Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal is working on a paid option to create an account without a phone number

aboutsignal.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: Signal is working on a paid option to create an account without a phone number

#41

Post by autoexec »

Cider9986 wrote: post #26
zuhsetaqi wrote: post #23

Earlier quoted context omitted.

If it’s not anonymous then it’s only a matter of time until it’ll lose its privacy …

They have sealed sender which improves contact privacy.

That's outdated information.

https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars."

However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud.

see:

https://web.archive.org/web/20250117232443/https://www.vice....

https://web.archive.org/web/20230519120156/https://community...

Re: Signal is working on a paid option to create an account without a phone number

#42

Post by autoexec »

Cider9986 wrote: post #38
autoexec wrote: post #34

Earlier quoted context omitted.

That's outdated info. Currently signal collects your name, photo, phone number, and your contacts and permanently stores them in the cloud, weakly protected See: https://web.archive.org/web/20250117232443/https://www.vice.... https://web.archive.org/web/20230519120156/https://community...

It's an optional feature. Mathew Green has continued to use and recommend it. If you have the threat model to worry about Intel SGX being cracked, you will also know to use a long passphrase. You could also use a GrapheneOS phone with a weak pin, it makes it easier to access the data. You can use a long passphrase if you want to protect your data. It doesn't make GrapheneOS bad. Other apps can see that data themselve…

It isn't an optional feature. If you decide not to create a pin one is created for you and your data is still uploaded to the cloud.

See: https://web.archive.org/web/20230616082821/https://old.reddi...

https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars."

However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud.

Re: Signal is working on a paid option to create an account without a phone number

#43

Post by Yukonv »

autoexec wrote: post #41
Cider9986 wrote: post #26

Earlier quoted context omitted.

They have sealed sender which improves contact privacy.

That's outdated information. https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars." However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud. see: https://web.archive.org/web/…

Needs a big asterisk on “stores it forever in the cloud.” That information is end-to-end encrypted and not accessible to Signal or anyone else. If you don’t want that feature you can simply disable it.

[1] https://support.signal.org/hc/en-us/articles/360007059792-Si...

Re: Signal is working on a paid option to create an account without a phone number

#44

Post by autoexec »

Yukonv wrote: post #43
autoexec wrote: post #41

Earlier quoted context omitted.

That's outdated information. https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars." However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud. see: https://web.archive.org/web/…

Needs a big asterisk on “stores it forever in the cloud.” That information is end-to-end encrypted and not accessible to Signal or anyone else. If you don’t want that feature you can simply disable it. [1] https://support.signal.org/hc/en-us/articles/360007059792-Si...

You can disable the pin but disabling the pin does not remove the data they already collected and stored in the cloud. If you decide to never create a pin in the first place, a pin is generated for you and your data is still uploaded and stored in the cloud forever. see https://web.archive.org/web/20230616082821/https://old.reddi...

The data is avilable to anyone who brute forces the pin or uses an attack on SGX which has a history of being leaky.

Note that they have been refusing to update their privacy policy after adding all the cloud storage. The fact that they don't make it extremely clear where, when, and how they store such sensitive data in their privacy policy should tell you everything you need to know about how trustworthy they are. In fact, the very first line of the privacy policy says that the service is designed to never collect and store sensitive information which used to be true, but is now a lie.

It's a bad look for a service that advertises itself to whistleblowers, activists, and others whose lives and/or freedom depend on that information being safe. They should make it very clear to people what their risks are, but as it stands today Signal's website actually misleads them.

Re: Signal is working on a paid option to create an account without a phone number

#45

Post by inigyou »

mindslight wrote: post #12
tapoxi wrote: post #7

Earlier quoted context omitted.

We've had a lot of open systems and protocols, SIP, XMPP, Matrix, desktop Linux, Mastodon. It only gains adoption from the technologically savvy and fails to capture a regular user base. My mother, a 70 year old retired special education teacher, got me and my extended family (21 people) on Signal. I didn't tell her about it, I didn't encourage her to use it, I didn't step her through the process. She doesn't know ho…

This relies on an implicit idea that a system being closed is required for encouraging adoption, but without actually stating a concrete mechanism for that. One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal…

That's one mechanism, but another mechanism is what I said - an open system fragments too much, making it completely unapproachable. Or even within one "vendor" if they can't make up their mind about how it should work (i.e. if they can't be opinionated) it's just as bad as being fragmented.

Re: Signal is working on a paid option to create an account without a phone number

#46

Post by mindslight »

inigyou wrote: post #45
mindslight wrote: post #12

Earlier quoted context omitted.

This relies on an implicit idea that a system being closed is required for encouraging adoption, but without actually stating a concrete mechanism for that. One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal…

That's one mechanism, but another mechanism is what I said - an open system fragments too much, making it completely unapproachable. Or even within one "vendor" if they can't make up their mind about how it should work (i.e. if they can't be opinionated) it's just as bad as being fragmented.

If there is still one company pushing their own strongly opinionated client, how does having competing options available to power users detract from that? Like I'm not saying Signal-the-client should go away, rather that Signal-the-company who runs Signal-the-server could be accepting of third party clients, to the point where Signal was easily usable from F-Droid and whatnot. How would that undermine the mass market option?

Re: Signal is working on a paid option to create an account without a phone number

#47

Post by sylos »

slopinthebag wrote: post #37

I don’t understand the FUD and negativity I see about Signal on platforms like this. I’m not gonna argue that they are perfect but of all organizations involved in secure messaging I trust them the most. Their CEO appears sincere in her conviction for privacy and I see no reason to not trust them, at least to the extent you can trust any third party. And yet people seem to nitpick certain aspects of what they build w…

There's a lot of astroturfing and psyops that work against that want any efforts in these areas to "vibe" negatively

Re: Signal is working on a paid option to create an account without a phone number

#48

Post by lrvick »

Cider9986 wrote: post #29
pstuart wrote: post #19

Earlier quoted context omitted.

Is there an alternative out there that you do trust that is "noob friendly"?

You don't need an alternative. Signal is the best private messenger in terms of privacy and usability. SimpleX has more privacy and anonymity but has worse usability. Matrix has terrible metadata privacy and terrible usability.

> Matrix has terrible metadata privacy

Federated, can run server and have strong metadata privacy talking to your family but still talk to people on other servers publicly when you wish so you have choices to control your privacy as much as you wish.

> Signal is the best private messenger in terms of privacy and usability.

Requires proprietary operating systems, a phone number, and centralized US infrastructure where all network metadata lands in one place for much easier timing analysis. With MobileCoin, which was definitely something all users wanted and great messenger UX.

Right.

Re: Signal is working on a paid option to create an account without a phone number

#49

Post by lrvick »

slopinthebag wrote: post #40
lrvick wrote: post #14

Earlier quoted context omitted.

This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying…

I just want to point out that this comment is almost certainly a false flag “privacy conscious” personality who is attempting to discredit Signal to push people away from reasonable and usable private options towards a nihilist approach to privacy. If the usable solutions aren’t “truly” private you might as well stop caring and just use the more convenient alternatives which freely share all their data with governmen…

Rather than refute any of my points the best you could do is try to discredit me and say "No one listen to this heretic that has concerns with Signal!"

Re: Signal is working on a paid option to create an account without a phone number

#50

Post by inigyou »

mindslight wrote: post #46
inigyou wrote: post #45

Earlier quoted context omitted.

That's one mechanism, but another mechanism is what I said - an open system fragments too much, making it completely unapproachable. Or even within one "vendor" if they can't make up their mind about how it should work (i.e. if they can't be opinionated) it's just as bad as being fragmented.

If there is still one company pushing their own strongly opinionated client, how does having competing options available to power users detract from that? Like I'm not saying Signal-the-client should go away, rather that Signal-the-company who runs Signal-the-server could be accepting of third party clients, to the point where Signal was easily usable from F-Droid and whatnot. How would that undermine the mass market…

They do accept third party clients. They don't like it, but they don't have a choice, because they don't use device attestation.
Post reply on HN