7 ms·

Signal v7.0.0 with phone number privacy

107 points by p4bl0 3y ago

p4bl0 3y ago
It seems there's nothing on Signal's blog as of yet, but the project's git repository was tagged with v7.0.0 yesterday and we can see from the commit history since the previously tagged version (v6.74.4) that there will be a setting to hide one's phone number [1], as well as disabling the previous default behavior of advertising that one is on Signal to all of their contacts already using it [2]. [1] https://github.com/signalapp/Signal-Android/commit/8797236b5a9e7252d3aae8cfb6d91bb87e2c266b https://github.com/signalapp/Signal-Android/commit/8797236b5... (PNP stands for "Phone Number Privacy") [2] https://github.com/signalapp/Signal-Android/commit/6097e6c30593c36091e9c4823c68cddbe4fb9b25 https://github.com/signalapp/Signal-Android/commit/6097e6c30...
fsflover 3y ago
When will I be able to use my GNU/Linux phone without buying another phone from the duopoly? My phone is considered "desktop" by Signal, and it doesn't work without connecting to a "real" phone.
- deleted 3y ago
  [deleted]
- notso411 3y ago
  [dead]
- anon-sre-srm 3y ago
  Wrong forum for this question. I wanted universal chat, file transfer, and clipboard sharing across the big 3 desktop and big 2 mobile OSes without being tied to a universal, privacy-invading, primary key like a phone number. Using phone numbers for signup is only a couple degrees from using social security numbers for customer accounts in the 90's. Captchas and account expiry are some of the proper forms of abuse prevention that don't leap straight to privacy invasion with a not truly portable or anonymous unique identifier.
  - fsflover 3y ago
    https://news.ycombinator.com/item?id=39414077 https://news.ycombinator.com/item?id=39414077
wkat4242 3y ago
It's good enough when I don't need a number to sign up at all. Unfortunately they're not there yet. So for now.. meh Without that it's just a slightly more private WhatsApp. In fact I wish we could move to another kind of identifier than a "phone number" for things like this. It's probably pretty region-dependent but personally I never use my phone to actually make phone calls or text. All my voice, video and messaging traffic to friends goes through apps, though the number is unfortunately still used as an identifier. Unfortunately, because if I let a number lapse I lose access to the whatsapp and telegram accounts related to it. This way it makes it hard having multiple accounts. I'd prefer if mobile providers would just become a dumb data pipe the same as landline providers have already become. My Spanish provider still forces me to take a "landline" with my internet but I don't even have a phone connected to it.
- fsflover 3y ago
  I solved this problem (and more) by switching to Matrix.
  - tptacek 3y ago
    Records of precisely who you talk to are being kept serverside because of that decision. Maybe that's totally fine for you! Most people have pretty unserious secure messaging threat models (I don't mean that as a value judgement).
    - greyface- 3y ago
      The same is likely true of Signal, no? Traffic analysis on AWS' edge would tell you precisely who is talking to who, and user identities are tied to legal identities via phone numbers. Maybe Signal doesn't store this data serverside, but there are entities with both the capability and motivation to obtain it. I bet there are Signal XKEYSCORE selectors.
      - tptacek 3y ago
        No, it's not. Traffic analysis is potent, but it is not a literal SQL database of who has talked to who when.
jwr 3y ago
Will we get an ability to backup on iOS? Most people don't even realize that if their phone dies today, all of their Signal chat history (photos, etc) are gone.
- whitepoplar 3y ago
  Please, we need this.
  - medstrom 3y ago
    Used to be a feature. It got removed.
    - privacyking 3y ago
      Do you remember why?
- Karellen 3y ago
  Heh. I have the opposite problem. I'd like a way to have Signal auto-delete conversations and media from my device after a certain amount of time. Yes, there are auto-delete options, but those apply to the group/chat as a whole, and other people in some of the groups I belong to want to keep their chat history. I'm not totally opposed to them doing so, but would like the option to just delete my copies. (Signal uses more space on my iPhone than all my other apps combined, and I've had problems with upgrades being blocked because there wasn't enough space remaining to install them. Manually deleting hundreds of photos from individual groups to make room is such a pain in the ass.)
  - px43 3y ago
    Large group chats should have an expiry of one week or so, maybe 4 weeks at the longest, otherwise it gets crazy. Unfortunately the best way to delete those old messages in your local chat is to delete the conversation and rejoin it. Admins really should have a "purge all history older than X" option. They let you do it one by one manually, but it's basically impossible to automate, and doing it manually is super tedious.
garciansmith 3y ago
N.b. this version is a recent beta. See https://community.signalusers.org/t/beta-feedback-for-the-upcoming-android-7-0-release/58941 https://community.signalusers.org/t/beta-feedback-for-the-up...
ByQuyzzy 3y ago
[flagged]
- dang 3y ago
  Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
chislobog 3y ago
I started getting “unknown” message requests on three unrelated phone numbers through my different signal accounts on Jan 24 2024. The contact info doesn't have a phone number, crypto scams. I guess this is the result of the beta. See screenshot please. https://ibb.co/F014n88 https://ibb.co/F014n88
- woofcat 3y ago
  The beta environment is completely distinct from the prod one. So unless you're on the beta servers they're not related.
  - chislobog 3y ago
    Even more curious about these numberless messages then.
    - NewJazz 3y ago
      I also got one in December and another January. Crypto scams. No number displayed.
colordrops 3y ago
Sounds like moving the goal posts. So they just gave up in allowing registrations without a phone number? Perhaps pressure from three letter agencies.
- 3np 3y ago
  Have they ever announced that allowing registrations without a phone number is something they intend to do?
anon-sre-srm 3y ago
Or use a fork like Session, despite its (unsustainable?) crypto business model. Reliance on phone numbers creating trackable metadata was a critical and avoidable footgun resulting from copying WhatsApp too closely without leaning into privacy first.
glub103011 3y ago
[dead]

107 points by p4bl0 3y ago

It seems there's nothing on Signal's blog as of yet, but the project's git repository was tagged with v7.0.0 yesterday and we can see from the commit history since the previously tagged version (v6.74.4) that there will be a setting to hide one's phone number [1], as well as disabling the previous default behavior of advertising that one is on Signal to all of their contacts already using it [2]. [1] https://github.com/signalapp/Signal-Android/commit/8797236b5a9e7252d3aae8cfb6d91bb87e2c266b https://github.com/signalapp/Signal-Android/commit/8797236b5... (PNP stands for "Phone Number Privacy") [2] https://github.com/signalapp/Signal-Android/commit/6097e6c30593c36091e9c4823c68cddbe4fb9b25 https://github.com/signalapp/Signal-Android/commit/6097e6c30...

fsflover 3y ago

When will I be able to use my GNU/Linux phone without buying another phone from the duopoly? My phone is considered "desktop" by Signal, and it doesn't work without connecting to a "real" phone.

deleted 3y ago
[deleted]
notso411 3y ago
[dead]
anon-sre-srm 3y ago
Wrong forum for this question. I wanted universal chat, file transfer, and clipboard sharing across the big 3 desktop and big 2 mobile OSes without being tied to a universal, privacy-invading, primary key like a phone number. Using phone numbers for signup is only a couple degrees from using social security numbers for customer accounts in the 90's. Captchas and account expiry are some of the proper forms of abuse prevention that don't leap straight to privacy invasion with a not truly portable or anonymous unique identifier.
- fsflover 3y ago
  https://news.ycombinator.com/item?id=39414077 https://news.ycombinator.com/item?id=39414077

wkat4242 3y ago

It's good enough when I don't need a number to sign up at all. Unfortunately they're not there yet. So for now.. meh Without that it's just a slightly more private WhatsApp. In fact I wish we could move to another kind of identifier than a "phone number" for things like this. It's probably pretty region-dependent but personally I never use my phone to actually make phone calls or text. All my voice, video and messaging traffic to friends goes through apps, though the number is unfortunately still used as an identifier. Unfortunately, because if I let a number lapse I lose access to the whatsapp and telegram accounts related to it. This way it makes it hard having multiple accounts. I'd prefer if mobile providers would just become a dumb data pipe the same as landline providers have already become. My Spanish provider still forces me to take a "landline" with my internet but I don't even have a phone connected to it.

fsflover 3y ago
I solved this problem (and more) by switching to Matrix.
- tptacek 3y ago
  Records of precisely who you talk to are being kept serverside because of that decision. Maybe that's totally fine for you! Most people have pretty unserious secure messaging threat models (I don't mean that as a value judgement).
  - greyface- 3y ago
    The same is likely true of Signal, no? Traffic analysis on AWS' edge would tell you precisely who is talking to who, and user identities are tied to legal identities via phone numbers. Maybe Signal doesn't store this data serverside, but there are entities with both the capability and motivation to obtain it. I bet there are Signal XKEYSCORE selectors.
    - tptacek 3y ago
      No, it's not. Traffic analysis is potent, but it is not a literal SQL database of who has talked to who when.

jwr 3y ago

Will we get an ability to backup on iOS? Most people don't even realize that if their phone dies today, all of their Signal chat history (photos, etc) are gone.

whitepoplar 3y ago
Please, we need this.
- medstrom 3y ago
  Used to be a feature. It got removed.
  - privacyking 3y ago
    Do you remember why?
Karellen 3y ago
Heh. I have the opposite problem. I'd like a way to have Signal auto-delete conversations and media from my device after a certain amount of time. Yes, there are auto-delete options, but those apply to the group/chat as a whole, and other people in some of the groups I belong to want to keep their chat history. I'm not totally opposed to them doing so, but would like the option to just delete my copies. (Signal uses more space on my iPhone than all my other apps combined, and I've had problems with upgrades being blocked because there wasn't enough space remaining to install them. Manually deleting hundreds of photos from individual groups to make room is such a pain in the ass.)
- px43 3y ago
  Large group chats should have an expiry of one week or so, maybe 4 weeks at the longest, otherwise it gets crazy. Unfortunately the best way to delete those old messages in your local chat is to delete the conversation and rejoin it. Admins really should have a "purge all history older than X" option. They let you do it one by one manually, but it's basically impossible to automate, and doing it manually is super tedious.

garciansmith 3y ago

N.b. this version is a recent beta. See https://community.signalusers.org/t/beta-feedback-for-the-upcoming-android-7-0-release/58941 https://community.signalusers.org/t/beta-feedback-for-the-up...

ByQuyzzy 3y ago

[flagged]

dang 3y ago
Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

chislobog 3y ago

I started getting “unknown” message requests on three unrelated phone numbers through my different signal accounts on Jan 24 2024. The contact info doesn't have a phone number, crypto scams. I guess this is the result of the beta. See screenshot please. https://ibb.co/F014n88 https://ibb.co/F014n88

woofcat 3y ago
The beta environment is completely distinct from the prod one. So unless you're on the beta servers they're not related.
- chislobog 3y ago
  Even more curious about these numberless messages then.
  - NewJazz 3y ago
    I also got one in December and another January. Crypto scams. No number displayed.

colordrops 3y ago

Sounds like moving the goal posts. So they just gave up in allowing registrations without a phone number? Perhaps pressure from three letter agencies.

3np 3y ago
Have they ever announced that allowing registrations without a phone number is something they intend to do?

anon-sre-srm 3y ago

Or use a fork like Session, despite its (unsustainable?) crypto business model. Reliance on phone numbers creating trackable metadata was a critical and avoidable footgun resulting from copying WhatsApp too closely without leaning into privacy first.

glub103011 3y ago

[dead]