3 ms·
Please, stop using phone numbers. There is no reliable way to hold a phone number. The messaging protocols are insecure. If your service uses phone numbers or S
by beefee 4y ago
Please, stop using phone numbers. There is no reliable way to hold a phone number. The messaging protocols are insecure. If your service uses phone numbers or SMS, that means it's not secure or reliable.
- registeredcorn 4y agoNot only that, I don't want any service that I use tied to a phone number. Partially for the reasons you listed, but also because there are better alternatives; email, authenticator apps, physical keys, cards, etc. I hate looking at my phone. I hate using my phone. I don't want to have even more reasons to keep my phone charged and in my hand. Phones suck.
- spurgu 4y agoThe Signal desktop app doesn't require your phone to be turned on (once it's been "paired") by the way, as opposed to for example Whatsapp.
- LtWorf 4y agoBy desktop app you mean a website cosplaying as a desktop app.
- spurgu 4y agoI didn't know Signal had a web app. Yes, I'm aware the desktop app is made with Electron. So what? I keep it running almost all the time and I've never had any performance issues with it.
- LtWorf 4y agoWell, it's slow, it has awful accessibility, you can't create accounts from a computer, you will have performance issues with it if you need the resources for something else. Also it won't work on linux phones.
- brewdad 4y agoWhatsapp has finally gotten away from requiring your phone to be on. It works the same way as the Signal app now.
- spurgu 4y agoAh, didn't know that, but you're right (just tried it)! That's cool. I ran into this issue around a year ago when my phone broke.
- registeredcorn 4y agoWell sure, but does it require me to use my phone at some point in the process of account creation? That's the part I have an issue with. I had assumed that there would be an alternative to access the service post-creation. My gripe is more with the fact that a phone is a requirement at any point. To put it another way: imagine I had to send a letter to Signal's HQ in order to make an account. Now, obviously I'm not going to be sending and receiving letters constantly to/from Signal, but the mere fact that writing and sending a letter would be a requirement as part of the process would be at the users personal detriment. That's the point I was trying to get at - that it is forcing the user into a specific method which is undesired, arbitrary, and frustratingly unnecessary.
- spurgu 4y agoYeah agreed, as I mentioned elsewhere I don't see why phone number should be required. It's a good default (esp. for non-technical users) to use phone number and contacts (= "social network"), but I really don't see what the problem is with using email or just username/password combo and then adding contacts manually from wherever. Why not have that option? Most people would likely still use their phone number for this.
- marshray 4y agoWhat identity token would you prefer? Would it be bound to the mobile device in any way? Would it require that a canonical list of registered identities be stored server-side? How would you impose a cost on spam accounts without burdening users? Just a few considerations.