Anyone have information about how/where they get their funding and/or income?
Looking back at how Signal works
41–50 of 301 posts
Re: Looking back at how Signal works
#42> how we think about concepts like privacy, security, and trust I was disappointed to see that a mobile number is needed and that this number is shown by default in groups. Mobile numbers are much more trackable then email addresses in my opinion. And I do not understand at all why others should be able to see them so easily. So I now prefer Telegram because at least it hides numbers in groups by default.
> a mobile number is needed
They're laying the groundwork to change this. Part of the purpose of the PINs rolled out last month is to enable centralizing some data to allow for other addressing schemes.
Re: Looking back at how Signal works
#43Earlier quoted context omitted.
Burner sim to setup and throw away addresses this concern. Telegram, messages in plaintext on the server? Encryption that isn't open? Yeah telegram is a bit of a non-starter if you have these kinds of concerns as far as I'm aware.
Don't you have to keep paying for the sim, otherwise someone else might "steal" your account once your phone number gets reused?
Yes, and I'm tired of hearing "burner sim" thrown around as a solution whenever some company stupidly demands a phone number. Getting a burner sim is WAY more effort than I'm prepared to expend to sign up to some service.
Stop asking for phone numbers!
My mother has my phone number. A few of my closest friends and family have it. That's it. I have like 10 actual people on my phonebook. My phone provides immediate 24/7 access to me, and there are very few people who are close enough to me that I want to be able to reach me at any time.
Some Silicon Valley company with an inflated sense of importance is never on that list...
Re: Looking back at how Signal works
#44Earlier quoted context omitted.
If that’s the case doesn’t it matter even less that signal requires it since it’s already known anyway? Signal’s use of phone numbers as IDs means they don’t have to have any of your contacts sent to their servers. As shown in the article they have no metadata and nothing to reveal beyond your phone number and when you signed up. These other apps send your social graph to their servers, track and store metadata, don’…
Assuming you’re using Signal for organizing something the government doesn’t want you organizing, if one member of the group gets rubber-hosed into unlocking their phone, the govt instantly gets a list of verifiably correct names of people involved. In contrast, with a service that lets you use usernames that maneuver would reveal nothing but those usernames (which are as pseudonymous as it gets).
Thanks - the concern makes sense to me given that context.
Re: Looking back at how Signal works
#45I love Signal and use it as much as I can, but I'm thinking of switching to Matrix solely because the desktop client is pretty bad. It won't show me messages until it syncs everything (so I can't even see old messages while things sync), and, what's worse, it skips messages, and multi-device just doesn't work. My laptop just shows "Message could not be decrypted" until I delete everything and reset.
I'm not sure why it works so poorly after years of existence, but unfortunately I'm losing hope that it'll be fixed. I sometimes feel like the Signal team doesn't use their product, or they would have noticed this. Meanwhile, yes, Matrix took years to add encryption, but it works much better than Signal, even with quite a few small bugs.
Re: Looking back at how Signal works
#46What happens to Signal when the EARN It Act passes? I assume that eventually the Apple App Store and Google Play Store will just stop allowing it to be downloaded if they do not add the backdoor in? Is there a workaround that will allow people to use it still? I've heard people mention locating the servers in other countries, but wouldn't the various App stores be bound by US law and still not allow them?
> the Apple App Store and Google Play Store will just stop allowing it to be downloaded Time for a privacy focused app store!
at least on Android you can sideload it
Re: Looking back at how Signal works
#47Anyone have information about how/where they get their funding and/or income?
Donors and grants.
Re: Looking back at how Signal works
#48The only reason I don't use Signal is because it still uses your phone number for ID. What is even the point of verifying by number?
I suspect you are massively outnumbered by people who do use it because it integrates with their existing phone book, and is a drop-in replacement for the default SMS app. Without those things it'd be just another niche app for weird nerds.
there is a difference between making it possible to use phone numbers and making it a hard, unavoidable requirement.
Re: Looking back at how Signal works
#49I love Signal and use it as much as I can, but I'm thinking of switching to Matrix solely because the desktop client is pretty bad. It won't show me messages until it syncs everything (so I can't even see old messages while things sync), and, what's worse, it skips messages, and multi-device just doesn't work. My laptop just shows "Message could not be decrypted" until I delete everything and reset. I'm not sure why…
> Meanwhile, yes, Matrix took years to add encryption, but it works much better than Signal, even with quite a few small bugs.
I'm not sure which Matrix client you use, but clients like Riot don't even let you opt out of sending read receipts unless you edit `/etc/riot/config.json` to enable experiments and then go into the settings to disable read receipts. Problems like this (and issues like this [0]) give me the impression that Riot isn't designed for people who need privacy.
(Yes, there are other Matrix clients [1], but my understanding is that Riot is the flagship interface.)
Re: Looking back at how Signal works
#50Earlier quoted context omitted.
> roll their own cryptography Signal did the same thing. They invented their own cryptographic algorithms. https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm And the social graph IS sent to servers by Signal. It's protected only by hashing (trivial to circumvent) and by the Intel SGX technology (a bit harder to circumvent, but I doubt that the US govt can't do it).
My (limited) understanding is numbers are queried to see if accounts exist, but those queries are not connected to the users sending them (and they are obscured in transit). Am I wrong? Signal’s cryptography has also gotten a ton of attention, I don’t think the same is true for competitors.
Transit encryption is employed by other services as well. Whether there is de-correlation on the cloud backend I don't know. Maybe there is, but you can't really verify that and it's easy to correlate them again, especially if clients use ipv6 or non-CGNAT ipv4.