4 ms·
Not really. Anonymity is simple. You don't require PII for registration. As simple as that. What is hard are their other use cases. Preventing rotten eggs ente
by stiray 4y ago
Not really. Anonymity is simple. You don't require PII for registration. As simple as that.
What is hard are their other use cases. Preventing rotten eggs entering the system. And they cut shortcut here, sacrificing security of their users to keep the bills down. The phone number requirement is not there to protect you but to protect their ecosystem and even more their resources (if I take it as lightly as possible, check the last line).
Again I will use IRC as an example, it was able to connect so many people without requiring PII, yes there was spam (same as with emails, I host my own mail server and I dont see spam, it is 100% filtered out by rspamd), for what, 30 years(?), they can do it too. I don't see any excuse for their requirement.
But ok, lets be fair - easy to connect. I have around 400 phone numbers in my phone of people I asked for their phone number - they were relevant to me at some point, for instance primary school schoolmates. How many, do you think I communicate with? I went to count history for last year - 35 numbers. 35! Out of those, I would communicate over secure channel with 6 (current company). And now this is an issue?
Let me say it again, with all the facts, I can only take them as a honeypot.
- godelski 4y agoHonestly you seem to just want to hate Signal. That's okay to dislike something but calling Signal a honeypot is a strong statement. That requires strong evidence, not weak conjecture. It is hard to respond to you in good faith because it does not feel like you want to engage that way. Maybe I am misunderstanding your statement. So I will engage in good faith once more (reminding you that this is a HN rule). Anonymity is nowhere near as simple as not requiring PII during registration. Even from the provider side. We can agree that it is difficult to maintain anonymity from the user side. But choices made by the provider can make these things impossible. Let's suppose Signal gives me one username that I can use and I must use that continuously. What do I choose? If I use "godelski" then I've made a permanent connection between that identity and my real life identity. After all, I do talk to friends, family, and coworkers on Siganl. If I choose another name and share that name through this name, then those two are linked together. All of this is information leakage and highly valuable to OSINT people. I'm sure someone here has significantly more experience than me and would be happy to expand upon this too. But it is extremely naive to believe/claim that anonymity is provided simply by removing the phone number. It is far more complicated than that. Hopefully you now know that.
- stiray 4y ago
- bboygravity 4y agoThere's quite a few other hints in the marketing and decisions at Signal that reek a little bit of honeypot (by the NSA). Super hard to prove though... For me personally the strongest hints are the fact that it's centralized, there's no getting around connecting to their server(s) for the app/clients to be useful and that it's impossible to know what exactly their server is running (by design?). Oh, and Signal is based in the US. That fact by itself pretty much means all bets are off when it comes to security or anonimity. I don't see how the NSA would not be pwning that server or owning/creating that server and/or organization (indirectly or directly). Or to put it differently: why would it be hard or illogical for the NSA to setup an innocent seeming "good guys" radiating non-profit chat service that is supposedly secure (yet centralized and non-anonymous by design and also a honeypot)?
- tptacek 4y agoPlease don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=author%3Adang%20%22owe%20this%20community%22&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- dementiapatent 4y agoI always took that rule as "don't post insinuations (accusing other HN users of being) astroturfing, shilling, bots, foreign agents...". Can we not point out when corporate entities are comprised of these things?
- tptacek 4y ago
- easrng 4y agoI'm pretty sure I've had to register my email with nickserv to join an IRC channel before.