3 ms·

>That doesn't make any sense. Signal did the total opposite. It started keeping sensitive user data in the cloud including your name, your photo, your phone num

>That doesn't make any sense. Signal did the total opposite. It started keeping sensitive user data in the cloud including your name, your photo, your phone number, and a list of your contacts. It stores that data on their servers permanently. This is the first I've heard of that. And if it's true, it's a big problem. Is there any documentation of this behavior that you can direct me to?

autoexec 4y ago
You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service. https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/5 https://community.signalusers.org/t/what-contact-info-does-t... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...
- nobody9999 4y ago
  >You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service. Edit: This bit is apparently not the case. And more's the pity. ====Section affected by edit========= I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about. ==== End section affected by edit========= Which isn't a new change (IIUC, PIN disablement was introduced ~2 years ago). I'd say that using the PIN functionality should be opt-in rather than opt-out, so in that respect I agree. Further, Signal should probably update their policy documents to reflect the current state of affairs. But I stand by my previous comment[1]. [0] https://support.signal.org/hc/en-us/articles/360007059792#pin_disable https://support.signal.org/hc/en-us/articles/360007059792#pi... [1] https://news.ycombinator.com/item?id=32474579 https://news.ycombinator.com/item?id=32474579
  - autoexec 4y ago
    > I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about. This is also incorrect. If you opt out of setting a pin, Signal creates a pin for you and uses that to encrypt the data it uploads to their servers. Again, not your fault. Signal has gone out of their way to avoid answering direct questions about this in a plain way. See: https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

autoexec 4y ago

You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service. https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/5 https://community.signalusers.org/t/what-contact-info-does-t... https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...

nobody9999 4y ago
>You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service. Edit: This bit is apparently not the case. And more's the pity. ====Section affected by edit========= I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about. ==== End section affected by edit========= Which isn't a new change (IIUC, PIN disablement was introduced ~2 years ago). I'd say that using the PIN functionality should be opt-in rather than opt-out, so in that respect I agree. Further, Signal should probably update their policy documents to reflect the current state of affairs. But I stand by my previous comment[1]. [0] https://support.signal.org/hc/en-us/articles/360007059792#pin_disable https://support.signal.org/hc/en-us/articles/360007059792#pi... [1] https://news.ycombinator.com/item?id=32474579 https://news.ycombinator.com/item?id=32474579
- autoexec 4y ago
  > I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about. This is also incorrect. If you opt out of setting a pin, Signal creates a pin for you and uses that to encrypt the data it uploads to their servers. Again, not your fault. Signal has gone out of their way to avoid answering direct questions about this in a plain way. See: https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...