Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

291–300 of 410 posts

Re: You can change your number

#291

Post by sa1 »

colordrops wrote: post #180
sa1 wrote: post #56

Earlier quoted context omitted.

On the contrary, they started out with phone numbers so that they could avoid storing user data on their servers. The whole plan to finally have usernames comes down to their use of Intel SGX.

What does being tied to a phone number have to do with avoiding storing data on their servers or SGX?

With a phone number, the contact graph can be on the phone. With usernames, the contact graph has to be stored on their servers.

They were forced to store (encrypted) information on servers anyway, since client-side contact matching didn't end up scaling, which is why stuff like this and usernames are now being developed.

Their new security strategy now relies on decryption being done by client-attested code on SGX enclaves, so that the server still doesn't have access to the plain-text contact graph.

All of this took a huge amount of time to come up with, and you can see the progress if you read their blogs or forums.

Re: You can change your number

#293

Post by godelski »

thaumasiotes wrote: post #285
godelski wrote: post #213

Earlier quoted context omitted.

Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that us…

> Edit: Lots of people are saying you can't share contact without revealing your identity. Does a 1-click link not solve this issue? If I post a signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g then I don't see how that would reveal my identity. Well, if you're under attack, the 1-click link will reveal your identity to the first person to click on the link. But that's entirely different from what you're asking for…

> Well, if you're under attack, the 1-click link will reveal your identity to the first person to click on the link.

That's true, but much easier to defend against. Since you can talk in a semi-synchronous manner and we can have a high _probability_ that the correct person will be be the one clicking on the link.

So if it works:

Godelski: Hey, let's chat on Signal, my link is signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g

Thaumasiotes: Great!

If it doesn't work:

Godelski: Hey, let's chat on Signal, my link is signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g

Thaumasiotes: Hey, link seems bad

While you're right that there are no guarantees, I don't think that's true for any system. There's only probabilities. Obviously there are other ways to do this along the same lines. I can have a global link that has infinite links (e.g. one I could place under my HN profile) that I can only have there. These strings are much easier to generate than usernames given that with higher entropy you don't have the same likelihood of a birthday clash.

I'm not saying that communicating without revealing your identity isn't a challenging problem. But there are clearly some versions that reveal _more_ than others. Maybe there's no perfect system (I'm not smart enough to know) but there's clearly better ones than others. Standard usernames seems to just be throwing your hands up and giving up.

> you're on the much simpler problem of communicating in a way that is resistant to eavesdroppers

We already have that. It's called E2EE.

Re: You can change your number

#294

Post by godelski »

thaumasiotes wrote: post #281
godelski wrote: post #225

Earlier quoted context omitted.

> I don't understand how you think those two actions could be theoretically separated. Suppose Signal generates a one-click (or even temporary) link. I can share that link that'll connect. That can accomplish the same thing as a signal.me address. Onetime links are definitely a thing. I'm sure people that know more can share even more creative ways to accomplish this. Someone has to have some fancy ZKP method for ini…

> Seems you're passing the buck. Making it a "not my problem" issue and I think this is a big enough problem that it would make platforms like NYT wary of using such a system. How? So you've got your account with a display name of "NYT_Whistleblower". Now... how does somebody else find it by accident?

I'm sure you can be creative enough where you can read between the lines and determine a valid username that is a near clash and someone might accidentally use that name instead.

Re: You can change your number

#295

Post by Godel_unicode »

crossroadsguy wrote: post #257
gst wrote: post #177

Earlier quoted context omitted.

> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800...

It is unfortunate that they seem to be going for user created username. I’d rather have something like ~hkopy-vnhyt randomly generated and given to users with option to try for another randomly generated username if they didn’t like the first.

Nobody is stopping you from doing that for yourself.

Re: You can change your number

#296

Post by godelski »

rcarback wrote: post #265
godelski wrote: post #207

Earlier quoted context omitted.

I also don't see usernames as really being that anonymous. Like even if I make a username there that's "notgodelski" if I share that username here on HN then I haven't done anything to keep myself anonymous. All it does is trades one PII for another (phone number for username). I'm also curious about scaling and collisions. Not only do you have a birthday problem with normal usernames, but what about special classes?…

Agreed that usernames aren't exactly anonymous, which is why the platform doesn't require one to use and you can share your QR Code directly instead. I think the mobile apps might force registration with user discovery (this is an active argument i've been having...) but it's not designed to be required. It's not fully baked, but my expectation is that it will work similarly to how the .eth, namecoin, and other syste…

> and you can share your QR Code directly

That's a useful feature. Others (above) are telling me this is useless (I disagree). Are these identities separate?

The discovery service sounds useful

Re: You can change your number

#297

Post by brewdad »

crossroadsguy wrote: post #268
odjebioff wrote: post #219

Earlier quoted context omitted.

Try Threema then, they don’t require email nor phone

One fundamental problem with messaging apps is that you need other people you want to connect to to be using that app. Decentralisation and all that - again, other people.

This was why I started using Signal in the first place. I could replace my SMS app with Signal and immediately gain the advantages it offers for my friends that were also on it or willing to switch. Over time, more have switched to it and the network grows but I don't miss out with those who won't switch for whatever reason.

Re: You can change your number

#298

Post by [deleted] »

runnerup wrote: post #89
advisedwang wrote: post #66

Earlier quoted context omitted.

Can you explain this a bit more? Am I correct in understanding that you feel it hurts you when your contacts find out that you have signal installed, hence why signal shouldn't do it? What is the impact of someone who has your phone number knowing you are available over Signal? Are there communities out there where someone being on signal is a red flag?

> Are there communities out there where someone being on signal is a red flag? Absolutely. Outside of the tech industry, people have a "reason" for using Signal. My wife remarked one day that one of her coworkers (a plant operator) suddenly appeared on Signal. I mused that he is probably cheating on his wife. She found out a few weeks later that my hunch was correct. Other people I've seen on it I've been able to ded…

[deleted]

Re: You can change your number

#299

Post by runnerup »

__MatrixMan__ wrote: post #287
runnerup wrote: post #89

Earlier quoted context omitted.

> Are there communities out there where someone being on signal is a red flag? Absolutely. Outside of the tech industry, people have a "reason" for using Signal. My wife remarked one day that one of her coworkers (a plant operator) suddenly appeared on Signal. I mused that he is probably cheating on his wife. She found out a few weeks later that my hunch was correct. Other people I've seen on it I've been able to ded…

You're not wrong, but if we care about privacy isn't that an association that we need to break? Wanting to live in a society where people can have secrets ought to be reason enough to use technology that keeps yours. And then there's my mom, she's on a grandfathered mobile plan that charges her $1 every day that she sends any text messages. I got her on signal so she didn't have to pay the $1 when she texts me. She g…

Why does it need to tell everyone I have a Signal account?

Adobe doesn't tell everyone that I own Photoshop. Gmail doesn't tell everyone that I have a Gmail email. PornHub doesn't tell everyone that I subscribe to their premium account.

Why the fuck does Signal need to? Broadcast should be off by default, on by opt-in.

Re: You can change your number

#300

Post by Talanes »

recursive wrote: post #208
charcircuit wrote: post #139

Earlier quoted context omitted.

I don't even have my friends' phone numbers. If I want to call a friend I do it on my desktop using Discord. Before like 2016 we would call using Skype instead.

It's been a while since I had a friend I was regularly communicating with, so I have no idea how normal this is. But it is totally foreign to me.

I'm turning 32 this year, and I've honestly never used phone calls as a way to talk with my friends (outside the quick calls that texting replaced.) When I changed my phone number a few years back I told like 5 people, all family.

We had AIM and message boards pretty early, but no dedicated phone lines. By the time cell-phones became ubiquitous, we had cars and could just actually hang out. And by the time we all moved apart, voice chat services were good enough to just hop back to the old chat model.

Post reply on HN