5 ms·

> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has).

by gst 5y ago

> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800cbdb3afa01a67390b6efa2fc91be6/app/src/main/java/org/thoughtcrime/securesms/util/UsernameUtil.java https://github.com/signalapp/Signal-Android/blob/a5e5a735800...

crossroadsguy 5y ago
It is unfortunate that they seem to be going for user created username. I’d rather have something like ~hkopy-vnhyt randomly generated and given to users with option to try for another randomly generated username if they didn’t like the first.
- Godel_unicode 5y ago
  Nobody is stopping you from doing that for yourself.
  - julianwachholz 5y ago
    Well the username "~hkopy-vnhyt" would be invalid because they only allow case insensitive a-z, digits and _ underscores. I can see some reasoning, but there's technically nothing stopping them from allowing more universal ASCII characters at the very least.
godelski 5y ago
Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.
- iqanq 5y ago
  So choose an identifier that does not... identify you. Or choose not to have a username. I assume that that will be an option, since Telegram has it as well.
  - thaumasiotes 5y ago
    No, the problem your parent is referring to is that you have the same username in every chat. Discord really suffers from this.
    - godelski 5y ago
      Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that username. But now I've deanonymized myself to friends and family who can see that username through Signal. Alternatively, if I have a username "not_godelski" then how do I get in contact with someone on HN while maintaining anonymity? If I use share it under this account then those two names are linked forever and that deanonymizes me. I can't create a new account just to share that name because those groups know me by that name. If I can have an infinite number of usernames, that solves the problem, but this isn't practical (even 5 usernames would be problematic and requires a lot of cognitive load, which is antithetical to Signal's philosophy). There's also a third problem I don't care as much about but I'd assume Signal does. And that's naming collisions. NYT has a Signal number that allows whistleblowers to contact them. What's stopping me from creating the username NYT_Whistleblower and becoming a honeypot? Edit: Lots of people are saying you can't share contact without revealing your identity. Does a 1-click link not solve this issue? If I post a signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g then I don't see how that would reveal my identity. (I'm also not a fan of "you can't". I can understand this being unsolved, but it feels like there are solutions to this problem)
      - 5y ago

by gst 5y ago

crossroadsguy 5y ago

It is unfortunate that they seem to be going for user created username. I’d rather have something like ~hkopy-vnhyt randomly generated and given to users with option to try for another randomly generated username if they didn’t like the first.

Godel_unicode 5y ago
Nobody is stopping you from doing that for yourself.
- julianwachholz 5y ago
  Well the username "~hkopy-vnhyt" would be invalid because they only allow case insensitive a-z, digits and _ underscores. I can see some reasoning, but there's technically nothing stopping them from allowing more universal ASCII characters at the very least.

godelski 5y ago

Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.

iqanq 5y ago
So choose an identifier that does not... identify you. Or choose not to have a username. I assume that that will be an option, since Telegram has it as well.
- thaumasiotes 5y ago
  No, the problem your parent is referring to is that you have the same username in every chat. Discord really suffers from this.
  - godelski 5y ago
    Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that username. But now I've deanonymized myself to friends and family who can see that username through Signal. Alternatively, if I have a username "not_godelski" then how do I get in contact with someone on HN while maintaining anonymity? If I use share it under this account then those two names are linked forever and that deanonymizes me. I can't create a new account just to share that name because those groups know me by that name. If I can have an infinite number of usernames, that solves the problem, but this isn't practical (even 5 usernames would be problematic and requires a lot of cognitive load, which is antithetical to Signal's philosophy). There's also a third problem I don't care as much about but I'd assume Signal does. And that's naming collisions. NYT has a Signal number that allows whistleblowers to contact them. What's stopping me from creating the username NYT_Whistleblower and becoming a honeypot? Edit: Lots of people are saying you can't share contact without revealing your identity. Does a 1-click link not solve this issue? If I post a signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g then I don't see how that would reveal my identity. (I'm also not a fan of "you can't". I can understand this being unsolved, but it feels like there are solutions to this problem)
    - 5y ago