Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

281–290 of 410 posts

Re: You can change your number

#281

Post by thaumasiotes »

godelski wrote: post #225
thaumasiotes wrote: post #218

Earlier quoted context omitted.

> There's also a third problem I don't care as much about but I'd assume Signal does. And that's naming collisions. NYT has a Signal number that allows whistleblowers to contact them. What's stopping me from creating the username NYT_Whistleblower and becoming a honeypot? That's easy; you want an internal identifier for Signal accounts that is unrelated to display name. This is already routine in most places includin…

> I don't understand how you think those two actions could be theoretically separated. Suppose Signal generates a one-click (or even temporary) link. I can share that link that'll connect. That can accomplish the same thing as a signal.me address. Onetime links are definitely a thing. I'm sure people that know more can share even more creative ways to accomplish this. Someone has to have some fancy ZKP method for ini…

> Seems you're passing the buck. Making it a "not my problem" issue and I think this is a big enough problem that it would make platforms like NYT wary of using such a system.

How? So you've got your account with a display name of "NYT_Whistleblower". Now... how does somebody else find it by accident?

Re: You can change your number

#282

Post by snowgrove »

I stopped using Signal, along with my adult tech-oriented friends, when we all had bad experiences migrating our accounts to new phones. That plus the phone number requirement, intrusive contacts integration, and the weird crypto side projects killed my interest in Signal entirely. My friends and I use Discord now.

Re: You can change your number

#283

Post by wolverine876 »

godelski wrote: post #199
gst wrote: post #177

Earlier quoted context omitted.

> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800...

Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.

> a global username identifier isn't anonymous (not any more than a phone number anyways)

A Signal username is global to Signal communication; a phone number is global to far more.

Re: You can change your number

#284

Post by theamk »

tptacek wrote: post #92
theamk wrote: post #54

Earlier quoted context omitted.

This decision seems pretty crazy to me, especially on the cell phones where a lot of apps require phone book access to function, and there is generally no way to give a different view to different apps. I understand that Signal wants to be blame it all on users, but the practical consequence of their design is that the moment people want to talk to a single person on Whatsapp, they give out Signal contact list to Fac…

Signal having the contact list means that they'd be subject to legal (and extralegal) process to obtain the entire contact list for everybody using the service, which is untenable for them. Again: Signal is not Discord or WhatsApp; these are different services with different primary objectives.

If one wants to avoid having contact list on server, they don't have to force everyone to use government issued and fully controlled identifiers. They can do local contacts storage, and use emails... or even random numeric identifiers (anyone remembers ICQ?).

I think novok is right in their uncle comment -- the decision to force people to use phone numbers, with all the related privacy problems, was to increase adoption. And we should be upfront on it: "Yes, Signal could have made things more private if they would allow usernames/emails/UINs... but instead they decided to force phone numbers to get market share as fast as possible. Yes, this means millions of people are forced to share the Signal contact list with Facebook and Google, but it was worth it -- look we have 40 million users now!"

There is nothing wrong with reducing user's privacy in order to get more market share. But let's not claim that this was for users' benefits.

Re: You can change your number

#285

Post by thaumasiotes »

godelski wrote: post #213
thaumasiotes wrote: post #206

Earlier quoted context omitted.

No, the problem your parent is referring to is that you have the same username in every chat. Discord really suffers from this.

Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that us…

> Edit: Lots of people are saying you can't share contact without revealing your identity. Does a 1-click link not solve this issue? If I post a signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g then I don't see how that would reveal my identity.

Well, if you're under attack, the 1-click link will reveal your identity to the first person to click on the link. But that's entirely different from what you're asking for, which is to reveal your identity to a specific person designated by yourself, regardless of who sees your link first.

The reason people are telling you you can't reveal your identity while staying anonymous is that those are opposite concepts. But if you're not trying to preserve your anonymity against the same person you want to reveal your identity to, you're on the much simpler problem of communicating in a way that is resistant to eavesdroppers. You don't need anything from Signal; you need an encrypted channel of communication with your counterparty.

Re: You can change your number

#287

Post by __MatrixMan__ »

runnerup wrote: post #89
advisedwang wrote: post #66

Earlier quoted context omitted.

Can you explain this a bit more? Am I correct in understanding that you feel it hurts you when your contacts find out that you have signal installed, hence why signal shouldn't do it? What is the impact of someone who has your phone number knowing you are available over Signal? Are there communities out there where someone being on signal is a red flag?

> Are there communities out there where someone being on signal is a red flag? Absolutely. Outside of the tech industry, people have a "reason" for using Signal. My wife remarked one day that one of her coworkers (a plant operator) suddenly appeared on Signal. I mused that he is probably cheating on his wife. She found out a few weeks later that my hunch was correct. Other people I've seen on it I've been able to ded…

You're not wrong, but if we care about privacy isn't that an association that we need to break? Wanting to live in a society where people can have secrets ought to be reason enough to use technology that keeps yours.

And then there's my mom, she's on a grandfathered mobile plan that charges her $1 every day that she sends any text messages. I got her on signal so she didn't have to pay the $1 when she texts me. She got her whole church music group to switch for the same reason.

Re: You can change your number

#290

Post by theamk »

caslon wrote: post #171
theamk wrote: post #59

Earlier quoted context omitted.

Question: do you use Signal? If yes, are you backing up/syncing your contact list? If yes, are you worried about Feds coming for your backup/sync provider?

If that happens, that's not a disastrous thing. That means one person reveals who they're talking to in general, not just on Signal. It doesn't mean that the millions of Signal users all lose that privacy. But no, I don't use Signal. I just think it's strange how some people can't seem to wrap their head around any of the rationale for this when it's the most transparent thing in the world. Do I like it? No, but it's…

I don't think you are getting it -- I am not talking about single user.

Whatsapp has 2 billion users, and they are pretty open that they upload entire user's phonebooks to Facebook-owned servers. We know Facebook is not worried much about privacy, so I am pretty sure that this data can be subpoenaed, sold and so on. If you care about privacy, you probably want to install something else, like Signal.

But you know what happens if you cannot get all of your friends converted at once, so you keep Whatsapp around? It will keep sending your contact list changes to Facebook, just at it is designed to.

Let me repeat this: you worry about metadata, so you want to chat to a friend via Signal. But the moment you add them, this is reported to all other apps including Facebook's Whatsapp. And there is no way to opt out of it.

How can people not notice this? How can any company call themselves "privacy friendly" and do this stuff?

Post reply on HN