6 ms·

I don't think it's cool at all, a secure messaging app should not require personal/tracking identifiers like phone numbers in the first place.

overfeed 11mo ago
Security and usability are frequently at odds. The ease with which users can discover and exchange messages with their contacts is a major usability issue. Phone number as a proxy for identity mostly works, at the cost of some privacy risks.
- soulofmischief 11mo ago
  This made sense when Signal/TextSecure allowed users to send regular SMS, making it easy to convince others to set it as their default messenger. Now that this crucial adoption feature has been removed, it makes zero sense for Signal to continue to rely on phone numbers. Since that feature has been removed, the utility of Signal has been lost anyway and many in my groups returned to regular SMS. So the system is already compromised from that perspective. At least forks such as Session tried to solve this (too bad Session removed forward secrecy and became useless)
K0balt 11mo ago
I agree, but since a messaging apps utility is some fraction of the square of the # of users on the platform, a facile way to propagate virally is a de facto requirement for an app targeting wide spread adoption / discovery rather than targeted cells of individuals focused around a pre shared idea. It’s a compromise meant to propagate the network, and it has a high degree of utility to most users. There are also plenty of apps that are de-facto anonymous and private. Signal is de facto non-anonymous but private, though using a personally identifiable token is not a hard requirement and is trivial to avoid. (A phone number of some kind is needed once for registration only)
0x1ch 11mo ago
There's no alternative to reduce spam and fake accounts, unless we collectively are fine with blocking Russia, India, China, and friends from the internet.
maqp 11mo ago
The sad part is, that's what's keeping Signal safe from spam. Also, average Joe is not using proxy to hide the IP-address of their device so they leak their identity to the server anyway. Signal is not keeping those logs so that helps. Messaging apps cater to different needs, sometimes you need only content-privacy. It's not a secret you're married to your partner and you talk daily, but the topics of the conversation aren't public information. When you need to hide who you are and who you talk to (say Russian dissident group, or sexual minorities in fundamentalist countries), you might want to use Tor-exclusive messaging tools like Cwtch. But that comes at a near-unavoidable issue of no offline-messaging, meaning you'll have to have a schedule when to meet online. Signal's centralized architecture has upsides and downsides, but what matters ultimately is, (a) are you doing what you can in the architectural limitations of the platform (strong privacy-by-design provides more features at same security level), and (b), are you communicating the threat model to the users so they can make informed decision whether the applications fits their threat model.
- kragen 11mo ago
  If you wanted to keep it safe from spam, you'd use a proof-of-work scheme using a memory-hard hash function like scrypt, or a Captcha, or an invite-code system like lobste.rs or early Gmail. Signal's architects already knew that when they started designng it.
  - codedokode 11mo ago
    Or a small payment in cryptocurrency.
    - kragen 11mo ago
      Yes, that would also work, but you should probably offer alternatives.
  - creata 11mo ago
    > you'd use a proof-of-work scheme I thought the general belief (e.g., '“Proof-of-Work” Proves Not to Work') was that proof-of-work isn't very good anti-spam. > or a Captcha Aren't bots better at those than humans by now? And making people do captchas in an instant messenger is a great way to make people not use that instant messenger. > or an invite-code system like lobste.rs or early Gmail. That's not a long-term option if you want to make something mainstream.
robot-wrangler 11mo ago
Signal blasted my whole contacts list the day I signed up so that I was surprised to see lots of people saying "finally you got signal". That was also the moment I uninstalled the app. Leaking contact info appears to be part of the design. Should have deleted my account instead of just removing the app, because it turns out the difference between using signal and using SMS is obscured for most phones, and when people thought they were texting me they weren't. I was just out of contact for a long time as people kept sending me the wrong kind of messages. I suppose one could argue protecting contact/identity is not a real goal for e2e encryption, but what I see is a "privacy oriented" service that's clearly way too interested in bootstrapping a user base with network effects and shouldn't be trusted.
- immibis 11mo ago
  When someone on your contacts list gets Signal, Signal displays this in its UI. I don't think this is a privacy violation. Signal aims to hide your messages, but it does not have its own contacts system, and piggybacks on your existing phone number and phone number contacts. Nor does it attempt to hide the fact you have Signal.
- mmooss 11mo ago
  > Leaking contact info appears to be part of the design. Those people already had your contact info, probably. Also, I think there is a setting in Signal to prevent that - and via the OS you can block Signal's access to your contacts, of course.
  - robot-wrangler 11mo ago
    > Those people already had your contact info, probably. What leaked was that I was a signal user, and that the person on the other side was a signal user. The security implications are obvious, and by itself, that's already enough to get someone who really needs to care about privacy killed. > Also, I think there is a setting in Signal to prevent that False. It happened without my permission as soon as the app was installed, and there was no way to opt out. Maybe they changed it since then, but the fact remains they obviously cared more about network-effects and user-counts than user privacy. Sigh, there's just no need for this kind of apologism. You could just admit that a) it's bad behavior, b) they did it on purpose, and c) it's not possible to trust someone who does something like this. I'm aware they are nonprofit, so I don't know why it's like this, but the answer is probably somewhere in the list of donors.
immibis 11mo ago
Signal's security model does not include metadata, and this is a valid design.
stavros 11mo ago
What's more secure? A moderately secure messaging app all your friends have installed, or a very secure messaging app nobody else has?
josh2600 11mo ago
Signal requires a phone number for signup but you only have to share a username. We know from subpoenas that signal only holds the user phone number, creation timestamp, and last login timestamp. That’s it.

overfeed 11mo ago

Security and usability are frequently at odds. The ease with which users can discover and exchange messages with their contacts is a major usability issue. Phone number as a proxy for identity mostly works, at the cost of some privacy risks.

soulofmischief 11mo ago
This made sense when Signal/TextSecure allowed users to send regular SMS, making it easy to convince others to set it as their default messenger. Now that this crucial adoption feature has been removed, it makes zero sense for Signal to continue to rely on phone numbers. Since that feature has been removed, the utility of Signal has been lost anyway and many in my groups returned to regular SMS. So the system is already compromised from that perspective. At least forks such as Session tried to solve this (too bad Session removed forward secrecy and became useless)

K0balt 11mo ago

I agree, but since a messaging apps utility is some fraction of the square of the # of users on the platform, a facile way to propagate virally is a de facto requirement for an app targeting wide spread adoption / discovery rather than targeted cells of individuals focused around a pre shared idea. It’s a compromise meant to propagate the network, and it has a high degree of utility to most users. There are also plenty of apps that are de-facto anonymous and private. Signal is de facto non-anonymous but private, though using a personally identifiable token is not a hard requirement and is trivial to avoid. (A phone number of some kind is needed once for registration only)

0x1ch 11mo ago

There's no alternative to reduce spam and fake accounts, unless we collectively are fine with blocking Russia, India, China, and friends from the internet.

maqp 11mo ago

The sad part is, that's what's keeping Signal safe from spam. Also, average Joe is not using proxy to hide the IP-address of their device so they leak their identity to the server anyway. Signal is not keeping those logs so that helps. Messaging apps cater to different needs, sometimes you need only content-privacy. It's not a secret you're married to your partner and you talk daily, but the topics of the conversation aren't public information. When you need to hide who you are and who you talk to (say Russian dissident group, or sexual minorities in fundamentalist countries), you might want to use Tor-exclusive messaging tools like Cwtch. But that comes at a near-unavoidable issue of no offline-messaging, meaning you'll have to have a schedule when to meet online. Signal's centralized architecture has upsides and downsides, but what matters ultimately is, (a) are you doing what you can in the architectural limitations of the platform (strong privacy-by-design provides more features at same security level), and (b), are you communicating the threat model to the users so they can make informed decision whether the applications fits their threat model.

kragen 11mo ago
If you wanted to keep it safe from spam, you'd use a proof-of-work scheme using a memory-hard hash function like scrypt, or a Captcha, or an invite-code system like lobste.rs or early Gmail. Signal's architects already knew that when they started designng it.
- codedokode 11mo ago
  Or a small payment in cryptocurrency.
  - kragen 11mo ago
    Yes, that would also work, but you should probably offer alternatives.
- creata 11mo ago
  > you'd use a proof-of-work scheme I thought the general belief (e.g., '“Proof-of-Work” Proves Not to Work') was that proof-of-work isn't very good anti-spam. > or a Captcha Aren't bots better at those than humans by now? And making people do captchas in an instant messenger is a great way to make people not use that instant messenger. > or an invite-code system like lobste.rs or early Gmail. That's not a long-term option if you want to make something mainstream.

robot-wrangler 11mo ago

Signal blasted my whole contacts list the day I signed up so that I was surprised to see lots of people saying "finally you got signal". That was also the moment I uninstalled the app. Leaking contact info appears to be part of the design. Should have deleted my account instead of just removing the app, because it turns out the difference between using signal and using SMS is obscured for most phones, and when people thought they were texting me they weren't. I was just out of contact for a long time as people kept sending me the wrong kind of messages. I suppose one could argue protecting contact/identity is not a real goal for e2e encryption, but what I see is a "privacy oriented" service that's clearly way too interested in bootstrapping a user base with network effects and shouldn't be trusted.

immibis 11mo ago
When someone on your contacts list gets Signal, Signal displays this in its UI. I don't think this is a privacy violation. Signal aims to hide your messages, but it does not have its own contacts system, and piggybacks on your existing phone number and phone number contacts. Nor does it attempt to hide the fact you have Signal.
mmooss 11mo ago
> Leaking contact info appears to be part of the design. Those people already had your contact info, probably. Also, I think there is a setting in Signal to prevent that - and via the OS you can block Signal's access to your contacts, of course.
- robot-wrangler 11mo ago
  > Those people already had your contact info, probably. What leaked was that I was a signal user, and that the person on the other side was a signal user. The security implications are obvious, and by itself, that's already enough to get someone who really needs to care about privacy killed. > Also, I think there is a setting in Signal to prevent that False. It happened without my permission as soon as the app was installed, and there was no way to opt out. Maybe they changed it since then, but the fact remains they obviously cared more about network-effects and user-counts than user privacy. Sigh, there's just no need for this kind of apologism. You could just admit that a) it's bad behavior, b) they did it on purpose, and c) it's not possible to trust someone who does something like this. I'm aware they are nonprofit, so I don't know why it's like this, but the answer is probably somewhere in the list of donors.

immibis 11mo ago

Signal's security model does not include metadata, and this is a valid design.

stavros 11mo ago

What's more secure? A moderately secure messaging app all your friends have installed, or a very secure messaging app nobody else has?

josh2600 11mo ago

Signal requires a phone number for signup but you only have to share a username. We know from subpoenas that signal only holds the user phone number, creation timestamp, and last login timestamp. That’s it.