211–220 of 367 posts
Signal exposes the user's phone number, better alternative is to use burner phones or Telegram.
Telegram doesn't have encryption for groups though.
Earlier quoted context omitted.
That doesn't change the fact that all phone numbers are visible to all group members. All it takes is one rogue participant to reveal the identities of all members. If that actor has access to triangulation data they now have identity, location history, words and possibly images/video.
Yeah, it's optimized for communication between trusted parties (e.g. Snowden and a journalist) - as such the focus is on verifying the identity of the other person, not hiding it. It'd be cool if they figured out a group chat setting that was optimized for groups like protesters trying to coordinate - show your identity only to users you are directly connected with/have verified/whitelisted, but hide your identity to…
Earlier quoted context omitted.
Using phone number as ID has been proven idiotic since forever now. As much as I like Signal this is such a design flaw that it makes their software not only untrustable but often unusable too. What's wrong with email logins?
I'm no expert on the subject, but probably the use of phone numbers (and confirmation by SMS) is helpful to limit the number of bots.
Personally I liked the way ICQ did it back in the day, they used a uniq ID just for their service decoupling it from a phone number.
If Signal wanted to avoid long numbers, they could use a CorrectBatteryHorseStaple approach which is what Xbox does for their usernames if you don't pick one.
Easier to remember,
Signal exposes the user's phone number, better alternative is to use burner phones or Telegram.
Or an open standard like Matrix
Earlier quoted context omitted.
> Signal DOES NOT get your full contact list The full contact list is uploaded to Signal servers by the phones. The only protection layer that users have is the questionable security of Intel's SGX. It's still much better than what WhatsApp is doing, just not a black and white situation. To add a point to your list: Signal does not have automatic cloud backup of messages, unlike WhatsApp. On WhatsApp, 30% of users ha…
Do you have a reference for the claim that your full contact list is uploaded to servers? That seems important since their privacy policy says that they only use hashes, and it can’t be dependent on SGX since it runs on non-Intel hardware: https://signal.org/legal/#privacy-policy
I say theoretically because these schemes all have a core problem when they're not federated - you have no idea what your client is really doing and it's the client performing remote attestation with the enclave. You have no control over it. It could update tomorrow and switch every last bit of encryption off. Or it could do RA but not pin the enclave hash to anything audited (i.e. it accepts any enclave signed by Signal).
It's not a theoretical problem. Facebook say that WhatsApp is end to end encrypted, in the same way as Signal. That didn't stop them blocking people from forwarding links related to coronavirus. The literal and entire point of E2E cryptography is to stop them monitoring and interfering with people's communications, Facebook have been assuring governments for years they're powerless to do that, but of course the moment Facebook wanted to fight "misinformation" it all went out the window.
Fundamentally Signal and WhatsApp can never provide meaningful encryption or privacy. They don't allow alternative clients, so regardless of how much code they throw into the mix they control the entire pipe end to end and can just as easily switch it off again. And the moment their employees feel they have a sufficiently good motivation, it'll happen again.
Earlier quoted context omitted.
The method is explained here: https://signal.org/blog/private-contact-discovery/ Yes, it's hashes of phone numbers instead of the phone numbers themselves, but that's a detail. Phone numbers are easy to brute-force especially for people the protesters are worried about, as well as easy to build rainbow tables for.
I think you might want a better way of phrasing that: it’s not the “full contact list” - most people would assume that includes names and all of the other metadata - and since it’s rate-limited there’s an interesting trade off where it’s not easy to brute-force but it is targetable if you are trying to track specific known people.
Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck.
Has anyone here successfully convinced their non-techie friends to switch to Signal? How have you done it? I've been trying on and off with my closest friends, but no luck.
Earlier quoted context omitted.
Signal is not only used by protesters[0][1] so discovering that a phone number is connected to a Signal account by no means implies that the phone is used by a protester. [0]: https://www.militarytimes.com/flashpoints/2020/01/23/deploye... [1]: https://www.theguardian.com/politics/2019/dec/17/tories-swit...
The point made by the parent commenter was that you can join any group (if you get someone to invite you) related to a certain topic and get the phone numbers of everyone in that group. I am not sure about the situation in the US, but in Europe almost all phone numbers are directly linked to a certain person and address by the provider.
One of the points which, yes, I agree with, but I mainly responded to this:
> I can add phone numbers by enumeration into my contacts and Signal will show who among my contacts is on it.\
> I am not sure about the situation in the US, but in Europe almost all phone numbers are directly linked to a certain person and address by the provider.
Or you can go to a corner shop and buy a Lyca or Lebara SIM with cash. No need to give them your address. You can buy top ups in cash as well. At least in Western Europe this is available everywhere, pretty much.
(I'd still prefer if Signal didn't require phone number to sign up though.)