4 ms·

No mention of criticism for requiring use of phone numbers as identifiers. Falsely claims phone numbers are not linked to usernames.

deleted 3y ago
[deleted]
j_crick 3y ago
Yeah, any discussion of anonymity and Signal can start and end with phone numbers. They could maybe offer an option to use just a username and some kind of authentication? But somehow they don’t :(
- asynchronous 3y ago
  So many are missing the point here- Signal is *private*, not anonymous. They are two different things.
  - autoexec 3y ago
    We'd hope it's that, but the data collection isn't a good sign that it's private either.
nathanaldensr 3y ago
That has always bugged me about Signal. It seems like such an obvious hole--one that other services like Telegram and Wickr don't suffer from. I think Signal implies that you always know and are comfortable with the person on the other side of the message, but that is not always the case.
- zen_1 3y ago
  Telegram also requires phone number signups
  - pepa65 3y ago
    I think you can sign up without a phone number.
canjobear 3y ago
I've been hearing that that feature will be added soon since 2014.
harry8 3y ago
No mention in your criticism above that bringing genuine e2e encryption to the masses in a way that is actually used by billions of people had not been achieved and many thought was totally impossible until Moxie went and did it. Once you acknowledge that incredible achievement that nobody else got close to previously, you can then criticise anything you think could have been done better. Or could be improved in the future. I know when I do it I'm doing something similar to criticising Kareem Abdul-Jabbar's execution of his skyhook and that is a reasonable thing to acknowledge, even when I'm 100% sure that my criticism is legitimate.
autoexec 3y ago
Worse, they store your phone number (along with your name, your photo, and most damning of all, a list of all of your signal contacts) permanently in the cloud. This is exactly the information they used to brag about not being able to turn over to the authorities because they didn't collect it in the first place. Their website still has pages that brag about that with no indication that it's no longer the truth. I've seen way too many signal users who had no idea this data collection was even happening which is a good sign that Signal isn't very trustworthy. If you're going to promote yourself to whistleblowers and activists, they need to know what data you're collecting and what their risks are, but ever since Signal started collecting all this data they've refused to update their privacy policy which even now starts with "Signal is designed to never collect or store any sensitive information." which is an outright lie. I'm pretty sure at this point it's a dead canary warning people not to trust the service. They've been very unclear in their communications about the data collection too. They've removed features people loved (the ability to get secure communications and unsecured SMS/MMS in a single app) and they've pushed weird crypto features nobody asked for, which might be another sign they're trying to encourage users to leave the platform, but I sure see them come up a lot in the news. Signal seems to get a lot of promotion. At this point though, people looking for secure communication might want to look for something else. For more info see: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...
- edrxty 3y ago
  Signal is very much a first generation private messaging application (in the sense that it was the first generation actually adopted). I think we're starting to see true gen 2 protocols rise to fix some of the issues it has like matrix, berty, briar, etc.
  - blitzar 3y ago
wolverine876 3y ago
Perhaps it doesn't have to be mentioned in every article, even though people feel it needs to be mentioned in every HN discussion.
coldblues 3y ago
Whenever this is mentioned, the answer is always the ease of adoption. Less tech literate people can just use their phone number and they won't have to bother themselves with anything else.

deleted 3y ago

[deleted]

j_crick 3y ago

Yeah, any discussion of anonymity and Signal can start and end with phone numbers. They could maybe offer an option to use just a username and some kind of authentication? But somehow they don’t :(

asynchronous 3y ago
So many are missing the point here- Signal is *private*, not anonymous. They are two different things.
- autoexec 3y ago
  We'd hope it's that, but the data collection isn't a good sign that it's private either.

nathanaldensr 3y ago

That has always bugged me about Signal. It seems like such an obvious hole--one that other services like Telegram and Wickr don't suffer from. I think Signal implies that you always know and are comfortable with the person on the other side of the message, but that is not always the case.

zen_1 3y ago
Telegram also requires phone number signups
- pepa65 3y ago
  I think you can sign up without a phone number.

canjobear 3y ago

I've been hearing that that feature will be added soon since 2014.

harry8 3y ago

No mention in your criticism above that bringing genuine e2e encryption to the masses in a way that is actually used by billions of people had not been achieved and many thought was totally impossible until Moxie went and did it. Once you acknowledge that incredible achievement that nobody else got close to previously, you can then criticise anything you think could have been done better. Or could be improved in the future. I know when I do it I'm doing something similar to criticising Kareem Abdul-Jabbar's execution of his skyhook and that is a reasonable thing to acknowledge, even when I'm 100% sure that my criticism is legitimate.

autoexec 3y ago

Worse, they store your phone number (along with your name, your photo, and most damning of all, a list of all of your signal contacts) permanently in the cloud. This is exactly the information they used to brag about not being able to turn over to the authorities because they didn't collect it in the first place. Their website still has pages that brag about that with no indication that it's no longer the truth. I've seen way too many signal users who had no idea this data collection was even happening which is a good sign that Signal isn't very trustworthy. If you're going to promote yourself to whistleblowers and activists, they need to know what data you're collecting and what their risks are, but ever since Signal started collecting all this data they've refused to update their privacy policy which even now starts with "Signal is designed to never collect or store any sensitive information." which is an outright lie. I'm pretty sure at this point it's a dead canary warning people not to trust the service. They've been very unclear in their communications about the data collection too. They've removed features people loved (the ability to get secure communications and unsecured SMS/MMS in a single app) and they've pushed weird crypto features nobody asked for, which might be another sign they're trying to encourage users to leave the platform, but I sure see them come up a lot in the news. Signal seems to get a lot of promotion. At this point though, people looking for secure communication might want to look for something else. For more info see: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

edrxty 3y ago
Signal is very much a first generation private messaging application (in the sense that it was the first generation actually adopted). I think we're starting to see true gen 2 protocols rise to fix some of the issues it has like matrix, berty, briar, etc.
- blitzar 3y ago

wolverine876 3y ago

Perhaps it doesn't have to be mentioned in every article, even though people feel it needs to be mentioned in every HN discussion.

coldblues 3y ago

Whenever this is mentioned, the answer is always the ease of adoption. Less tech literate people can just use their phone number and they won't have to bother themselves with anything else.