251–260 of 410 posts
It would be nice if it didn't require a phone number. My daughter doesn't have a phone, but I would still like to use Signal with her when she's on a wifi-connected iPad.
Regarding your specific issue: You could get your daughter a VOIP number, which can run as an app on the iPad. VOIP numbers can process text messages too, which should enable Signal's confirmation message.
Earlier quoted context omitted.
> AFAIK, it prompts at first, maybe a few times, but then stops. It's been re-prompting me for years. If there's a time it stops, I haven't found it. > I am not sure how Signal backups work or that user contacts, encrypted, are backed up to the SGX enclave. Where does it say that? You're talking about backups. I'm talking about contact-discovery, wherein the client regularly sends (hashed versions of) all the phone n…
Could you provide documentation of that version of how Signal operates? You can see the links from Signal and Matthew Green that I supplied. > I'm talking about contact-discovery, wherein the client regularly sends (hashed versions of) all the phone numbers from your contacts (if you've shared them with the app) to Signal's servers If they are hashed, why do you need to trust anyone?
Note it relies on SGX for privacy. (Anything they did earlier may have involved even more trust of Signal Inc's servers.)
Hashes across the (tiny!) space of all phone numbers are easy to reverse via brute-force.
But also, again: how do you think Signal is able to notify you when any phone number in your contacts – even if you're not in theirs! – first joins Signal?
Earlier quoted context omitted.
Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that us…
> Alternatively, if I have a username "not_godelski" then how do I get in contact with someone on HN while maintaining anonymity? You can't, and I don't think that's a surprising outcome. If you have a non-anonymous identity on one platform, and link it to your anonymous identity on another, then that latter identity is no longer anonymous. You just can't really mix your anonymous and non-anonymous worlds without de-…
Earlier quoted context omitted.
Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that us…
> Alternatively, if I have a username "not_godelski" then how do I get in contact with someone on HN while maintaining anonymity? You can't, and I don't think that's a surprising outcome. If you have a non-anonymous identity on one platform, and link it to your anonymous identity on another, then that latter identity is no longer anonymous. You just can't really mix your anonymous and non-anonymous worlds without de-…
Earlier quoted context omitted.
https://getsession.org/ Already does all of these.
I clicked around a bit trying to find out who creates and runs Session. And of course it's built by someone pushing a new crypto currency. That made me really really sad.
Earlier quoted context omitted.
FWIW, Signal can send SMS to a regular number on Android. https://support.signal.org/hc/en-us/articles/360007321171-Ca...
Thanks for the reminder. The idea was to use signal with a degoogled phone. It would be great if signal could send SMS without the cell network. There are places and devices, without cell connections.
Something like Google Fi can provide a web-based client for your SMS (which works on any device and doesn't require cellular) because they know your virtual SIM and can emulate it as needed. But I don't see how Signal could pull that off.
Earlier quoted context omitted.
I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). I took a poll on reddit[0][1] to see what people wanted. I was rather surprised at how many wanted strong anonymity. I expected that the top choice would be the weak anonymity, where people just have an alternative to phone numbers. But I think if that's what S…
> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800...
Earlier quoted context omitted.
Signal started off as a secure SMS replacement. Also, they mainly used numbers so they could leverage the social graph of phone contact lists. That way they didn't need to store any social graphs on their systems.
They must store something to route messages. Graph of random numbers is even better than the graph of actual numbers. They just wanted to piggyback on already existing network of people contacts. Standard startup "growth hack".
It is early stage, but there is now an alternative to Signal that doesn't use phone numbers at all: https://xx.network/messenger/ While you can add your number to be searchable by others, it doesn't let strangers with your number know you signed up automatically, either. Full disclosure: I work on the infrastructure behind it.
Became significantly less interested when I saw it had a cryptocurrency attached.
As an example, one of the next applications I am working on with it is voting (a continuation of my PhD research). You can do things with this that you can't do anywhere else because you've got hundreds of untrusted, uninterested nodes, changing the threat model in a very important way. Unfortunately, I'm not aware of any other way to incentivize that without some form of payment system, which is why it is intrinsic to this chain.
It is fundamental to safe and fair commerce to be able to not be tracked in the ways we care about folks not being tracked. I want to do things like read my news subscription without them being a data vampire that tracks how long my eyes hover over each paragraph of every story then sells that to some advertiser. I also don't want my credit card company selling my purchase history to some government that then uses that information to decide if I am allowed to enter their country 15 years from now.
In other words, the project is not trying to be a slower, less private version of a credit card. We do not want to be just another privacy coin or utility for some pre-existing internet service and, unlike other mixnet projects, our goal is a much more ambitious resistance to global adversary threat model. We want to enable folks to do things over the internet with similar properties and experience as buying milk from the corner store with real money. We might not get there, but that's my vision for what we are trying to achieve.