4 ms·

I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make the

I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.

tptacek 4y ago
It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but requires Signal to keep a database of contacts serverside. That's untenable for Signal's threat model.
- daneel_w 4y ago
  The sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone. Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm sure.
  - tptacek 4y ago
    That's a good way to build a secure messaging app nobody ever uses.
    - 8ytecoder 4y ago
      Signal still assumes you manage your contacts no? It happens via iCloud or a google account today.
    - daneel_w 4y ago
      It may very well be the case for the smartphone-flipping demographic that prefer WhatsApp and TikTok, but I think it's a misunderstanding/misrepresentation of the crowd that go for e.g. Signal and Telegram.
      - detaro 4y ago
        Signals very explicit goal is making something that's usable for everybody. If they'd wanted to make a nerd-messenger they'd make a different product. (I still consider it a major downside that the phone number is the only lookup key)
        daneel_w 4y ago
        Sounds pretty drastic to me to draw the line between "everybody" and "nerds" at the point of the contact book being available or not.
        detaro 4y ago
        Feel free to insert your word choice of "smartphone-flipping demographic" instead. The point is that if you argue based on "the crowd that goes for signal", that crowd being everyone is the clear aim of Signal, and thus they design around that goal.
      - roughly 4y ago
        Large swaths of my non-tech social group are on Signal because it offers a large amount of practical security and privacy without the kinds of sacrifices people seem to assume signal users want to take. Signal has successfully and dramatically increased the number of people enjoying privacy in their communications by not making that assumption.
      - joshuamorton 4y ago
        The majority of my signal contacts aren't particularly tech-literate. The crowd that go for signal and the crowd that go for telegram are different crowds, in a large part because signal designed itself to be accessible to nonexperts.
    - atemerev 4y ago
      That anonymous IDs can be _optional_, in addition to phone numbers. Again, like Threema is already doing.
- potatototoo99 4y ago
  Why would contacts need to be saved though? If I change my phone, I expect my contacts will be copied in some manner, and they'll be available on the new phone. Why would a messaging app need a persistent social network of contacts?
- teraflop 4y ago
  After countless discussions of Signal on HN, I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list. Surely, in either case the identifier can be treated as an opaque string, right? Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break? By saying "without phone numbers, they can't use clientside contact lists", you seem to be suggesting that something would break, but I can't imagine how, unless it's as trivial as a database constraint that says "this field must contain only digits".
  - spullara 4y ago
    People don't have email addresses in their contact lists because all their email contacts are stored on Google servers.
    - xorcist 4y ago
      Having the ability to identify by other strings than "phone number" wouldn't take away any functionality, just add it. It would be possible to communicate with devices that have email but not phone numbers (children without SIM cards, for example). But this is all moot because phone numbers aren't just opaque binary strings. They are more useful than other forms of identification.
      - spullara 4y ago
        That isn't why Signal uses phone numbers. It uses phone numbers because users have a local list of phone numbers they communicate with and Signal can use that to determine if people you communicate with are on Signal. If there was a reliable local list of email addresses they could use that but most people use cloud email now and don't have their email addresses they communicate with on their device.
  - spurgu 4y ago
    > I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list OS functionality? There no "Grant access to Gmail contacts" (= email addresses) on Android/iOS, so that client-side list would have to be manually maintained, while (practically) everyone already has a contact list containing phone numbers of their friends. That said I don't see why a user would have to have a stored social network at all, why can't it simply be opt-out?
- daneel_w 4y ago
  > "It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design." I don't understand why you state this, when you obvioulsy know that data is connectable and joinable across discrete sources. Being "the only social network available to service X" is the inherent case for every single online service on the entire planet when viewed as an isolated entity. But this isn't a case of anonymized UUIDs. It's a case of personal phone numbers.
- deleted 4y ago
  [deleted]
- xorcist 4y ago
  That doesn't follow. A client side contact list does not need to consist of phone numbers. Apart from using the device contact list (which contains email addresses as well as phone numbers) the client can also keep a private contact list.
- 3np 4y ago
  I feel we've had this conversation before. IIRC this is where we left off: E-mail as a complement should work fine and supported in all contact lists. It wouldn't change a thing wrt what you're describing.

tptacek 4y ago

It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but requires Signal to keep a database of contacts serverside. That's untenable for Signal's threat model.

daneel_w 4y ago
The sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone. Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm sure.
- tptacek 4y ago
  That's a good way to build a secure messaging app nobody ever uses.
  - 8ytecoder 4y ago
    Signal still assumes you manage your contacts no? It happens via iCloud or a google account today.
  - daneel_w 4y ago
    It may very well be the case for the smartphone-flipping demographic that prefer WhatsApp and TikTok, but I think it's a misunderstanding/misrepresentation of the crowd that go for e.g. Signal and Telegram.
    - detaro 4y ago
      Signals very explicit goal is making something that's usable for everybody. If they'd wanted to make a nerd-messenger they'd make a different product. (I still consider it a major downside that the phone number is the only lookup key)
      - daneel_w 4y ago
        Sounds pretty drastic to me to draw the line between "everybody" and "nerds" at the point of the contact book being available or not.
        detaro 4y ago
        Feel free to insert your word choice of "smartphone-flipping demographic" instead. The point is that if you argue based on "the crowd that goes for signal", that crowd being everyone is the clear aim of Signal, and thus they design around that goal.
    - roughly 4y ago
      Large swaths of my non-tech social group are on Signal because it offers a large amount of practical security and privacy without the kinds of sacrifices people seem to assume signal users want to take. Signal has successfully and dramatically increased the number of people enjoying privacy in their communications by not making that assumption.
    - joshuamorton 4y ago
      The majority of my signal contacts aren't particularly tech-literate. The crowd that go for signal and the crowd that go for telegram are different crowds, in a large part because signal designed itself to be accessible to nonexperts.
  - atemerev 4y ago
    That anonymous IDs can be _optional_, in addition to phone numbers. Again, like Threema is already doing.
potatototoo99 4y ago
Why would contacts need to be saved though? If I change my phone, I expect my contacts will be copied in some manner, and they'll be available on the new phone. Why would a messaging app need a persistent social network of contacts?
teraflop 4y ago
After countless discussions of Signal on HN, I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list. Surely, in either case the identifier can be treated as an opaque string, right? Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break? By saying "without phone numbers, they can't use clientside contact lists", you seem to be suggesting that something would break, but I can't imagine how, unless it's as trivial as a database constraint that says "this field must contain only digits".
- spullara 4y ago
  People don't have email addresses in their contact lists because all their email contacts are stored on Google servers.
  - xorcist 4y ago
    Having the ability to identify by other strings than "phone number" wouldn't take away any functionality, just add it. It would be possible to communicate with devices that have email but not phone numbers (children without SIM cards, for example). But this is all moot because phone numbers aren't just opaque binary strings. They are more useful than other forms of identification.
    - spullara 4y ago
      That isn't why Signal uses phone numbers. It uses phone numbers because users have a local list of phone numbers they communicate with and Signal can use that to determine if people you communicate with are on Signal. If there was a reliable local list of email addresses they could use that but most people use cloud email now and don't have their email addresses they communicate with on their device.
- spurgu 4y ago
  > I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list OS functionality? There no "Grant access to Gmail contacts" (= email addresses) on Android/iOS, so that client-side list would have to be manually maintained, while (practically) everyone already has a contact list containing phone numbers of their friends. That said I don't see why a user would have to have a stored social network at all, why can't it simply be opt-out?
daneel_w 4y ago
> "It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design." I don't understand why you state this, when you obvioulsy know that data is connectable and joinable across discrete sources. Being "the only social network available to service X" is the inherent case for every single online service on the entire planet when viewed as an isolated entity. But this isn't a case of anonymized UUIDs. It's a case of personal phone numbers.
deleted 4y ago
[deleted]
xorcist 4y ago
That doesn't follow. A client side contact list does not need to consist of phone numbers. Apart from using the device contact list (which contains email addresses as well as phone numbers) the client can also keep a private contact list.
3np 4y ago
I feel we've had this conversation before. IIRC this is where we left off: E-mail as a complement should work fine and supported in all contact lists. It wouldn't change a thing wrt what you're describing.