4 ms·

Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure. > We use third-pa

Aside from the salaries, which I agree are a problem, I think there are a lot of architectural issues that are both costly and not so secure. > We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. Simple solution, go distributed. 6M $ for that. Stop doing that. What do dictators control? Mobile phone networks and other infrastructure. And, yes, they really do go after people any way they can. This "cost" puts people into danger. Coupling identity and operator infrastructure is a critical privacy flaw. And a costly one too apparently. If your #1 goal is to be the most private solution, this cannot be tolerated to continue to be the case. Get rid of it. Your identity should be your cryptographic key.

8organicbits 3y ago
Have you tried verifying your contacts? It's clunky, but I believe this is how signal handles the problem: https://support.signal.org/hc/en-us/articles/360007060632-What-is-a-safety-number-and-why-do-I-see-that-it-changed-#safety_number_view https://support.signal.org/hc/en-us/articles/360007060632-Wh... Using signal without verifying contacts is like bit like using HTTPS without verifying certificates. It prevents passive monitoring.
- jillesvangurp 3y ago
  Outsourcing identity to operators just moves the problem. And it adds a lot of privacy and security concerns. Besides, other platforms manage just fine without phone number based authentication (which is what this is).
jwestbury 3y ago
> which I agree are a problem Are they? These salaries are much lower than most tech competitors. I know we like to call out "high" salaries when a useful service is struggling - but they'll struggle even more if they can't retain good talent because their pay is too low. There's a reason tech skill in government is generally lower than that in industry, for instance.
- dijkstra_j 3y ago
  I agree, if you lower the salaries now they will probably leave.
- waffleiron 3y ago
  > Are they? These salaries are much lower than most tech competitors. That really depends on the location these people are working from. In most of the world, those are insanely high salaries. A company like this doesn't need to be based in SV.
  - xtracto 3y ago
    I tended to agree with your sentiment. But the reality is that for some unknown reason to me, it's companies from SV the ones that get famous and used globally. Why didn't this start from say Mexico? Or Singapore or Vietnam? Or at least Germany which has a good record of freedom conscious tech scene . My bet is in something related to the "maslow pyramid": people in SV have so much money that have everything solved in their lives, so they have the luxury of spending their time in this sort of problems.
    - johnnyanmac 3y ago
      1. It's a network effect. If you're raised around doctors, go to school with prospective doctors, and your school gets many university recruits from a good doctor college, you will strive to be a doctor more likely than not. SV had a bunch of tech companies and falls into the same kind of environment. 2. It's probably a matter of Venture capitalists. Even if you aren't from SV, you may strive to go there to get funding for a pitch or find talent. Similar to your prospective actor that moves to Hollywood. Go where the crowds are. Now, we can ponder why SV became a tech hub, but current market forces makes it ripe for tech startups.
    - lebed2045 3y ago
      Many messengers companies started outside of SV, • Telegram - Founded: Russia, Headquartered: Dubai, Users: 500M+ • WeChat - Founded: China, Headquartered: Shenzhen, Users: 1.2B+ • LINE - Founded: Japan, Headquartered: Tokyo, Users: 84M (Japan) • Viber - Founded: Israel, Headquartered: Luxembourg, Users: 1B+ • KakaoTalk - Founded: South Korea, Headquartered: Jeju City, Users: 52M+ • Zalo - Founded: Vietnam, Headquartered: Ho Chi Minh City, Users: 100M+ • ICQ - Founded: Israel, Headquartered: Cyprus, used to have big market share • Skype - Founded: Estonia, Headquartered: Luxembourg/USA, Users: 40M daily
ysnp 3y ago
Their #1 goal is not to be the most private solution. Their goal is to make day-to-day communications of most people difficult to surveil. Day-to-day/People is why they keep the registration process familiar to other platforms like WhatsApp/Telegram. "Most" is why they try to compete with Telegram/WhatsApp on features to drive adoption (see Stories and Announcement Groups).
prepend 3y ago
The reason I don’t use signal much is this link to a phone number. Both because sometimes I don’t have a phone number. And I don’t want participants to know my phone number. I don’t get why they have this requirement as it’s not like having a phone number means anything significant. For me, I think privacy includes my ability to not reveal my identity to the network.
- Vinnl 3y ago
  > And I don’t want participants to know my phone number. They're currently in the testing phase of allowing phone numbers not be known by your conversation partners: https://community.signalusers.org/t/public-username-testing-staging-environment/56866 https://community.signalusers.org/t/public-username-testing-...
  - bitvoid 3y ago
    You still need to register with a phone number though. Until that's no longer a requirement, I'm personally not using Signal.
    - daddylongstroke 3y ago
      Interesting take. What is your current secure messenger of choice?
caeril 3y ago
> This "cost" puts people into danger. They know this, but it's likely a precondition of not getting Joe Nacchio'ed. It's a feature, not a bug. Signal's partners* in FVEY IC/LE have given them a lot of latitude in developing a very solid e2e cryptographic protocol and application as long as the users themselves are identifiable. The pigs don't need to backdoor the protocol or the keys as long as there is more than one party to a conversation and each party is identifiable. The prisoner's dilemma, in real life, almost always gives the pigs a defection. My pet conspiracy theory is not that Signal is evil, but that Signal is being allowed to operate by the pigs as long as account identifiers are very difficult to anonymize. They are likely very good people with good intentions, but when the FBI or NSA makes you an offer you can't refuse, you do the best you can. *: I'm not suggesting Signal is in bed with IC. Just that if you operate a communications service of any scale, IC/LE will be your partners whether you want them or not.

8organicbits 3y ago

Have you tried verifying your contacts? It's clunky, but I believe this is how signal handles the problem: https://support.signal.org/hc/en-us/articles/360007060632-What-is-a-safety-number-and-why-do-I-see-that-it-changed-#safety_number_view https://support.signal.org/hc/en-us/articles/360007060632-Wh... Using signal without verifying contacts is like bit like using HTTPS without verifying certificates. It prevents passive monitoring.

jillesvangurp 3y ago
Outsourcing identity to operators just moves the problem. And it adds a lot of privacy and security concerns. Besides, other platforms manage just fine without phone number based authentication (which is what this is).

jwestbury 3y ago

> which I agree are a problem Are they? These salaries are much lower than most tech competitors. I know we like to call out "high" salaries when a useful service is struggling - but they'll struggle even more if they can't retain good talent because their pay is too low. There's a reason tech skill in government is generally lower than that in industry, for instance.

dijkstra_j 3y ago
I agree, if you lower the salaries now they will probably leave.
waffleiron 3y ago
> Are they? These salaries are much lower than most tech competitors. That really depends on the location these people are working from. In most of the world, those are insanely high salaries. A company like this doesn't need to be based in SV.
- xtracto 3y ago
  I tended to agree with your sentiment. But the reality is that for some unknown reason to me, it's companies from SV the ones that get famous and used globally. Why didn't this start from say Mexico? Or Singapore or Vietnam? Or at least Germany which has a good record of freedom conscious tech scene . My bet is in something related to the "maslow pyramid": people in SV have so much money that have everything solved in their lives, so they have the luxury of spending their time in this sort of problems.
  - johnnyanmac 3y ago
    1. It's a network effect. If you're raised around doctors, go to school with prospective doctors, and your school gets many university recruits from a good doctor college, you will strive to be a doctor more likely than not. SV had a bunch of tech companies and falls into the same kind of environment. 2. It's probably a matter of Venture capitalists. Even if you aren't from SV, you may strive to go there to get funding for a pitch or find talent. Similar to your prospective actor that moves to Hollywood. Go where the crowds are. Now, we can ponder why SV became a tech hub, but current market forces makes it ripe for tech startups.
  - lebed2045 3y ago
    Many messengers companies started outside of SV, • Telegram - Founded: Russia, Headquartered: Dubai, Users: 500M+ • WeChat - Founded: China, Headquartered: Shenzhen, Users: 1.2B+ • LINE - Founded: Japan, Headquartered: Tokyo, Users: 84M (Japan) • Viber - Founded: Israel, Headquartered: Luxembourg, Users: 1B+ • KakaoTalk - Founded: South Korea, Headquartered: Jeju City, Users: 52M+ • Zalo - Founded: Vietnam, Headquartered: Ho Chi Minh City, Users: 100M+ • ICQ - Founded: Israel, Headquartered: Cyprus, used to have big market share • Skype - Founded: Estonia, Headquartered: Luxembourg/USA, Users: 40M daily

ysnp 3y ago

Their #1 goal is not to be the most private solution. Their goal is to make day-to-day communications of most people difficult to surveil. Day-to-day/People is why they keep the registration process familiar to other platforms like WhatsApp/Telegram. "Most" is why they try to compete with Telegram/WhatsApp on features to drive adoption (see Stories and Announcement Groups).

prepend 3y ago

The reason I don’t use signal much is this link to a phone number. Both because sometimes I don’t have a phone number. And I don’t want participants to know my phone number. I don’t get why they have this requirement as it’s not like having a phone number means anything significant. For me, I think privacy includes my ability to not reveal my identity to the network.

Vinnl 3y ago
> And I don’t want participants to know my phone number. They're currently in the testing phase of allowing phone numbers not be known by your conversation partners: https://community.signalusers.org/t/public-username-testing-staging-environment/56866 https://community.signalusers.org/t/public-username-testing-...
- bitvoid 3y ago
  You still need to register with a phone number though. Until that's no longer a requirement, I'm personally not using Signal.
  - daddylongstroke 3y ago
    Interesting take. What is your current secure messenger of choice?

caeril 3y ago

> This "cost" puts people into danger. They know this, but it's likely a precondition of not getting Joe Nacchio'ed. It's a feature, not a bug. Signal's partners* in FVEY IC/LE have given them a lot of latitude in developing a very solid e2e cryptographic protocol and application as long as the users themselves are identifiable. The pigs don't need to backdoor the protocol or the keys as long as there is more than one party to a conversation and each party is identifiable. The prisoner's dilemma, in real life, almost always gives the pigs a defection. My pet conspiracy theory is not that Signal is evil, but that Signal is being allowed to operate by the pigs as long as account identifiers are very difficult to anonymize. They are likely very good people with good intentions, but when the FBI or NSA makes you an offer you can't refuse, you do the best you can. *: I'm not suggesting Signal is in bed with IC. Just that if you operate a communications service of any scale, IC/LE will be your partners whether you want them or not.