal (e.g. block one off IDs and secondary IDs from unknown numbers) by default would be seamless. -Mobilecoin usage seamless across IDs, retaining anonymity
- wh33zle 5y ago
  I would love to move the backup off my device. It is eating my storage but I also don't want to delete it!
compsciphd 5y ago
I never understood using phone # as a permanent ID. phone numbers change (heck, I effectively have 2 whatsapps, because I have a US phone # and an international phone # because of this). ID shouldn't matter to most users (it can be hidden behind the scenes). Phone # is great for looking up the ID, but users should be able to remap it at will. Example: register with your phone #. This generates a new ID (you don't know or care about it). If you have to login from a new device, that doesn't have the ID stored, can you login with your phone #, but all this does is look up the ID and uses that ID to try and then authenticate you. If someone wants to find you, they use the phone number to look up your ID. Once its looked up and mapped, the phone number never needs to be used again. If I change my phone #, all I have to do is update the mapping of phone # -> id (i.e. add a new entry, remove the old entry). Anyone contacts who have me already, will not be bothered by this (they only care about the ID, which they already have). new "contacts" will also behave correctly, as I no longer have that phone #, so it shouldn't be able to be used to find me (it might be someone else's # now). Users would be able to move phone #s and their existing contacts would be able to follow them. New telephone users would be able to get recycled old phone #s without getting messages from the old owner of number's contacts (assuming they had previously contacted). the only places I see people think this might fall down (but I think are wrong) is 1) if the same user creates a new id with the old phone #. However, the solution seems pretty simple, you just need a way to invalidate the old ID (i.e. never to be used again) and force the contact to get the new id for the phone number. 2) what happens when a user moves devices. i.e. they might have to redo the mapping of phone # -> id. However. at its worst, this is no worse than the current system (which effectively does that update on every single message). In practice, there are ways to move data between devices which would just move the mappings with it (examples being a cloud cache backup, the ability migrate data from device to device, or probably other ways as well).
Katherine1212 5y ago
Katherine1212 5y ago

651 points by feross 5y ago

Karsteski 5y ago

Great update. Patiently waiting until the day I can decouple my phone number from my Signal "account" though.

crossroadsguy 5y ago
I seriously doubt it’ll be a decoupling. They might come up with a coupling like Telegram - having both at once.

Katherine1212 5y ago

Vinnl 5y ago

> We built Change Number using the foundation of more exciting features to come. Surely this is referring to the ability to use a non-phone number ID, which they've hinted at before [1]. Looking forward to that, only because I know many others are! [1] https://www.reddit.com/r/technology/comments/kt91qk/comment/giks8hv/?context=3 https://www.reddit.com/r/technology/comments/kt91qk/comment/...

viccuad 5y ago
Oh, I'm surprised, after a decade stating that phone numbers were great for ID.
- killingtime74 5y ago
  It shows they have an open mind I guess
  - fartcannon 5y ago
    To me, it shows that whatever agent is pushing signal adoption has seen the writing on the wall and is trying to get ahead before the tide changes and they have to hit some other developers with wrenches. ;)
  - tibyat 5y ago
    well, the ceo did step down last month..
- tptacek 5y ago
  They're great compared to the alternative of simply storing a plaintext register of every pair of communicating parties on the server, which is how other messengers work. What's "good" about phone numbers is that they're tied clientside to a "buddy list" that everyone already keeps --- their contact list. They don't want phone numbers on the merits of phone numbers.
  - charcircuit 5y ago
    I've never used a contact list for my "buddies." We just have each other added on Discord.
    - caslon 5y ago
      Discord keeps your friend information on their servers. This is, like tptacek said, exactly what Signal is trying to prevent. If servers get seized by the Feds, they don't want to needlessly reveal who's contacting who for everyone. It's about storing as little personal information as they can.
      - theamk 5y ago
        Question: do you use Signal? If yes, are you backing up/syncing your contact list? If yes, are you worried about Feds coming for your backup/sync provider?
        stjohnswarts 5y ago
        Isn't your contact list encrypted? I mean wouldn't they have to hack my password (good luck) to do that?
        crtasm 5y ago
        When you backup to/sync via Apple or Google? No.
        caslon 5y ago
- root_axis 5y ago
  Signal was built as an alternative to SMS so that design makes sense with that goal in mind.
  - phaer 5y ago
    TextSecure, Signals name before re-branding started out doing only SMS encryption. Sending messages over data started earlier if I remember correctly. I think that must have been almost 10 years ago
- stjohnswarts 5y ago
  I would much prefer a one time randomly generated GUID myself that can be used to transfer to new phones or just trash if you want a full reset on your signal contacts. Obviously 2FA like TOTP or similar to change it.
- raspyberr 5y ago
  They mainly used numbers so they could leverage the social graph of phone contact lists. That way they didn't need to store any social graphs on their systems.
wyager 5y ago
Based on the whole "mobilecoin" pump and dump scam they tried to pull, I unfortunately expect this to be tied to some kind of identity shitcoin.
- 0xdeadb00f 5y ago
  I'd laugh then probably cry.
gaius_baltar 5y ago
> Surely this is referring to the ability to use a non-phone number ID, They are promising this for years and years, I hope this time is real. Specially if we don't need a phone number to create an account: that's just incompatible with privacy.
godelski 5y ago
I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). I took a poll on reddit[0][1] to see what people wanted. I was rather surprised at how many wanted strong anonymity. I expected that the top choice would be the weak anonymity, where people just have an alternative to phone numbers. But I think if that's what Signal was rolling out then it would have been here already. So I hope they make anonymous communication available to everyone. I don't expect strong anonymity in the initial rollout, but I hope that is what they are working towards. As I see it, there are three aspects to protected communication: privacy (no one sees what you're saying), anonymity (no one sees who's communication), and censorship prevention (no one can shut down communication). If we get strong anonymity in Signal then that is 2/3 and would be a great leap forward for free speech _everywhere_. I expect censorship prevention to be the hardest of these to tackle, even with decentralization. [0] https://www.reddit.com/r/signal/comments/skoaf6/poll_why_do_you_want_usernames/ https://www.reddit.com/r/signal/comments/skoaf6/poll_why_do_... [1] Yes, I realize there are issues with the poll. Polling is hard.
- gst 5y ago
  > I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800cbdb3afa01a67390b6efa2fc91be6/app/src/main/java/org/thoughtcrime/securesms/util/UsernameUtil.java https://github.com/signalapp/Signal-Android/blob/a5e5a735800...
  - crossroadsguy 5y ago
    It is unfortunate that they seem to be going for user created username. I’d rather have something like ~hkopy-vnhyt randomly generated and given to users with option to try for another randomly generated username if they didn’t like the first.
    - 5y ago
FunnyLookinHat 5y ago
I'm hoping to reclaim my ICQ number!
crossroadsguy 5y ago
I hope they don’t implement it broken like Telegram’s. If a person has your number in the contacts then your username and phone number are automatically merged together even if you were conversing to that person using your username from your perspective. That’s such a safety nightmare.

throwaway22032 5y ago

That's cool. Can I not use a number? Would it be so hard to add a username field? That the default is phone-number based for discovery is a savvy and logical move for adoption. So add it as an optional feature. The conclusion that I immediately arrive to is that this software must be a honeypot of some sort because it makes no sense. Literally zero.

deleted 5y ago
[deleted]
Trias11 5y ago
Exactly. Honeypot developed by spying entity. Otherwise anonymous usernames + passwords would perfectly do.

rvz 5y ago

How about no phone number at all?

jokowueu 5y ago
You can use wire instead
- rvz 5y ago
  Exactly. Why on earth is it so hard or difficult for Signal to do just that? Regardless, I don't know why they are pushing in a somewhat unregulated, volatile cryptocurrency that will be used by extremists, terrorists and the like who in no doubt will not only use it to fund their activities and will be sitting in their group chats but now they can change their phone numbers to hide even further? The road to hell is been paved with good intentions. Hasn't it? But at least Wire does not still require a phone number, nor does it have silly cryptocurrencies in their product for pump and dump purposes.
  - UncleMeat 5y ago
    This has been discussed literally 1000 times. The alternative is having the server know who is talking to whom. Further, phone numbers provide a valuable bootstrap to connect with people. Other secure messengers have chosen a different design than Signal. This means you can choose the one you prefer.
    - SailingSperm 5y ago
      How about no ph number and only UUIDs- You send a msg that only personA can decrypt - but you broadcast the encrypted message to all contacts /+ random UUIDs ... So signal doesn't know who it was intended for exactly, and only personA gets the information. Of course you'd want the app to only alert users getting the broadcast once a received comm is successfully decrypted, otherwise discard. It's clearly a lot higher data overhead, but that'd acheive phone numberless accounts without signal knowing 100% A is talking to B.... Only that 'A' might be talking to 'B'..Or C..or D.. Or sending decoy msgs intended for nobody. Settling for phone numbers on a privacy based messenger because it's too hard to do an alternative implem is a cop out I feel. What do you think of the above proposal?

SecurityLagoon 5y ago

Can people please choose an appropriate title when posting. "You can change your number" makes sense in the context of signal.org but makes little sense on the front page of HN. The RSS feed doesn't even include the domain for context.

nsajko 5y ago
HN guidelines forbid changing the title. I proposed changing this once, but the post didn't get traction. There was more traction for that years ago though. https://news.ycombinator.com/item?id=26300126 https://news.ycombinator.com/item?id=26300126
- deleted 5y ago
  [deleted]
- slyall 5y ago
  I often change titles on submissions. Making them shorter for instance. I also do change some to provide more context that the original source didn't. An article has only 15 minutes in /new to attract enough votes. Sticking with a crappy title nobody will click on wastes everyone's time. Obviously don't go full clickbaity. Sometimes the HN mods change them back.
- dang 5y ago
  > HN guidelines do not forbid changing the title. It's more nuanced than that. See https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html: "Please use the original title, unless it is misleading or linkbait; don't editorialize."
saurik 5y ago
This website has an extremely awkward policy about titles that makes it so if you don't use the original title people get angry. The policy though just doesn't make sense, sadly, as the concept of titles is audience-specific (and even movies or books, which might feel more organized, sometimes have different audiences in different markets). FWIW, I did connect it together as I saw "(signal.org)" and that was sufficient for me in this specific case.

usea 5y ago

How can I use this without a phone or phone number at all? If I am concerned about privacy, why would I give them that access and information when it's not necessary for the service? Surely they are only trying to gather information on their users. Whether it's being sold, breached, or used for ad targeting, I am not interested. It comes across as a scam. I cannot take seriously any claims made by the company or its employees / owners. None of it can be used as evidence of their goodwill or what they do with my data. They have an interest in deceiving me.

colordrops 5y ago
This is for proctecting your data from other end users. Signal still needs your number to provide to three letter agencies.
- sa1 5y ago
  On the contrary, they started out with phone numbers so that they could avoid storing user data on their servers. The whole plan to finally have usernames comes down to their use of Intel SGX.
  - colordrops 5y ago
    What does being tied to a phone number have to do with avoiding storing data on their servers or SGX?
    - sa1 5y ago
      With a phone number, the contact graph can be on the phone. With usernames, the contact graph has to be stored on their servers. They were forced to store (encrypted) information on servers anyway, since client-side contact matching didn't end up scaling, which is why stuff like this and usernames are now being developed. Their new security strategy now relies on decryption being done by client-attested code on SGX enclaves, so that the server still doesn't have access to the plain-text contact graph. All of this took a huge amount of time to come up with, and you can see the progress if you read their blogs or forums.

YaBomm 5y ago

Not sure why you need a phone number? besides government and/or ad tracking. This is why I use Matrix/Element

deleted 5y ago
[deleted]
_joel 5y ago
What's a universal thing to the portable device that everyone has got in their pocket? I agree it's sucky and really there could be better ways, should be something none trackable and perhaps offer opt-in discovery via phone book. Have the option of decoupling it entirely from the phone. The government can track you a lot easier than pinging via signal btw. A lot easier!
- YaBomm 5y ago
  > What's a universal thing to the portable device that everyone has got in their pocket? All phones have internet connectivity... The phone number is completely useless to talk via the internet anyways... > The government can track you a lot easier than pinging via signal btw. A lot easier! I think that it is easier to connect a real-world identity to an internet account when they also have your phone number associated with the account...
  - YaBomm 5y ago

mlissner 5y ago

This is fine, but signal still doesn't tell you when the person you're sending to has uninstalled signal. Instead, your messages go into ether and you think the person is ignoring you. It blows my mind they haven't prioritized this. https://github.com/signalapp/Signal-Android/issues/11164 https://github.com/signalapp/Signal-Android/issues/11164

stavros 5y ago
This shows a single check mark, no? Ie it tells you that the user hasn't received the message.
- jessriedel 5y ago
  Yea, it seems like this is the most information they could give you without violating the addressee's privacy by revealing whether they have uninstalled the app. I suppose it could be worth it if, when the message remains undelivered for a while, Signal added an explicit note to that effect so the sender doesn't misunderstand.
  - mlissner 5y ago
    Yes, exactly this. All that's needed is to tell senders when a message wasn't received after X hours. You don't have to figure out if the user uninstalled. This also happens if they get a new phone and don't re-install on it, so relying on uninstalls wouldn't work anyway.
  - not2b 5y ago
    How can they tell that a user has uninstalled the app? Does uninstalling send a notification to signal.org?
    - jessriedel 5y ago
      I dunno. It's true they might not even have that information.
    - 5y ago

stavros 5y ago

This is a great feature, well done for adding it! However, I'm a bit puzzled as to why seemingly easy bug fixes aren't addressed. There's a longstanding issue with Signal not recognizing that the phone is in a landscape orientation when taking photos, so they're rotated by 90 degrees. I opened an issue[1] and it got closed with a related-but-not-exact workaround. This impacts everyone who takes photos on Android with Signal, it's not a niche problem. It seems like an easy fix, and I'm perplexed that it doesn't get prioritized. Ah well, can't complain too much about a free product. [1] https://github.com/signalapp/Signal-Android/issues/9641 https://github.com/signalapp/Signal-Android/issues/9641

Waterluvian 5y ago
Signal is eating up 11GB of my iOS space. There is no way to clear it without completely uninstalling and reinstalling. And then the problem just resets and grows again. It’s a ridiculously consequential bug and they don’t seem motivated to even comment. Pretty sad.
- grlass 5y ago
  Signal keeps all downloaded media locally until you delete it. They don't have the resources to store files on the cloud, even encrypted, and don't appear to have taken WhatsApp's approach of backing up unencrypted media and messages on user's third-party cloud services like Google Drive and iCloud. You can mitigate this by having disappearing chats (current longest self-destruct time is 4 weeks), or by going to Settings->Data and Storage->Review Storage and deleting the largest files. This isn't a great UX design, as users are not informed there is a problem, or how to solve it.
  - Waterluvian 5y ago
    I don’t want them keeping my data. I don’t want restoring data. I want the ability to purge 11gigs off my device. When you select “delete all message history” it should free up the disk.
  - nottorp 5y ago

asiachick 5y ago

How about no need for a number at all!?!??

deleted 5y ago
[deleted]

yusmary 5y ago

All that is cool, but I don't want Signal to advertise my presence to anybody that has my phone number when I first log in after a fresh install. I have only a handful of people that know and we negotiated that face to face prior, Signal breaks that trust

advisedwang 5y ago
Can you explain this a bit more? Am I correct in understanding that you feel it hurts you when your contacts find out that you have signal installed, hence why signal shouldn't do it? What is the impact of someone who has your phone number knowing you are available over Signal? Are there communities out there where someone being on signal is a red flag?
- valleyer 5y ago
  This is just a shade away from the typical "nothing to hide, nothing to fear" argument, and is in my opinion equally invalid. Let people decide for themselves what in their lives is OK to share with others. You don't need to know the reason why.
  - samatman 5y ago
    Either you don't understand how Signal works vis a vis phone numbers, or you're expecting something unreasonable. The behavior which is reliably objected to by someone on HN, every time Signal is mentioned, is that the app sends a user an alert when someone in their contacts list is on Signal. Phone numbers are the only resolution mechanism in Signal. Should that change? Separate question. Having someone's phone number is by definition a way to contact them. Registering for Signal is by definition agreeing that anyone who searches for your phone number can send you a message on Signal. What is the privacy violation in pushing awareness of that affordance? What about pull-only is better? Signal does what I want it to here, and my trouble understanding why someone would be ok with everything about Signal except the push notification on join to people who have your number is genuine. It's easy for me to understand why people don't like that a phone number is inherent to Signal, don't much care for it myself. But it's unrelated.

rckt 5y ago

Wow, so many discussions about removing the phone number completely and now that's what we get instead.

scotty79 5y ago

Why would supposedly secure communicator use actual phone number as identifier is beyond me. And everybody does that, either phone number or email. The only software I could find for anonymous communication was old Polish communicator http://gg.pl http://gg.pl which uses arbitrary numbers as identifiers I understand that startups are scared that they won't be able to build up userbase from scratch but come on! Discord and Slack did it.

palata 5y ago
Two words: threat model.
- scotty79 5y ago
  I don't get it. I find my interlocutor knowing my phone number a severe threat to my privacy.
  - bt1a 5y ago
    Sure - that's why Signal is for secure communication between individuals who have some level of trust. There's nothing stopping your interlocutor from leaking all of the messages you send to them, what's the big issue with them having your number?
    - scotty79 5y ago
      > Sure - that's why Signal is for secure communication between individuals who have some level of trust. If I have this level of trust with someone they are about at level of adding them as a friend on Facebook. Who knows, I even might invite them on Facebook sooner than I decide to give them my phone number. > what's the big issue with them having your number? Seriously? With my number you can harass me endlessly with phonecalls, text messagers, registering for various services that will harass me basically forcing me to abandon this phone number and notify all of my valuable contacts of the number change. Hell, they might even plaster town with my number with advert saying "Win 50$ in Chewbaca noise contest by subitting your best attempt at that number." as one creative asshole did to some poor girl. > There's nothing stopping your interlocutor from leaking all of the messages you send to them That way less of a problem if I haven't doxed myself in those conversations. All he will publish is some conversations he had with someone.

smm11 5y ago

Signal installs via the app store, and you all are freaking out that it might reveal your phone number? Okay, then.

netizen-936824 5y ago
Signal hosts an apk for download on their website. App stores are not the only place to get applications
Vinnl 5y ago
Not necessarily, at least on Android: https://signal.org/android/apk/ https://signal.org/android/apk/
deleted 5y ago
[deleted]
palata 5y ago
To be fair, you can build it from sources, and I'm pretty sure they provide an apk (they used to, at least).

Trias11 5y ago

STOP asking for my phone number to use your "secure" app. I don't want to disclose my phone number to any user, platform or any app. Just please STOP.

deleted 5y ago
[deleted]

rcarback 5y ago

It is early stage, but there is now an alternative to Signal that doesn't use phone numbers at all: https://xx.network/messenger/ https://xx.network/messenger/ While you can add your number to be searchable by others, it doesn't let strangers with your number know you signed up automatically, either. Full disclosure: I work on the infrastructure behind it.

TacticalCoder 5y ago
Yup. For those who don't know that is David Chaum's quantum-resistant messenger and he's an OG cryptographer (and he's mentioned in Bitcoin's original whitepaper, funnily enough). > Full disclosure: I work on the infrastructure behind it. Oh cool... I ran a node for many months during the beta (from home, fiber optic at home). I'm busy atm so I'm not running anything anymore but I do really hope that a real secure messenger that doesn't leak metadata left and right, and which uses advanced cryptography, shall eventually prevail.
pomian 5y ago
Can you use this to send texts via SMS to regular phone numbers? How does this differ from Linphone?
- rcarback 5y ago
  No it can't use SMS as a transport. It protects metadata using a mixnet and the E2E encryption for authenticated channels uses post quantum cryptography(SIDH) to establish symmetric keys. The infrastructure is run by 3rd party node runners and there's an open source API for other applications in addition to the messenger being open source.
wolverine876 5y ago
We see many apps that promise to be secure. With due respect, why would someone trust this one?
- TacticalCoder 5y ago
  > With due respect, why would someone trust this one? It's the project of David Chaum: https://en.wikipedia.org/wiki/David_Chaum https://en.wikipedia.org/wiki/David_Chaum Which makes that messenger very interesting. It's also quantum-resistant from the get go. I think the beta just went live.

alfiedotwtf 5y ago

It would be nice if it didn't require a phone number. My daughter doesn't have a phone, but I would still like to use Signal with her when she's on a wifi-connected iPad.

wolverine876 5y ago
Regarding your specific issue: You could get your daughter a VOIP number, which can run as an app on the iPad. VOIP numbers can process text messages too, which should enable Signal's confirmation message.
- pomian 5y ago
  Do you have any suggestions on where/how would be best to get a VoIP number?
  - wolverine876 5y ago
    It's very easy; you could have it up and running in an hour, possibly. Here are market leaders for small business, and I presume they would handle consumer accounts. In my very limited experience, I had the best experience with RingCentral. * RingCentral: Softphones only (i.e., applications on a computer), IIRC - no hardware handsets. * Nextiva: In my one experience, the sales culture as a bit of a hustle, but it worked out. * 8x8 * Star2Star: Don't know much about them; maybe medium-to-large business only.
- alfiedotwtf 5y ago
  Oh! Thanks, I never actually thought of that. Awesome

HNSucksAss 5y ago

renewiltord 5y ago

It would be neat if my .eth was a valid message source/target on Signal.

gardnr 5y ago

Can I sign up without a number? Why does Signal require an identifier that is very difficult and perhaps illegal to make anonymous?

__MatrixMan__ 5y ago
Signal stores your contact list on your phone (and not on their servers). Unlike other devices, people typically only have one active phone at any time, which means that your contact list on your phone can be your contact list on any linked device (its primary, they're secondary). If they didn't anchor to something that they knew you only had one of, then it's not clear which of your devices should be authoritative. The alternative is to store your contact list on their servers, but they don't do that because they aren't confident that they could do so in a way that keeps your contacts hidden from somebody who gained access to their servers. Often, letting an adversary know who you associate with is just as dangerous as letting them know what you say to those people. Having your phone number be the key means that metadata security comes down to whether you lock your phone instead of whether the bad guys can get a warrant to compromise Signal's servers. It's a worse user experience, but I can understand not wanting to be responsible for the bad things that happen when bad guys map a target's social network.
- pseudalopex 5y ago
  Mobile telephone subscriptions passed global population 7 years ago.[1] More than 1 phone is not so unusual. End to end encrypted messages are harder than end to end encrypted contacts. Using phone numbers encourages people to use their phone's contacts app. Most people have theirs connected to Google or Apple. If they have other devices especially. [1] https://archive.fo/6je9z https://archive.fo/6je9z
  - __MatrixMan__ 5y ago
    To your first point, if you have two phone numbers then you're probably keeping them separate for a reason, and so their contacts should be kept separate by the app too. As for your second: what are the "ends" you're taking about with this "end to end encrypted contacts" idea? Certainly, a contact list has to be visible at the device--otherwise it's useless. Where else would you want it to be visible?

SSLy 5y ago

So, Android ↔ iOS transfer when?

welder 5y ago

With SIM swapping, does using a phone number mean someone can takeover your Signal account?

slowbdotro 5y ago
You can turn on Registration Lock which requires the PIN if you "re-register" with signal again.
- mort96 5y ago
  So, for most people, who wouldn't think to take extra precautions for Signal specifically, the answer would be yes?

NullPrefix 5y ago

>If you’re getting a new phone, but keeping your old number, you can use our end-to-end encrypted device-to-device transfer on Android or iOS to carry your contacts and chat history over to your new device Is there a way to export chat history into HTML or other file? I want to re read my chat sometime later.

mmaunder 5y ago

Thought this was about you not negotiating against yourself every time an employer asks your current salary.

seany 5y ago

Now let us get rid of it, and not use a phone at all

Amfy 5y ago

Oh Thank you!

wolverine876 5y ago

Can users choose an arbitrary number?

legalcorrection 5y ago

It's been promised for years, but you still can't use a second phone as a linked/secondary device. As a result, it is literally impossible to have the same signal account on two iPhones. Since they already support using an iPad as a linked device, this would require little more than changing a flag and a recompilation. Maybe they have their reasons, but all they keep saying is 'soon'.

BugsJustFindMe 5y ago
> but you still can't use a second phone as a linked/secondary device. As a result, it is literally impossible to have the same signal account on two iPhones. I use my google voice number on multiple phones.
- legalcorrection 5y ago
  That's not how that works. If you sign up for Signal with the same number on multiple iPhones, for example, only the last one will still be connected. The iPhone app only supports being the primary device. There can only be one primary device per account.
lkxijlewlf 5y ago
This is the feature I want most. I have my EDC and then I have a "if I drop it in the ocean, oops" phone.
- gefhfffh 5y ago
  You could bridge Signal with Matrix and then use two Matrix clients. Quite a workaround, but should work ;-)
  - zaik 5y ago
    Bridges break end-to-end encryption.
    - 5y ago

snowgrove 5y ago

I stopped using Signal, along with my adult tech-oriented friends, when we all had bad experiences migrating our accounts to new phones. That plus the phone number requirement, intrusive contacts integration, and the weird crypto side projects killed my interest in Signal entirely. My friends and I use Discord now.

sneak 5y ago
Discord is not end to end encrypted, and Discord, along with whoever buys them, will receive the complete plaintext message history of all of your conversations with those friends.
- enlyth 5y ago
  So some algorithm somewhere will eventually try to parse five years of shitposts and memes between me and my friends and try to figure out what it can advertise to me based on it, I can't say I'm even mad
  - sneak 5y ago
    https://en.m.wikipedia.org/wiki/Third-party_doctrine https://en.m.wikipedia.org/wiki/Third-party_doctrine
  - berkes 5y ago
    Ah, the old 'I don't need privacy because I have nothing to hide' fallacy.
    - enlyth 5y ago
      I have nothing to hide because I recognize the intentions and limitations of different platforms. Discord is a gaming chat platform and I post and act accordingly there. I don't understand why I should be entitled to privacy on a free chat platform hosted with someone else's money.
      - 5y ago

NaturalPhallacy 5y ago

Signal is more valuable to democracy than CNN and Fox News combined.

NaturalPhallacy 5y ago

Not being able to use the same account on my phone and ipad is retarded.

YaBomm 5y ago

erenw 5y ago

"I use Signal every day." - Edward Snowden Okay, im in

antman 5y ago

This is an important addition. My request list would be from easier to harder: - Strong anonymity - Offline and cloud encrypted backups that can be imported to the new IDs (also potential monetization source) - Secondary IDs per user and one off IDs, with the nature of said IDs communicated to the other party (primary, secondary permanent, one off). Of course it could create problems but with a proper blocking mechanism within signal (e.g. block one off IDs and secondary IDs from unknown numbers) by default would be seamless. -Mobilecoin usage seamless across IDs, retaining anonymity

wh33zle 5y ago
I would love to move the backup off my device. It is eating my storage but I also don't want to delete it!

compsciphd 5y ago

I never understood using phone # as a permanent ID. phone numbers change (heck, I effectively have 2 whatsapps, because I have a US phone # and an international phone # because of this). ID shouldn't matter to most users (it can be hidden behind the scenes). Phone # is great for looking up the ID, but users should be able to remap it at will. Example: register with your phone #. This generates a new ID (you don't know or care about it). If you have to login from a new device, that doesn't have the ID stored, can you login with your phone #, but all this does is look up the ID and uses that ID to try and then authenticate you. If someone wants to find you, they use the phone number to look up your ID. Once its looked up and mapped, the phone number never needs to be used again. If I change my phone #, all I have to do is update the mapping of phone # -> id (i.e. add a new entry, remove the old entry). Anyone contacts who have me already, will not be bothered by this (they only care about the ID, which they already have). new "contacts" will also behave correctly, as I no longer have that phone #, so it shouldn't be able to be used to find me (it might be someone else's # now). Users would be able to move phone #s and their existing contacts would be able to follow them. New telephone users would be able to get recycled old phone #s without getting messages from the old owner of number's contacts (assuming they had previously contacted). the only places I see people think this might fall down (but I think are wrong) is 1) if the same user creates a new id with the old phone #. However, the solution seems pretty simple, you just need a way to invalidate the old ID (i.e. never to be used again) and force the contact to get the new id for the phone number. 2) what happens when a user moves devices. i.e. they might have to redo the mapping of phone # -> id. However. at its worst, this is no worse than the current system (which effectively does that update on every single message). In practice, there are ways to move data between devices which would just move the mappings with it (examples being a cloud cache backup, the ability migrate data from device to device, or probably other ways as well).

Katherine1212 5y ago