4 ms·

Does Signal protect from the scheme when the government sends discovery requests for all existing phone numbers (< 1B) and gets a full mapping between user id a

Does Signal protect from the scheme when the government sends discovery requests for all existing phone numbers (< 1B) and gets a full mapping between user id and phone number? While slightly unrelated, I thought, how we can fix this for truly secure and privacy-aware, non-commercial communication platforms like Matrix? Make it impossible to build such mapping. The core idea is that you should be able to find the user by number only if you are in their contact list - strangers not welcome. So every user, who wishes to be discovered, uploads hash(A, B) for every contact - a hash of user's phone number (A) and contact's phone number (B), swapped if B < A. Let's say user A uploaded hashes h(A,B) and h(A,C). Now, user B wishes to discover contacts and uploads hashes h(A, B) and h(B, D). The server sees matching hashes between A and B and lets them discover each other without knowing their numbers. The advantages: - as we hash a pair of 9-digit numbers, the hash function domain space is larger and it is more difficult to reverse the hashes (hash of a single phone number is reversed easily) - each user can decide who may discover them Disadvantages: - a patient attacker can create hashes of A with all existing numbers and discover who are the contacts of A. Basically, extract anyone's phone book via discovery API. One way to protect against this would be to verify A's phone number before using discovery, but the government, probably, can intercept SMS codes and pass the verification anyway. However, the government can also see all the phone calls, so they know who is in whose phone book anyway. - if the hash is reversed, you get pairs of phone numbers instead of just one number

wizzwizz4 10mo ago
And it's trivial to reverse a hash in such a scenario. This scheme is completely broken.
Arathorn 10mo ago
There's some really interesting stuff we've been looking into on the Matrix side to solve this - e.g. https://github.com/asonnino/arke https://github.com/asonnino/arke aka https://eprint.iacr.org/2023/1218 https://eprint.iacr.org/2023/1218 or https://martin.kleppmann.com/2024/07/05/pudding-user-discovery-anonymity-networks.html https://martin.kleppmann.com/2024/07/05/pudding-user-discove.... Meanwhile, Matrix for now does support hashed contact lookup, although few clients implement it given the privacy considerations at https://spec.matrix.org/unstable/identity-service-api/#security-considerations https://spec.matrix.org/unstable/identity-service-api/#secur...
- wkat4242 10mo ago
  Yeah you're doing a lot better job on the privacy side than signal is IMO. Especially just being able to run my own service will be priceless when something like chatcontrol eventually makes it through. Signal can only comply or leave, but they'll never manage to kill all the matrix servers around.
heavyset_go 10mo ago
The hash space for phone numbers is so small that you can enumerate them all.
ruined 10mo ago
yes. users can disable phone number discovery
- Groxx 10mo ago
  can they disable it before or after it tells other people that they joined, if those other people had their number in their synced contacts list? (I would be thrilled to learn that this changed, but it has been in place for many years and it's kinda hard to personally test)
  - ruined 10mo ago
    yes before. discoverability does default to "on", but there is an opportunity to disable it during registration, which prevents those notifications.
godelski 10mo ago
Signal publicly shares government requests AND the data that they send them The data Signal has is: 1) registration time for a given phone number, 2) knowledge of daily login (24hr resolution). That's it. That's the metadata. They do not have information on who is communicating with who, when messages are sent, if messages are sent, how many, the size, or any of that. Importantly, they do not have an identity (your name) associated with the account nor does that show for contacts (not even the phone number needs be shared). Signal is designed to be safe from Signal itself. Yes, it sucks that there is the phone number connected to the account, but you can probably understand that there's a reason authorities don't frequently send Signal data requests; because the information isn't very useful. So even if you have a phone number associated with a government ID (not required in America) they really can only show that you have an account and potentially that the account is active. Like the sibling comment says, there's always a trade-off. You can't have a system that has no metadata, but you can have one that minimizes it. Signal needs to balance usability and minimize bots while maximizing privacy and security. Phone numbers are a barrier to entry for bots, preventing unlimited or trivial account generation. It has downsides but upsides too. One big upside is that if Signal gets compromised then there's can be no reconstruction of the chat history or metadata. IMO, it's a good enough solution for 99.9% of people. If you need privacy and security from nation state actors who are directly targeting you then it's maybe not the best solution (at least not out of the box) but otherwise I can't see a situation where it is a problem. FWIW, Signal does look to be moving away from phone numbers. They have usernames now. I'd expect it to take time to completely get away though considering they're a small team and need to move from the existing infrastructure to that new one. It's definitely not an easy task (and I think people frequently underestimate the difficulty of security, as quoted in the article lol. And as suggested by the op: it's all edge cases) https://signal.org/bigbrother/ https://signal.org/bigbrother/
- codedokode 10mo ago
  > Phone numbers are a barrier to entry for bots, preventing unlimited or trivial account generation. What's wrong with account generation? Nothing. The problem is if they start sending spam to random people. So we can make registration or adding contacts paid (in cryptocurrency) and the problem is gone.

wizzwizz4 10mo ago

And it's trivial to reverse a hash in such a scenario. This scheme is completely broken.

Arathorn 10mo ago

There's some really interesting stuff we've been looking into on the Matrix side to solve this - e.g. https://github.com/asonnino/arke https://github.com/asonnino/arke aka https://eprint.iacr.org/2023/1218 https://eprint.iacr.org/2023/1218 or https://martin.kleppmann.com/2024/07/05/pudding-user-discovery-anonymity-networks.html https://martin.kleppmann.com/2024/07/05/pudding-user-discove.... Meanwhile, Matrix for now does support hashed contact lookup, although few clients implement it given the privacy considerations at https://spec.matrix.org/unstable/identity-service-api/#security-considerations https://spec.matrix.org/unstable/identity-service-api/#secur...

wkat4242 10mo ago
Yeah you're doing a lot better job on the privacy side than signal is IMO. Especially just being able to run my own service will be priceless when something like chatcontrol eventually makes it through. Signal can only comply or leave, but they'll never manage to kill all the matrix servers around.

heavyset_go 10mo ago

The hash space for phone numbers is so small that you can enumerate them all.

ruined 10mo ago

yes. users can disable phone number discovery

Groxx 10mo ago
can they disable it before or after it tells other people that they joined, if those other people had their number in their synced contacts list? (I would be thrilled to learn that this changed, but it has been in place for many years and it's kinda hard to personally test)
- ruined 10mo ago
  yes before. discoverability does default to "on", but there is an opportunity to disable it during registration, which prevents those notifications.

godelski 10mo ago

Signal publicly shares government requests AND the data that they send them The data Signal has is: 1) registration time for a given phone number, 2) knowledge of daily login (24hr resolution). That's it. That's the metadata. They do not have information on who is communicating with who, when messages are sent, if messages are sent, how many, the size, or any of that. Importantly, they do not have an identity (your name) associated with the account nor does that show for contacts (not even the phone number needs be shared). Signal is designed to be safe from Signal itself. Yes, it sucks that there is the phone number connected to the account, but you can probably understand that there's a reason authorities don't frequently send Signal data requests; because the information isn't very useful. So even if you have a phone number associated with a government ID (not required in America) they really can only show that you have an account and potentially that the account is active. Like the sibling comment says, there's always a trade-off. You can't have a system that has no metadata, but you can have one that minimizes it. Signal needs to balance usability and minimize bots while maximizing privacy and security. Phone numbers are a barrier to entry for bots, preventing unlimited or trivial account generation. It has downsides but upsides too. One big upside is that if Signal gets compromised then there's can be no reconstruction of the chat history or metadata. IMO, it's a good enough solution for 99.9% of people. If you need privacy and security from nation state actors who are directly targeting you then it's maybe not the best solution (at least not out of the box) but otherwise I can't see a situation where it is a problem. FWIW, Signal does look to be moving away from phone numbers. They have usernames now. I'd expect it to take time to completely get away though considering they're a small team and need to move from the existing infrastructure to that new one. It's definitely not an easy task (and I think people frequently underestimate the difficulty of security, as quoted in the article lol. And as suggested by the op: it's all edge cases) https://signal.org/bigbrother/ https://signal.org/bigbrother/

codedokode 10mo ago
> Phone numbers are a barrier to entry for bots, preventing unlimited or trivial account generation. What's wrong with account generation? Nothing. The problem is if they start sending spam to random people. So we can make registration or adding contacts paid (in cryptocurrency) and the problem is gone.