11 ms·
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
by AdmiralAsshat 4y ago
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal.
...eh, who am I kidding?
- colinmhayes 4y agoHow do you deal with spam without requiring a phone number to register?
- giancarlostoro 4y agoWho is dealing with the spam SMS messages I get all year round? Phone numbers do not stop spam, they are used to distribute it. I know I received no spam when I had Google Talk... It is a solvable problem that I guess benefits nobody in power to solve.
- colinmhayes 4y agoSpam is one of the major reasons people don’t use sms. “The product Were replacing sucks so our product can suck too”
- Aachen 4y agoI don't use SMS because I can't download an open source client to use on desktop, send pictures or other files, edit messages, encrypt conversations, share a live location, hold a poll, have group chats with some semblance of scale, it just doesn't work for more than receiving an occasional message as last resort. Spam via sms doesn't seem to really exist here, maybe two per year now, up from zero until three years ago.
- soziawa 4y agoThreema seems to manage just well. I guess payment is the natural limiter for spam there.
- uoaei 4y agoAnd accessibility.
- ssizn 4y ago
- rt4mn 4y agoGive people the option to pay. I would gladly pay $100 one time fee if it meant I could avoid having a phone number associated. https://jmp.chat https://jmp.chat is a great work around but I would rather just have an email address or ideally nothing but a receipt directly associated with my signal account.
- croes 4y agoIsn't email even worse for security?
- rakoo 4y ago"security" is vast and means different things to different people. Email can absolutely be used for with e2e encryption keeping the content of exchanges from external eyes. Email can absolutely not be used for hiding metadata of who talks to who.
- lillecarl 4y agoDepends, if you're able to poison the DNS of the mailprovider / hack the recipient mailserver or do a phising attack. I just want to be able to communicate without sharing my phone number (since my phone number is bound to Swedish "Swish") meaning someone can get my ID from my phone number here. This is why drug dealers use Wickr, Threema and others, because they don't expose identity, not because they're "safer". I have a contact on Threema who I've met many times, but I have no idea how to contact him outside of Threema, because I don't know his identity and we'd both like to keep it that way.
- eitland 4y agoYou can trivially create as many emails as you want, anonymously and for free. In many countries, registering phone numbers anonymously is illegal and/or impossible.
- thaumasiotes 4y ago> You can trivially create as many emails as you want, anonymously and for free. Where? Gmail and hotmail both don't allow this.
- capableweb 4y agoOne option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.
- freedomben 4y ago> Add in rate limiting so you can only have N open "invitations" and spamming should be very limited. That also sounds like a good way to limit adoption as well, at least for anyone with more the N contacts, particularly >= 2N as that means likely a minimum waiting period before you can transfer over "more" contacts since some people will never accept/reject the invite because they don't use the app much. If it were me and I had to wait on others to accept or reject my invite before I can continue transferring contacts, I'm gonna move on.
- Aachen 4y agoI don't see the difference between some Isabelle showing up as someone to accept or deny, or some Isabelle with a "I'm a hot single in your area, click this link" message so I'm sure it's spam. On Telegram this is rampant, on average probably one person per day. It shifted from e-gold scams to sex since a few months, but both are still present. People that aren't in big groups (where the spammers scrape user IDs) have zero problems, so the trick is revealing your random identifier only to those you want to contact you. Phone number identifiers are the antithesis to spam protection: we keep our ranges just full enough that we can't shorten it by a digit, but empty enough that we have small growth possibilities. You're very likely to hit a subscriber, by design, by trying random numbers.
- tptacek 4y agoSignal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up contact lists altogether (at which point nobody would use the service), or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available to a state-level adversary.
- rt4mn 4y ago> It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. This makes sense for contact discovery, which is important for normal people who just want a chat app that works. But there are a very important segment of signal users, people with an elevated threat model, who I would be willing to bet a good portion of them would gladly sacrifice contact lists if it meant not having to share their phone number.
- Aachen 4y ago> or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available Why couldn't they just keep using the current system, alongside usernames, for phone number contact discovery? Of course for those who opt into it; imo that's what it should be.
- daneel_w 4y agoUsers having to add their contacts each time they set Signal up on a new phone, should the app keep its own client-side contact book, doesn't sound like hassle. Could you please explain how Signal does not have a social network map, when 1) user accounts are equal to mobile phone numbers, and 2) Signal servers route messages between user accounts.
- dylan604 4y agowhich is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
- jraph 4y agoIt's unsafe. They could lock you out from your Signal account and impersonate you. Someone who does not know you changed your number, forgot about it or does not think about this could then send a message to the person who has your old phone number thinking it's you at the other end. Most people don't bother with the warning about the security number having changed. I also personally assume that the phone number of a contact in Signal is theirs and that I can send an SMS or call them with this phone number. This not being true is at best confusing even if you are not locked out. It'd also be nice to let the current user of your old number to be able to join Signal without issues. I'd say don't play with fire and migrate as soon as possible before having issues. You probably could follow https://support.signal.org/hc/en-us/articles/360007062012-Change-Number https://support.signal.org/hc/en-us/articles/360007062012-Ch... Then the people with who you discussed on Signal will be notified of your number change. If you can't follow this, better decide to handle it the best way you can instead of having to deal with this when you have lost access.
- dylan604 4y agoThanks for the link. I have been way too lazy after having the new number for nearly a year. I just couldn't not do it after someone on the internet did the heavy lifting for me.
- daneel_w 4y agoI've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.
- tptacek 4y agoIt's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but requires Signal to keep a database of contacts serverside. That's untenable for Signal's threat model.
- daneel_w 4y agoThe sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone. Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm sure.
- the_other 4y ago
- dvzk 4y agoIt was because of over-represented complaints about phone number requirements that Signal implemented the mistake that is SGX and server-side contact lists. Now the social graph of millions of Signal users is instead centrally protected by Intel's attestation obfuscation and a weak 4-digit PIN. All to eventually support usernames, which normies won't use.
- colordrops 4y agoDo "normies" care about high quality encryption? And did signal ever turn on username support?
- dvzk 4y agoI think developers have a moral responsibility to make their products as secure as possible, within reason and while still being usable. It doesn't matter if the users care about the benefits. To your second question: no, not yet.
- colordrops 4y agoI fully agree with you, and my first question was asked somewhat sarcastically. For the second, my implication is that developers also have a moral responsibility to make their products as private as possible, and SMS verification aint it.
- ajmurmann 4y agoWhy are server-side contact lists needed to support identities not linked to phone numbers?
- lxgr 4y agoSignal (or, more accurately, one of its predecessors) used to use client-side private set intersection for contact discovery, but this scales poorly [1]. Now they use a solution based on Intel SGX and server-side trusted computing [2]. [1] https://signal.org/blog/contact-discovery/ https://signal.org/blog/contact-discovery/ [2] https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- godelski 4y agoI think they are. I just also think the problem is a lot harder than people give it credit for. If they just go with a standard username (as in some form of a database lookup) then I'll be upset. But I'll be upset because this effectively doesn't solve any issue, and introduces others that have big privacy impacts and requires Signal to be a trusted source (which is antithetical to Signal's proposed mission). I do wish Signal would be more transparent though. Given that this is such a difficult problem and they've been struggling with it for years, it reasons that it is time to seek help. This is like when a student just studies for hours and hours on end, spinning their wheels. They aren't learning anything. At some point you need a tutor, help from a friend, or asking the professor for help. (Or analogy in work if that's better) Signal, it is time to be transparent.
- notpushkin 4y agoSignal is a trusted source already – you trust them telling you which number is which user.
- godelski 4y agoSorry, let me clarify. We should trust Signal as little as possible. That's how the design should work. Zero trust is very hard to create but let's minimize it. Opening up usernames (in the conventional sense) you will end up needing to verify and act as an arbiter. This is due to the fact that certain usernames have real world meaning behind them and you don't want to create an ecosystem where it is really easy to honeypot whistleblowing platforms (how do you ensure that CNN gets {CNN, CNN-News, CNNNews, etc}?). They've suggested that this might be the case given that the "Notes to self" and "Signal" users are verified with a blue checkmark. The issue is that verifying users not only makes Signal a more trusted platform but the act of verification requires obtaining more information about the user. It also creates special users. All things I'm very against. I'd rather hand out my phone number than have Signal collecting this type of information. So yeah, it isn't completely trustless, but I certainly don't want to move in the direction of requiring more trust.
- throwaway290 4y agoSignal does not tell me which number is which user. I know which number is who myself. The most Signal does is presumably warn me when the key associated with the number changed (eg. new phone). And that's where I have to trust Signal, but as a protocol not a "trusted source" of information.
- deleted 4y ago[deleted]