4 ms·

I tried to install Signal once. First, it checks and matches your phone number. Strange, but acceptable. Then, it shows a Google Captcha [0], which sends my dat

• jzackpete 1y ago
  perfect is the enemy of good, with WhatsApp being neither (at least wrt privacy)
• mkj 1y ago
  Plausible they're anonymously proxying the captcha to google?
  • AlecSchueler 1y ago
    It's possible but if there's no transparency you can also assume the worst
  • deleted 1y ago
    [deleted]
  • balanc 1y ago
    Is that something that can be done?
  • reconnecting 1y ago
    Unless I'm mistaken, they use services provided by third parties, perhaps PayPal as indicated in the source code. But guess what - there's no mention of PayPal in privacy either.
  • reconnecting 1y ago
    No, there is (or was) just Google Captcha. Here is issue on Github about it. https://github.com/signalapp/Signal-Desktop/issues/6002 https://github.com/signalapp/Signal-Desktop/issues/6002
• hereme888 1y ago
  Signal is famous for their privacy as well as encryption. Moreover, the comparison is against WhatsApp, which requires you share all your contacts with facebook, and likely cooperates with governments to gain backdoor access.
  • reconnecting 1y ago
    Perhaps Signal is famous for its encryption, but what is related to handling information about yourself is handled below any expectations, and you can check this yourself by reading the following document. https://signal.org/legal/ https://signal.org/legal/
    • redrblackr 1y ago
      Clarify what you see there that makes it below any expectations?
      • reconnecting 1y ago
        1. There is no list of service providers with whom they share personal user data. 2. The privacy terms themselves were updated 7 years ago, which is impossible for any company operating on the internet. It's just impossible to claim to be famous for privacy and occasionally forget to update how you handle privacy for 7 years.
        • akaij 1y ago
          1. I’ll give you one guess why that is. 2. It is possible, and you better believe it. They haven’t updated it, because there is no need for it. Signal is simply not interested in your messages. It’s also not interested in your metadata, because it’s not an ad platform or a SIGINT front masquerading as a free messaging service. If all this sounds hard to believe, you should donate. (I’m not affiliated)
          • reconnecting 1y ago
• anon7000 1y ago
  “Unacceptably poorly” describes what Facebook & Google do with your data, which is to (essentially) sell your personal information to advertisers. Google captcha sends your data to Google? Come on. Not even remotely in the same ballpark.
  • reconnecting 1y ago
    Actually not, because Facebook and Google at least explain what happens with your personal data. Again, Signal doesn't do even this. [1] https://signal.org/legal/ https://signal.org/legal/
    • omnimus 1y ago
      First thing i saw when i clicked the link. “Privacy of user data. Signal does not sell, rent or monetize your personal data or content in any way – ever. Please read our Privacy Policy to understand how we safeguard the information you provide when using our Services.” I clicked Privacy Policy and there is whole page explaining whats happening with your data. Your comments seem a bit biased?
      • reconnecting 1y ago
        Also, this is untrue, as they monetize personal data by sharing it with ad networks. You can visit their donation page [1] that contains ad pixels from LinkedIn, Google Tag Manager and Reddit. Again, no details in the privacy terms [2] about sharing visitor data to those companies. [1] https://signal.org/donate/ https://signal.org/donate/ [2] https://support.signal.org/hc/en-us/articles/360032293251-Donor-Privacy-Policy https://support.signal.org/hc/en-us/articles/360032293251-Do...
        • omnimus 1y ago
          That's fair critique. Their website uses third parties to work and some of the services they shouldn't use. Others they probably have to use. But you are implying that this makes the app itself broken. I don't think this is proof that the app itself is not respecting privacy like their legal documents say. I won't fight for them. I've never even been on their website. But this is classic situation where someone else is in charge of website and marketing. I wouldn't be surprised if slapping google analytics on a website was standard for every other "privacy focused" marketing product.
• diffeomorphism 1y ago
  > I checked Signal's Privacy Policy and there are no details data sharing Okay, so they are not sharing data and your whole premise was wrong. That happens. But now how do you change your mind?
  • reconnecting 1y ago
    On the contrary, they are sharing the data and not explaining this matter.
• fortzi 1y ago
  This is incredibly nitpicky compared to the low standard that Whatsapp is held to
• ethersteeds 1y ago
  Signal started out as an Alternative Android SMS app that opportunistically upgraded text messages to use encryption when both parties had Signal. It exclusively used sms for transport, so phone numbers were baked deeply into it in a way similar to Twitter's 140 character limit. It's true that having to disclose your phone number to the service and especially to other users is now a significant drawback compared to internet-first services like WhatsApp that use entirely separate identifiers. Many people have raised this objection, and to their credit they've at last rearchitected to allow exchanging messages using user names and without your phone number being disclosed to the other party. They still have the phone number at the core of account registration, I suspect for similar reasons to the use of a (one-time sign up) captcha: because they raise the cost to create spam accounts. I'd understand if that's not acceptable to you, but I don't think "unacceptably poor" is a reasonable assessment of their handling of user privacy. Another example of their approach to privacy: they went to great lengths to design their Giphy search to avoid revealing your search terms to them or your IP address to Giphy: https://signal.org/blog/giphy-experiment/ https://signal.org/blog/giphy-experiment/
  • reconnecting 1y ago
    When a company, through an application or website, communicates any of your personal data to a third-party provider, this should be mentioned in their privacy terms. In the case of GIPHY that you mentioned, they are sending IP addresses, which is considered PII (according to GDPR), and this should be outlined in the terms and agreed to by the user prior to sending the data. Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years. All together, this is what I call "unacceptably poor" in terms of handling users' privacy.
    • yusina 1y ago
      > Signal's privacy terms were last updated in 2018. We are in 2025 now. It is unimaginable for any operational organization not to update their terms for 7 years. As a privacy-concious user, I always get suspicious abouy privacy policy changes. They always become more loose instead of doing anything to my advantage. Typically because company has found a new way to use my data to make money and their lawyers realized that this requires relaxing the privacy policy. It's a good thing Signal is not playing that game.
• gausswho 1y ago
  Agreed. It's a weird open secret that your phone number is your UUID across all the tech giants. That Signal follows the flock here instead of an email/pass signup is never gonna win me over.
  • pcthrowaway 1y ago
    There's a practical reason for that; if they don't collect and store any other user information, they have no way to determine if someone trying to sign up is a bot or someone else trying to abuse the service. I get far less spam messages on Signal than on telegram and discord, for example. There's a cost associated with setting up additional Signal accounts at the very least.
    • reconnecting 1y ago
      Strongly disagree. As a creator of tirreno platform [1] I can say that behavioural patterns are more helpful in fraud prevention (including spam) than phone verification, a specially taking into account that phone numbers could be bought in bulk online. [1] https://github.com/tirrenotechnologies/tirreno https://github.com/tirrenotechnologies/tirreno
• msgodel 1y ago
  >but acceptable. There is no acceptable reason for an online service to demand your phone number IMO. There are a lot of other issues with signal though.
  • yusina 1y ago
    For example?
    • msgodel 1y ago
      The insistence that you use their automatically updated smartphone client makes the E2EE practically a no-op.
      • deleted 1y ago
        [deleted]
      • crtasm 1y ago
        It's your choice to keep automatic app updates turned on. I turned it off.
        • msgodel 1y ago
          In my experience that choice is available but choosing to leave it off means choosing not to use the service so it may as well not exist. Unless they allow you to bring your own client E2EE is a no-op.
          • yusina 1y ago
            I have sympathies for this argument, though it boils down to trust. Even if you roll your own client, you still need to trust some things outside of your control, be it your build environment, your phone, whatever. But most people will use somebody else's client, so need to trust whoever built that one. Or whoever supposedly audited it. The Signal authors just play that role here. Their business model is fundamentally different that that of Google or Meta, which is a main source of trust people are putting into it. Offloading the exposure to a minimum (just the client which is open source) is another. Yes there are ways around all that for an attacker, but in the end it's a game of likelihood. A journalist or dissident fearing for their life may have a different conclusion than mom and dad who want to coordinate a birthday party without big tech reading those messages and selling them to ad companies. It's good to err on the side of caution, but acting like I am the former while in reality I'm closer to the latter user type is in the end just theatre.