9 ms·
I will admit that this requirement always confused me. What is there to benefit from by requiring it?
by A4ET8a8uTh0 4y ago
I will admit that this requirement always confused me. What is there to benefit from by requiring it?
- moontear 4y agoLess spam. A phone number is a much better deterrent against opening a hundred accounts than let’s say an email address.
- rakoo 4y agoIt's the easiest anti-spam measure, because it makes it expensive enough that spammers won't have a million accounts. Fake account detection is effectively put on the back of mobile carriers
- dogecoinbase 4y agoThey trade your privacy for not having to figure out some technical issues. Also, when they rolled out their cryptocurrency payment system (after keeping the server-side source code secret for more than a year, during which Moxie, who is a paid advisor to that same cryptocurrency, denied they were working on a payment system), they got KYC for free.
- MobiusHorizons 4y agoI believe they have covered this question many times before, but I don’t see an answer on signal’s website. From memory, it had to do with not wanting to own the user’s contact list. Using a phone number allowed them to rely on a contact list on the users phone, which is not tied to the signal account. There was more nuance than that though.
- charcircuit 4y agoWhy not just store a contact list of usernames on the phone though?
- dcow 4y agoWhat would this list contain? You don't have a signal username. If you did you'd have to claim it somehow (degenerates to email or phone verification). It's not that simple. Using phone numbers allows signal to plug into the existing state of the world and leverage it to upgrade the security of messaging for everyone who uses it. The one compromise is that it treats phone number as a short identifier (importantly, not cryptographic, it uses real crypto for that). If you don't use phone numbers, your product would look more like Keybase. You have to somehow facilitate key exchange between people in a way that's actually usable. Otherwise all your security benefits go out the window because nobody uses your product. Signal understands this nuance perfectly which is why they're a successful product.
- k1t 4y agoIf I don't use Signal, then I'm not going to keep a list of my friends' Signal usernames on my phone. If I subsequently sign-up for Signal, then I have no way to discover which of them use Signal - short of contacting them via some other method and asking for their Signal username, if any. By making the Signal username the same as the user's phone number, I actually DO have a list of Signal 'usernames' on my phone already. As soon as I sign-up, I can send my list of friends' phone numbers to Signal and they can tell me which of those people have Signal accounts.
- autoexec 4y ago> it had to do with not wanting to own the user’s contact list. Using a phone number allowed them to rely on a contact list on the users phone, which is not tied to the signal account. That doesn't make any sense. Signal did the total opposite. It started keeping sensitive user data in the cloud including your name, your photo, your phone number, and a list of your contacts. It stores that data on their servers permanently.
- _6hmp 4y agoI don't think this is true, do you have a source? They store registered users phone numbers and allow discovery by making a request with a hashed version of the phone numbers on your contact list. They add an extra layer to allow attestation of the software doing this using Intel's secure enclave. They give many examples of responding to warrants with only whether the number has been registered and the timestamp of registration, which they explain is the only information they hold. Private Contact Discovery: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- autoexec 4y agoYour 2017 blog post is outdated. See: https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... and https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057/27 https://community.signalusers.org/t/dont-want-pin-dont-want-... See here for a discussion on how Intel's 'secure' enclave won't save you: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...
- dcow 4y agoThere's a horrible conflation of concepts here. A pretty big one. When people talk about cloud services, they generally mean part of an application that runs on the cloud that participates as a trusted actor in the application's trust model. What people in the linked thread are realizing is that "signal has a server" and they are confused because they thought signal didn't have a server, or something. So, what's important about Signals servers is that, outside of initial key exchange which is verified by two parties out of band, they are not a trusted entity, ever. When you send a message it goes through signals servers. When you sync your profile picture with other devices, same thing. The data transits signals servers. This is made possible because of cryptography. By encrypting the data in a way that is indecipherable by 3rd parties (Signal's servers included) your data is isomorphic to random noise. So, the only thing Signal needs to do is route the random noise to the right place. If it doesn't do that, it's a denial of service and about the only attack you're vulnerable to if you use Signal. Otherwise, the receiver gets the exact random noise that you sent, but only they can make sense of it because of the miracle of cryptography. If you're really doing to throw a fit because Signal syncs a profile picture between your devices using the same level of crypto as is used for messaging then you're honestly crazy. No. Signal did not "not have a cloud" and now they "have a cloud". Not by any reasonable interpretation of the events.
- CodesInChaos 4y agoMaking it more expensive to create spam accounts, I'd guess.
- fooqux 4y agoBesides fighting spam accounts, finding and connecting with others is easier. No more needing to ask somebody what their account name / friend code / ICQ number / whatever UID a system uses to add them to your contacts. It's not a good user experience to type in someone's sometimes insane username. Meanwhile, someone in my contacts that installs Signal automatically sees my name pop up and can start chatting. Far easier, and helps drive adoption.
- Macha 4y agoExcept the reality is that I'm asking for a phone number to add people (well on whatsapp here in europe), and most screen names people chose can be communicated verbally while phone numbers often have people resorting to handing the phone displaying the number around.
- cmeacham98 4y agoThere's no need to make it a requirement for this. Matrix has similar functionality, but doesn't require that you add your phone, just makes it an option.
- konschubert 4y agoWithout it, you wouldn’t be able to see which of your contacts are on signal. And then nobody would use Signal. It’s very unfashionable today, but they decided to not let perfect be the enemy of good.
- panick21_ 4y agoWhile that is nice, I see no reason to require that. Some people just don't care about that feature.
- dcow 4y agoWhat is this future UX you're imagining? How does the future solve the contacts book/short identifiers problem?
- fezfight 4y agoJust like this website. Usernames. Easy peasy.
- dcow 4y agoAnd how do you claim a username?
- deleted 4y ago[deleted]
- aaaaaaaaaaab 4y agoBy knowing the password?
- dcow 4y agoWhere do you put the passwords DB?
- panick21_ 4y ago
- adrr 4y agoUsing the phone number as the identity. You need to verify ownership of the phone number to prove your identity. I guess they could use email as an alternative.
- mbrubeck 4y agoIt means that Signal doesn't need you to create or upload a list of your contacts; it uses the existing contact list from your phone. This also lets you use Signal to replace the default text messaging app on Android, automatically upgrading conversations to be encrypted when possible. This in turn means that just using Signal to communicate with someone becomes a normal, everyday activity, and less of a sign of suspicious activity (from the point of view of law enforcement, etc.).
- fezfight 4y agoI think the problem is that it's a requirement, not a feature you can choose to use. I'd be more inclined to use Signal if I choose to use only a user/pass. Just need a block function.
- dcow 4y agoHow would other people contact you?
- getcrunk 4y agoWith your username?
- dcow 4y agoHow do you text a username?
- Volundr 4y agoBy opening signal, putting in the username and sending a text. Signal only uses MMS as a fallback when communicating with someone not on signal. When both parties are on signal SMS/MMS is not used. Presumably they are OK with not being able to communicate with people not on signal.
- sofixa 4y agoWhy do you need to text? Sending messages without the arcane UX and unreliability of old school SMS or the tries at improving it(RCS) is simply better.
- xorcist 4y agoBeside the technical reasons, tech companies are valued from their access to contact information, and Signal has had huge investments made. This despite the obvious fact that it is highly unlikely that Signal would benefit directly from that data in any way. But much Signal's design is taken from the companies that came before, which did.
- dijonman2 4y agoIt also pushes fraud detection up the pipeline to mobile operators.