4 ms·

> why does Signal still require a phone number in the first place? From https://signal.org/blog/signal-is-expensive/ https://signal.org/blog/signal-is-expensiv

by Vinnl 3y ago

> why does Signal still require a phone number in the first place? From https://signal.org/blog/signal-is-expensive/ https://signal.org/blog/signal-is-expensive/ > We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. This is a critical step in helping to prevent spam accounts from signing up for the service and rendering it completely unusable—a non-trivial problem for any popular messaging app. I'm not sure why you need to assume that it will be linked back to your real identity; I haven't seen anything that indicates any motivation to do something like that. I'm all for being cautious, but being overly cynical can lead to letting perfect being the enemy of the good.

tamimio 3y ago
For the spam part, I commented below how’s that doesn’t work and it doesn’t even make sense for a messaging app. > I'm not sure why you need to assume that it will be linked back to your real identity; I’m not assuming, only North America (edit: and some European countries) doesn’t require an ID for a phone number (1), and even in here, you would use it in other services that are linked to your real ID like banks or paying the phone bill online. The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy. (1) https://www.comparitech.com/blog/vpn-privacy/sim-card-registration-laws/ https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...
- pyramid301 3y ago
  [dead]
- hnarn 3y ago
  > The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy You completely misunderstand what kind of privacy Signal aims to achieve. Signal protects you from eavesdropping and data hoarding, two major privacy issues with solutions like Facebook Messenger for example. They do not and have never claimed to offer a service where “privacy” means nobody knows who anyone is, it isn’t Tor and I wouldn’t want it to be. If you don’t like the goals and design choices of Signal, just use another service. There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people”, which I think is great. It’s not a social network, it’s a messaging app between friends that solves issues presented by alternatives like SMS or Instagram; that’s it.
  - tamimio 3y ago
    > Signal protects you from eavesdropping and data hoarding Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa_really_decrypt_tucker_carlsons_signal/ https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... As long as you can’t host and use your own server, you should never assume that. > There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people” You communicate with your colleagues and clients over emails and you know they are real, you probably play games too and use discord and you know they are real, meanwhile you can be talking to bot in twitter that they are registered with a “real” phone number.
    - pyramid301 3y ago
      [dead]
    - Sohcahtoa82 3y ago
      > Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... A lot of people in the comments have things to say about that video. Personally, I wouldn't trust anything that comes out of Tucker's mouth.
      - tamimio 3y ago
        Focus on the issue, not the person (Tucker), you might not trust a person which is fair, but you are still trusting Signal’s server, you can NEVER know if they have a memory injection backdoor running in there, you can audit the code as much as you want and it still passes, yet, the messages are compromised.
        luuurker 3y ago
        There are ways of getting messages without breaking Signal or using a backdoor. One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. Something else that might happen is you ending up with your phone hacked because you're talking with someone close to Putin. The only way to know for sure is for you to create an alternative service, write all code yourself, and host everything without ever leaving your server alone. And even then you can't be sure you haven't been hacked. On a side note, if we're getting information from someone that lies a lot and often leaves out details that don't fit the narrative, then perhaps we should also look at the person, not just the issue.
- abdullahkhalids 3y ago
  You lose anonymity. You do not lose privacy, which is still secured by the message encryption.
codedokode 3y ago
Neither Signal nor Telegram allow to pay a small amount in cryptocurrency to prove you are not a spammer. This shows that they are really interested in knowing who is their user.
- Vinnl 3y ago
  It's either that, or perhaps they're looking for a solution that works for 99% of people.
dredmorbius 3y ago
There are places where one's mobile phone is effectively one's identity. South Korea for example: <https://www.nfcw.com/2022/10/20/379863/south-korea-to-roll-out-digital-national-id-cards-that-citizens-can-store-on-their-mobile-phone/ https://www.nfcw.com/2022/10/20/379863/south-korea-to-roll-o...>
- Vinnl 3y ago
  Sure, but that means that your phone number is linked to your identity even without Signal? There's no additional data that Signal links to it, other than that you're a Signal user and when you sent your last message.
  - dredmorbius 3y ago
    Your previous question was "I'm not sure why you need to assume that it will be linked back to your real identity?" If it's not possible to buy a phone without a strong attestation of identity, as is the general case in at least one country, then the identity relationship is baked in. It's probably possible to buy a burner phone even in South Korea. But for those who are using their standard-issue phone with Signal, the problem most certainly exists. And even in countries where there isn't some national phone-as-identifier policy, effectively most people's phone numbers tie them to their real-space identity even if there's no explicit personal data association[1], and in most cases, phone number, IMEI, AAID, and/or billing data (credit card payment authorisation) provide far greater assurance. ________________________________ Notes: 1. <https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymous-data https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymo...> 2. IMEI: <https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity https://en.wikipedia.org/wiki/International_Mobile_Equipment...>, AAID: <https://support.google.com/authorizedbuyers/answer/3221407?hl=en https://support.google.com/authorizedbuyers/answer/3221407?h...> <https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracki...>
    - Vinnl 3y ago
      OK, yeah, I meant "I'm not sure why you need to assume that it will be linked back to your real identity by Signal ?"

by Vinnl 3y ago

tamimio 3y ago

For the spam part, I commented below how’s that doesn’t work and it doesn’t even make sense for a messaging app. > I'm not sure why you need to assume that it will be linked back to your real identity; I’m not assuming, only North America (edit: and some European countries) doesn’t require an ID for a phone number (1), and even in here, you would use it in other services that are linked to your real ID like banks or paying the phone bill online. The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy. (1) https://www.comparitech.com/blog/vpn-privacy/sim-card-registration-laws/ https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...

pyramid301 3y ago
[dead]
hnarn 3y ago
> The concept simply boils down to as soon as you find an account’s phone number, it’s a game over for that said privacy You completely misunderstand what kind of privacy Signal aims to achieve. Signal protects you from eavesdropping and data hoarding, two major privacy issues with solutions like Facebook Messenger for example. They do not and have never claimed to offer a service where “privacy” means nobody knows who anyone is, it isn’t Tor and I wouldn’t want it to be. If you don’t like the goals and design choices of Signal, just use another service. There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people”, which I think is great. It’s not a social network, it’s a messaging app between friends that solves issues presented by alternatives like SMS or Instagram; that’s it.
- tamimio 3y ago
  > Signal protects you from eavesdropping and data hoarding Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa_really_decrypt_tucker_carlsons_signal/ https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... As long as you can’t host and use your own server, you should never assume that. > There are benefits of the choices they’ve made, namely ensuring that most users of the service are “real people” You communicate with your colleagues and clients over emails and you know they are real, you probably play games too and use discord and you know they are real, meanwhile you can be talking to bot in twitter that they are registered with a “real” phone number.
  - pyramid301 3y ago
    [dead]
  - Sohcahtoa82 3y ago
    > Do they?! We can ask Tucker Carlsons about that https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa https://www.reddit.com/r/signal/comments/16evuej/did_the_nsa... A lot of people in the comments have things to say about that video. Personally, I wouldn't trust anything that comes out of Tucker's mouth.
    - tamimio 3y ago
      Focus on the issue, not the person (Tucker), you might not trust a person which is fair, but you are still trusting Signal’s server, you can NEVER know if they have a memory injection backdoor running in there, you can audit the code as much as you want and it still passes, yet, the messages are compromised.
      - luuurker 3y ago
        There are ways of getting messages without breaking Signal or using a backdoor. One of them is getting the messages from the other party(ies) involved. You can't protect yourself from this even if you self host. Something else that might happen is you ending up with your phone hacked because you're talking with someone close to Putin. The only way to know for sure is for you to create an alternative service, write all code yourself, and host everything without ever leaving your server alone. And even then you can't be sure you haven't been hacked. On a side note, if we're getting information from someone that lies a lot and often leaves out details that don't fit the narrative, then perhaps we should also look at the person, not just the issue.
abdullahkhalids 3y ago
You lose anonymity. You do not lose privacy, which is still secured by the message encryption.

codedokode 3y ago

Neither Signal nor Telegram allow to pay a small amount in cryptocurrency to prove you are not a spammer. This shows that they are really interested in knowing who is their user.

Vinnl 3y ago
It's either that, or perhaps they're looking for a solution that works for 99% of people.

dredmorbius 3y ago

There are places where one's mobile phone is effectively one's identity. South Korea for example: <https://www.nfcw.com/2022/10/20/379863/south-korea-to-roll-out-digital-national-id-cards-that-citizens-can-store-on-their-mobile-phone/ https://www.nfcw.com/2022/10/20/379863/south-korea-to-roll-o...>

Vinnl 3y ago
Sure, but that means that your phone number is linked to your identity even without Signal? There's no additional data that Signal links to it, other than that you're a Signal user and when you sent your last message.
- dredmorbius 3y ago
  Your previous question was "I'm not sure why you need to assume that it will be linked back to your real identity?" If it's not possible to buy a phone without a strong attestation of identity, as is the general case in at least one country, then the identity relationship is baked in. It's probably possible to buy a burner phone even in South Korea. But for those who are using their standard-issue phone with Signal, the problem most certainly exists. And even in countries where there isn't some national phone-as-identifier policy, effectively most people's phone numbers tie them to their real-space identity even if there's no explicit personal data association[1], and in most cases, phone number, IMEI, AAID, and/or billing data (credit card payment authorisation) provide far greater assurance. ________________________________ Notes: 1. <https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymous-data https://www.eff.org/deeplinks/2023/11/debunking-myth-anonymo...> 2. IMEI: <https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity https://en.wikipedia.org/wiki/International_Mobile_Equipment...>, AAID: <https://support.google.com/authorizedbuyers/answer/3221407?hl=en https://support.google.com/authorizedbuyers/answer/3221407?h...> <https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracki...>
  - Vinnl 3y ago
    OK, yeah, I meant "I'm not sure why you need to assume that it will be linked back to your real identity by Signal ?"