4 ms·

This decision seems pretty crazy to me, especially on the cell phones where a lot of apps require phone book access to function, and there is generally no way t

by theamk 5y ago

This decision seems pretty crazy to me, especially on the cell phones where a lot of apps require phone book access to function, and there is generally no way to give a different view to different apps. I understand that Signal wants to be blame it all on users, but the practical consequence of their design is that the moment people want to talk to a single person on Whatsapp, they give out Signal contact list to Facebook.. and the moment they start using Google's backup, they give out Signal contact list to Google.. and if they ever buy a new phone, they share Signal contact list with whoever wrote migration tool for their data. And there are tons of other random apps which all require contact list access... From the privacy standpoint, Signal having contact list would be better. At least then, I'd have a single party to worry about, instead of dozens.

tptacek 5y ago
Signal having the contact list means that they'd be subject to legal (and extralegal) process to obtain the entire contact list for everybody using the service, which is untenable for them. Again: Signal is not Discord or WhatsApp; these are different services with different primary objectives.
- pydry 5y ago
  It could be E2E encrypted.
- gojomo 5y ago
  Because the app constantly prompts for contact-list access, Signal's software-on-device definitely has the contact list. And, that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol. So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.)
  - tptacek 5y ago
    I haven't kept up with what they're doing so grain of salt on this, but I think this is incorrect. What they're moving towards is a design that looks like what Apple did with their HSM quorum system. The contact information we're talking about is encrypted clientside, but with (usually) a memorable pin. Without countermeasures, memorable PINs are very easy to attack; SGX allows them to artificially limit guesses. As a user, you retain a security dial on this: you can use a more complicated passcode than a 4-digit pin if you don't trust SGX. Obtaining the whole database Signal maintains gives you ciphertext that you need to mount attacks on user-by-user (and to make those attacks, you'd have to break SGX). It doesn't simply give you the plaintext SQL database other messaging systems collect.
    - gojomo 5y ago
      Yes, if you "break SGX", Signal's contact-intersection-privacy guarantees fall. Are you confident that SGX is unbroken?
    - stavros 5y ago
      AFAIK they don't encrypt the contact list, they hash each number and send a few bits of the hash to the server. The server replies with a few possible hashes it knows about, so the client can reason that "if the hash I was asking about is in that set, the user I want to talk to has Signal installed".
  - wolverine876 5y ago
    > Because the app constantly prompts for contact-list access AFAIK, it prompts at first, maybe a few times, but then stops. > Signal's software-on-device definitely has the contact list Definitely not required at all. Signal can use its own contact list. > that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol The SGX enclaves are not for contact discovery. Contact discovery worked long before Signal implemented the SGX enclaves. As I understand it: The SGX enclaves store a crypto key that Signal adds to the user's password, to enable data migration: Users tend to choose weak passwords; if Signal truly wants their data to be secure, strong passwords aren't realistic. Their solution is ingenious (IMHO): 1) Append a random key to strengthen the password chosen by the user. 2) A locally stored key would be a big problem for data migration, such as lost phones; the key would be lost too, and thus all the user data. 3) Therefore, they store the key centrally, as securely as possible (in the SGX enclave). That does make the key more vulnerable, but if you choose a strong password then it's irrelevant - the attacker needs to defeat both the key and your password. You can also disable this backup feature if you like. Some reading (partly because I might misremember a detail or two): https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th... I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? > So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.) Again, if you choose a strong password then you only need to trust yourself, and I think you can disable it altogether.
- theamk 5y ago
  If one wants to avoid having contact list on server, they don't have to force everyone to use government issued and fully controlled identifiers. They can do local contacts storage, and use emails... or even random numeric identifiers (anyone remembers ICQ?). I think novok is right in their uncle comment -- the decision to force people to use phone numbers, with all the related privacy problems, was to increase adoption. And we should be upfront on it: "Yes, Signal could have made things more private if they would allow usernames/emails/UINs... but instead they decided to force phone numbers to get market share as fast as possible. Yes, this means millions of people are forced to share the Signal contact list with Facebook and Google, but it was worth it -- look we have 40 million users now!" There is nothing wrong with reducing user's privacy in order to get more market share. But let's not claim that this was for users' benefits.
novok 5y ago
Back when signal was getting started, using the contact list to bootstrap buddy lists and reduce adoption friction was definitely the right decision. Now they are more established, they can offer the username only version for the %2 that will actually benefit from it. And now that %2 has the cover of a large established user base to blend in as noise. You have to remember, signal is about E2EE security for EVERYONE, not just nerds. There will imperfect solutions along that path, which also means things like no federation. Signal is very much about being effective vs about being 'right' and ineffective, because when you are king, you can start being right and effective.
wolverine876 5y ago
> From the privacy standpoint, Signal having contact list would be better. Signal can operate using its own contact list, without accessing your phone's central contacts.
brimble 5y ago
Wait—when you're using Signal, it resorts to using your whole-phone contact list when, say, you want send a direct message? That would be... not great UX, with my personal use of my phone contact list (mostly for people I barely ever message, contacts I'd never message but want to have a phone number and/or address down, or relatives who don't/can't use anything but SMS)

by theamk 5y ago

tptacek 5y ago

Signal having the contact list means that they'd be subject to legal (and extralegal) process to obtain the entire contact list for everybody using the service, which is untenable for them. Again: Signal is not Discord or WhatsApp; these are different services with different primary objectives.

pydry 5y ago
It could be E2E encrypted.
gojomo 5y ago
Because the app constantly prompts for contact-list access, Signal's software-on-device definitely has the contact list. And, that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol. So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.)
- tptacek 5y ago
  I haven't kept up with what they're doing so grain of salt on this, but I think this is incorrect. What they're moving towards is a design that looks like what Apple did with their HSM quorum system. The contact information we're talking about is encrypted clientside, but with (usually) a memorable pin. Without countermeasures, memorable PINs are very easy to attack; SGX allows them to artificially limit guesses. As a user, you retain a security dial on this: you can use a more complicated passcode than a 4-digit pin if you don't trust SGX. Obtaining the whole database Signal maintains gives you ciphertext that you need to mount attacks on user-by-user (and to make those attacks, you'd have to break SGX). It doesn't simply give you the plaintext SQL database other messaging systems collect.
  - gojomo 5y ago
    Yes, if you "break SGX", Signal's contact-intersection-privacy guarantees fall. Are you confident that SGX is unbroken?
  - stavros 5y ago
    AFAIK they don't encrypt the contact list, they hash each number and send a few bits of the hash to the server. The server replies with a few possible hashes it knows about, so the client can reason that "if the hash I was asking about is in that set, the user I want to talk to has Signal installed".
- wolverine876 5y ago
  > Because the app constantly prompts for contact-list access AFAIK, it prompts at first, maybe a few times, but then stops. > Signal's software-on-device definitely has the contact list Definitely not required at all. Signal can use its own contact list. > that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol The SGX enclaves are not for contact discovery. Contact discovery worked long before Signal implemented the SGX enclaves. As I understand it: The SGX enclaves store a crypto key that Signal adds to the user's password, to enable data migration: Users tend to choose weak passwords; if Signal truly wants their data to be secure, strong passwords aren't realistic. Their solution is ingenious (IMHO): 1) Append a random key to strengthen the password chosen by the user. 2) A locally stored key would be a big problem for data migration, such as lost phones; the key would be lost too, and thus all the user data. 3) Therefore, they store the key centrally, as securely as possible (in the SGX enclave). That does make the key more vulnerable, but if you choose a strong password then it's irrelevant - the attacker needs to defeat both the key and your password. You can also disable this backup feature if you like. Some reading (partly because I might misremember a detail or two): https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th... I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? > So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that deliver/update the Signal software on-device.) Again, if you choose a strong password then you only need to trust yourself, and I think you can disable it altogether.
theamk 5y ago
If one wants to avoid having contact list on server, they don't have to force everyone to use government issued and fully controlled identifiers. They can do local contacts storage, and use emails... or even random numeric identifiers (anyone remembers ICQ?). I think novok is right in their uncle comment -- the decision to force people to use phone numbers, with all the related privacy problems, was to increase adoption. And we should be upfront on it: "Yes, Signal could have made things more private if they would allow usernames/emails/UINs... but instead they decided to force phone numbers to get market share as fast as possible. Yes, this means millions of people are forced to share the Signal contact list with Facebook and Google, but it was worth it -- look we have 40 million users now!" There is nothing wrong with reducing user's privacy in order to get more market share. But let's not claim that this was for users' benefits.

novok 5y ago

Back when signal was getting started, using the contact list to bootstrap buddy lists and reduce adoption friction was definitely the right decision. Now they are more established, they can offer the username only version for the %2 that will actually benefit from it. And now that %2 has the cover of a large established user base to blend in as noise. You have to remember, signal is about E2EE security for EVERYONE, not just nerds. There will imperfect solutions along that path, which also means things like no federation. Signal is very much about being effective vs about being 'right' and ineffective, because when you are king, you can start being right and effective.

wolverine876 5y ago

> From the privacy standpoint, Signal having contact list would be better. Signal can operate using its own contact list, without accessing your phone's central contacts.

brimble 5y ago

Wait—when you're using Signal, it resorts to using your whole-phone contact list when, say, you want send a direct message? That would be... not great UX, with my personal use of my phone contact list (mostly for people I barely ever message, contacts I'd never message but want to have a phone number and/or address down, or relatives who don't/can't use anything but SMS)