8 ms·
Whatever the security of Signal is, all my trust into any service ends when it requires from me personally identifiable information, which could be easely repla
by stiray 4y ago
Whatever the security of Signal is, all my trust into any service ends when it requires from me personally identifiable information, which could be easely replaced by other methods (I am system software developer for ~31 years, don't even try to feed me with bs).
And as such, Signal/Telegram/Whatever that requires me to enter phone number, has zero trust from me. I don't care who analyzed the protocols security, what the safety measures are, what cipher algorithms you use, how many hackers tried to break in and failed, what other PR/SEO methods you use.
Just the fact, that you require information that is so deeply PII as phone number is a reason that overrides everything else. From my standpoint, software that requires that, is honeypot.
(btw, this is my personal opinion, you don't have to agree - I can (from any device, without giving any PII, now or 20 years in past) login into IRC network (vpn/... is outside this topic) and use asymmetric cryptography (with exchanging public key safely by some other method, stenography anyone?) to chat completely secure. I can send email (with exchanging public key safely by some other method, stenography anyone?) and communicate completely secure. I can use Counterstrike chat on random server to do the same. So what does the Signal does for me in terms of safety of exchanged information? Show me a nicer UI so I can use graphic smileys?)
- malikNF 4y agoThe argument I hear in favour of this practice by messaging apps is that, this design helps your friends find you easily by your number. But I agree with you, asking for the phone number and telling me this app is secure is ridiculous. Let me register with something less intrusive, if I want to go the phone number way, then let me use that. Give me an option.
- palata 4y agoNot ridiculous at all, depends on your threat model. It's perfect for me.
- malikNF 4y agoSo why do we need e2e encrypted messaging? Why do we worry about the "secure" part of messaging? One of the main reasons for me is, it's hard to trust a centralized authority. Can you trust your information stored at your messaging app's servers stay secure forever? Can you trust that company to never get compromised? So yeh, they go through all the hassle of making things "secure" but attach everything to something(phone number) most of us can't get without revealing our actual details. So yeh, its ridiculous to go through all this hassle to make things private and secure, but force people to use something that de-anonymizes everything about them.
- palata 4y agoI don't want them to have access to my messages and make a profile out of me, even less of billions of people. That's why I also care about metadata: social graph is valuable for profiling. I don't write anything that would be interesting to the NSA, I'm not a target for them, so I don't care if they see I use Signal. BTW, say you have an anonymous Telegram username, I'm pretty sure it's trivial to find your name from the content of your messages. Or just from the metadata.
- 8organicbits 4y agoIs there another technique for effortlessly bootstrapping a contact list? Finding someone requires some kind of lookup/search. Using PII makes a lot of sense because that's how people identify each other. Anything out-of-band is quite complex. If I told my mom to install some app and we'd connect to each other using some random IDs, we'd probably still be using SMS.
- andai 4y agoA Signal support claims "The Signal service does not have any knowledge of your contacts." Can someone explain how this is possible? How does my phone know when to notify me that a friend has joined signal? Edit: apparently it's "private contact discovery", I need to give this a proper read later. https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- palata 4y agoYes, their blog posts are really good. Read about the sealed sender, too! And then realise that even with sealed sender, if you send from your home IP, then you are identifiable. So you should send from a reasonably anonymous IP (w.r.t. your threat model)
- andai 4y ago>If I told my mom to install some app and we'd connect to each other using some random IDs, we'd probably still be using SMS This is surprising to me, since it was my mother's generation that got me into Skype (where you have to manually add the other person by their username), almost twenty years ago. (Even worse, not long before that you had to manually punch the other person's "ID" into the device every time you wanted to talk to them!)
- brandonr49 4y agoI will never get over the fact that the Nintendo Switch operated on random character strings to find friends rather than usernames or something more straightforward for normal users. But the fact that they managed it does mean it's not so large a barrier.
- uoaei 4y agoRepeat after me: Security and privacy are not the same thing. Among many other differences: security is a binary (can an attacker gain access to information) but privacy is a spectrum (what kinds of information do I want to leak).
- dane-pgp 4y ago> security is a binary (can an attacker gain access to information) Only if you're looking through a very narrow lens. There are a range of potential attackers out there with different motivations and resources available to them. The question you have to ask (for each attacker) is whether the value of the thing you are trying to secure is worth more to them than the cost it would take them to break your security. In aggregate, that looks a lot like a spectrum of security, with different people being secure against more or fewer different attackers.
- uoaei 4y ago"The thing" you are trying to secure is either secure or it is not. That is what I meant by "binary".
- dane-pgp 4y ago"The thing" you are trying to keep private is either private or it is not, too. Maybe you're saying that some information is more sensitive than others, which is true, but some security failures are worse than others (e.g. denial of service vs. remote code execution, or ability to forge messages vs. ability to decrypt messages).
- mistrial9 4y agosoftware dev with thirty years experience says: the modern push to make phones into de-facto PII is bluntly obvious. There are historical reasons that this is dangerous in itself, yet USA and others have profited mightily when successfully implementing systems like this. Awake.
- deleted 4y ago[deleted]
- greenail 4y ago+1: the globally unique identifier that is reused across multiple accounts is an antipattern in my opinion. This is just as bad as reusing passwords. There should be no need for anyone to have to reuse email user id's or phone numbers or credit card numbers. These should be unique per online "relationship", the way your CC chip creates per transaction identifiers. The fake account problem needs to be solved in another way. You simply can't take these GUIDs back once they are leaked and that leaves your only choice to burn them or just accept the risks of having that data leaked all over the net.
- joshuamorton 4y agoYour cc has a per transaction password, but still a unique identifier. Signal works surprisingly similarly.
- NikolaNovak 4y agoI come from point of ignorance and agree with you. I do not understand what privacy security or anonymity I can have, when we start with sharing my most identifiable personal information with the app and all my desired contacts. (whatsapp takes it further by refusing to work without full access to your contacts which... Just, no). I feel I'm in a twilight zone as everybody cheerful regresses to apps you have to bootstrap with your phone number and then proceed to basically only work well with your phone - teeny tiny screen with awful keyboard, instead of allowing me seamless access across my communication devices and preferences. Messaging seemed like a solved problem until we made it inexplicably and massively worse.
- JumpCrisscross 4y ago> whatsapp takes it further by refusing to work without full access to your contacts I’ve never given WhatsApp access to my contacts. Works fine. Just don’t get numbers matched to contacts, which makes sense.
- NikolaNovak 4y agoInteresting. Can you initiate a message? I can only talk to people if they've granted access to their contact list, and initiate conversation with me (which is not a solution, just a shifting of problem to others). On android at least, I cannot initiate a conversation with somebody I don't have a going chat with. It won't let me just type in a phone number. Specifically, Clicking "new chat" asks me for contacts permission, and if I say no it simply closes. I have to contact a person out of band and ask them to initiate whatsapp with me. By no definition is my experience "just fine". Is this not your experience? Can two people who have not granted access, converse?
- hso1 4y agoYou can open wa.me/<number> on a browser, it'll redirect to a chat on whatsapp.
- 4y ago
- sliken 4y ago"easily replaced by other methods" ... like what? How would this other method make it hard/expensive/infeasible for a malicious company to produce 100M accounts to cause problems with spamming, DoS, and related issues? Phone numbers are finite, cheap, but not zero cost. If sending a spam email cost $0.01 much of spam would disappear. How would this other method protect a user's social network without having to upload that meta data in signal? Currently this is handled by a user's address book hosted outside of signal. How many users would you lose if you required some key exchange in person? Sure it's easy to think about generating a key pair, uploading the public key to a DHT, and allow people to communicate directly without a central server. However that has a fair number of practical issues that would be worse for the average signal user, not the least of which would be much worse battery life and bandwidth charges.
- vorpalhex 4y agoLet me pay $5 to get a private handle.
- joshuamorton 4y agoHow do you pay them without revealing your identity?
- sliken 4y agoSounds good, and it could help fund signal without getting advertisers involved. So you pay $5 on a credit card, which connects you to said handle, much like buying a SIM. How is that any better? Someone in your social network joins signal next week, how would they find you?
- gray_charger 4y agoI think you may be misinterpreting the use case for Signal. Signal is not meant to be used for anonymous communication, it's meant for secure communication. Signal's threat model is meant to solve issues with SMS: a MitM can tell a message was sent but not the contents of the message. If you were to replace the phone number with a username of some sort it would be a little more anonymous, but could be easily doxed from users' poor OpSec or poor OpSec of a users' peers. Given Signal is meant to be used by people who don't know what OpSec is, it doesn't seem worth the effort to put up trivial anonymity barriers.
- stiray 4y agoSorry but anonymity is security. Once you know who to beat, you will get the keys. Wanna bet? We can do an experiment... ;) /s (anyone down-voting this post - you don't agree? You are welcome to join the experiment too. Why don't you put your livers where your mouth(fingers) are? I know for myself that immediately when you would show me rubber hose (not even coming to wrench!!!) I would tell you whatever you want to know. But you can obviously do it better, so lets test it. I have a nice, 1kg french wrench waiting for your beliefs (and knees). Yeah, I know I am not politically correct, but facts are facts and you deny them for unknown reason. /s)
- asah 4y agoobligatory xkcd: https://xkcd.com/538/ https://xkcd.com/538/
- godelski 4y ago> Sorry but anonymity is security. I'm actually with you here. But anonymity is HARD. Way harder than people give credit. We're not anonymous here on HN. But Signal is doing this step by step and I think that is the right way. Yes, the wrench attack works, but it doesn't always work. It would be better if it was hard to use the wrench attack, but protecting against it is surprisingly difficult. Signal seems to be taking this into account and also working on this in steps.
- 4y ago
- MichaelCollins 4y agoI agree. Furthermore it's extremely distasteful that Signal alerts people in your address book when you install Signal
- sliken 4y agoHow else are people supposed to know that they could send a secure signal message instead of an insecure SMS. I guess people could call this a growth hack, but without this kind of thing it's likely the number of signal users would be 10-100x smaller and the network effect would mean it's near useless for most. Just imagine someone installing signal, not seeing anyone they can chat, and never using it again.
- MichaelCollins 4y ago> How else are people supposed to know that they could send a secure signal message instead of an insecure SMS. They should know only if I ask them to. I don't want to share this sort of information to everybody in my contact list by default. If I think somebody needs to know, I would tell them. If I don't think they need to know, then they shouldn't be told. Anyway, the consequence of Signal being this way is that I refuse to install Signal at all, and don't recommend it to any of my friends or family. Instead I tell them that everything on phones is insecure and they should never believe or behave otherwise.
- Digit-Al 4y agoCan I ask you a question? I ask this in good faith, as a matter of curiosity, and am not being critical in any way. If you do not want someone to message you, why have you given them your number? My assumption would be that if you trust someone enough to give them your number then it shouldn't matter if they know that there is another app that they can use to message you through. Of course this is only my assumption and I am just curious as to your reason why you would not want some particular person to know that they can message you through Signal rather than some other, less secure, app.
- onetimeusename 4y agoI really dislike that about the app too. In fairness, I think the goal was to replace Apple Message and SMS which require a phone number but it is also self defeating in a sense because it breaks the privacy and plausible deniability Signal is supposed to offer by tying an app instance to a particular piece of hardware. Almost every communication app requires a phone number now. The claim is that this limits spam which is probably true but I suspect there is tremendous value in having real phone numbers and the ability to do pervasive tracking. We know mobile phone providers sell data on phones. The best that can be said about the Signal org is they are non profit but this is not very reassuring especially given the threat model of people who might be using Signal.
- palata 4y agoHalf of the world phone numbers have leaked already (including with a Facebook leak a few years ago). But that's not what's valuable. What's valuable is the social graph: who are your contacts, and who are you writing to. Signal works very hard to not know any of that. And it does it better than the alternatives I know.
- zikduruqe 4y ago> I can send email... and communicate completely secure. But what about PII? Goes against your Signal argument. Signal needs a phone number, not necessarily yours.
- godelski 4y ago1) Signal uses phone numbers to generate your social graph. They don't know it. 2) Usernames are pretty close. In fact, you can build the beta and use them now. [0] So your worries will be over soon. I really think you're exaggerating the simplicity of replacing the identifier in a way that is not personally identifiable. I mean my name here is only semi-anonymous but it would be a grave mistake to think one couldn't figure out who I am fairly easily. 3) What alternatives do you have? Yeah there are some that don't require this but also haven't had as extensive of audits, open sourced code, or the proof of time. Personally it does matter who analyzed protocols, safety measures, ciphers, etc because I can recognize that I'm not an expert in everything AND even if I was that dual verification is better than singular. With something as important as this, N-verification is important. IMO. [0] https://community.signalusers.org/t/usernames-in-signal/9157/642 https://community.signalusers.org/t/usernames-in-signal/9157...
- dogman144 4y agoI get what you’re getting at but I would first like to know how you’re keeping your phone number totally anon prior to agreeing or disagreeing with you. In my eval, phone numbers are barely PII, starting with when ISPs and carriers started selling mobile data 2 decades ago. So, my phone number is very much out there now. No issues using it for secure comms IMO. If you want truly anon comms, I’m not using signal, but that’s not what signal does anyway.
- babypuncher 4y agoThe Signal protocol does not require a phone number or any other PII. This is what has been "proven secure". The Signal app is a messaging platform built on this protocol by the same developers. That is what requires a phone number. Anyone can build their own messenger using the Signal protocol and use whatever means of authentication they want. I think there is also a useful distinction between "anonymity" and "privacy". The protocol is capable of facilitating both. The Signal app itself primarily focused on just the latter. Signal knows who you are, at least in so far as they know a hash of your phone number. You are not totally anonymous to them. But they do not know what you are saying. Your interactions on their platform are private.
- account-5 4y agoCan you not just use a burner number?
- Semaphor 4y agoNot possible everywhere, for example in Germany, you essentially have to do follow normal KYC protocols to get a number.
- maram 4y ago>>From my standpoint, software that requires that, is honeypot. I couldn’t agree more. In August this story was trending here using basic 101 growth hacking tactics https://news.ycombinator.com/item?id=28340542 https://news.ycombinator.com/item?id=28340542 Trace the source. The account got deleted from Reddit.
- JustSomeNobody 4y ago> (I am system software developer for ~31 years, don't even try to feed me with bs) Whoa now ol' timer! j/k. I like signal because it make switching people away from other platforms easier. It is not anonymous, but it is secure (until proven otherwise). I'll take the latter if I cannot have both. That being said, they have room to improve. I dislike the work-around I have to do to use two separate phones and keep a single conversation going.
- dennis_jeeves1 4y agoWhat you say appears to be true (to the security amateur in me). What app would you suggest for voice chat that is overall more "secure" than Signal?
- bozhark 4y agoisn't one, publicly. make one?
- leric 4y ago