7 ms·

The article included comments from Signal devs and Whittaker about this exact issue. There are valid reasons that Signal does not want to stop using phone numbe

The article included comments from Signal devs and Whittaker about this exact issue. There are valid reasons that Signal does not want to stop using phone numbers.

lxgr 3y ago
> “You reach a threshold where you’re actually reducing privacy,” Whittaker said. She gave an example of a person who faces severe threats and normally maintains vigilance but whose mother is only on WhatsApp because she can’t figure out the numberless Signal. The high-threat person would be stuck using the less secure option more often. How does that make sense? Signal just made phone numbers for contact discovery optional, in which case this person still couldn't find their mother, even though Signal has their number on file. What people are asking for is for phone numbers to be optional for account creation and identification. Everybody that wants to could still provide (and verify) their phone number for contact discovery, and this could even remain the default for non-sophisticated users as the one described above. So that seems more like a retroactive justification for an early design choice (Signal was originally TextSecure and used SMS as a transport layer, so making numbers the primary key made total sense back then). The only thing that still makes sense to me today is spam prevention: > Requiring phone numbers also makes it considerably harder for spammers to abuse Signal. “The existence of a handful of small apps that don’t really have a large scale of users, that don’t require phone numbers, I don’t think is proof that it’s actually workable for a large-scale app,” Whittaker said. One possible solution could be to tie numberless account creation to a nominal donation payment: Still not great, but spam prevention is unfortunately not free to Signal either.
- noirscape 3y ago
  It's probably also related to them not wanting to make Signal selfhostable. The server (and client) code is open source[0] but is reliant on an external SMS service to be self-deployed (as well as AWS for file storage, GCM and APN for push notifs but those aren't nearly as much of a barrier; AWS has numerous FOSS reimplementations while for GCM you can use ntfy), something which Signal devs have stated they don't want to happen (since providing libsignal implementations is, as far as I understand, part of how Signal makes money). SMS is afaik the only real barrier they have to preventing that. [0]: As in, AGPL and effectively a source dump with no instructions.

The article included comments from Signal devs and Whittaker about this exact issue. There are valid reasons that Signal does not want to stop using phone numbers.

lxgr 3y ago

> “You reach a threshold where you’re actually reducing privacy,” Whittaker said. She gave an example of a person who faces severe threats and normally maintains vigilance but whose mother is only on WhatsApp because she can’t figure out the numberless Signal. The high-threat person would be stuck using the less secure option more often. How does that make sense? Signal just made phone numbers for contact discovery optional, in which case this person still couldn't find their mother, even though Signal has their number on file. What people are asking for is for phone numbers to be optional for account creation and identification. Everybody that wants to could still provide (and verify) their phone number for contact discovery, and this could even remain the default for non-sophisticated users as the one described above. So that seems more like a retroactive justification for an early design choice (Signal was originally TextSecure and used SMS as a transport layer, so making numbers the primary key made total sense back then). The only thing that still makes sense to me today is spam prevention: > Requiring phone numbers also makes it considerably harder for spammers to abuse Signal. “The existence of a handful of small apps that don’t really have a large scale of users, that don’t require phone numbers, I don’t think is proof that it’s actually workable for a large-scale app,” Whittaker said. One possible solution could be to tie numberless account creation to a nominal donation payment: Still not great, but spam prevention is unfortunately not free to Signal either.

noirscape 3y ago
It's probably also related to them not wanting to make Signal selfhostable. The server (and client) code is open source[0] but is reliant on an external SMS service to be self-deployed (as well as AWS for file storage, GCM and APN for push notifs but those aren't nearly as much of a barrier; AWS has numerous FOSS reimplementations while for GCM you can use ntfy), something which Signal devs have stated they don't want to happen (since providing libsignal implementations is, as far as I understand, part of how Signal makes money). SMS is afaik the only real barrier they have to preventing that. [0]: As in, AGPL and effectively a source dump with no instructions.