Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

301–310 of 410 posts

Re: You can change your number

#301

Post by takeda »

TacticalCoder wrote: post #145
tgsovlerkhgsel wrote: post #133

Earlier quoted context omitted.

They're also critical to getting people to move from WhatsApp. Next time when Facebook pulls something user-hostile (e.g. monetization with ads, yet another privacy policy change for the worse, ...) some people will simply install Signal. If they use phone numbers as (an) identifier, two people who do this independently can immediately switch to Signal. If A convinces B to switch, and C convinces D to switch, B and D…

> Next time when Facebook pulls something user-hostile ... In my opinion with or without FB putting anything more hostile people are moving, in drones, to Telegram. I see regular people (non-tecchies at all) in my friends' circle joining Telegram regularly. I'm not saying TG is better than Signal but I think TG's userbase is many orders of magnitude bigger than Signal's.

That's because that's where many of the disinformation facebook groups went to, which is not surprising as Telegram is Russia owned.

Re: You can change your number

#302

Post by SailingSperm »

UncleMeat wrote: post #232
SailingSperm wrote: post #197

Earlier quoted context omitted.

How about no ph number and only UUIDs- You send a msg that only personA can decrypt - but you broadcast the encrypted message to all contacts /+ random UUIDs ... So signal doesn't know who it was intended for exactly, and only personA gets the information. Of course you'd want the app to only alert users getting the broadcast once a received comm is successfully decrypted, otherwise discard. It's clearly a lot higher…

> You send a msg that only personA can decrypt How are you going to do this without getting this person's public key? And how are you going to get their public key without asking signal?

Yes, signal would manage that. This is still more privacy preserving than a phone number because the the public key isn't attached to your identity in the way a phone number is. You'd still need to getAllContactsPubKey()->encr(PersonAKey)->SendToAllContacts

So signal knows you requested all your contact pubkeys, that you sent a duplicate broadcast to all contacts, obscuring who it was intended for... that could be 0-n of m persons.

Re: You can change your number

#303

Post by colordrops »

sa1 wrote: post #291
colordrops wrote: post #180

Earlier quoted context omitted.

What does being tied to a phone number have to do with avoiding storing data on their servers or SGX?

With a phone number, the contact graph can be on the phone. With usernames, the contact graph has to be stored on their servers. They were forced to store (encrypted) information on servers anyway, since client-side contact matching didn't end up scaling, which is why stuff like this and usernames are now being developed. Their new security strategy now relies on decryption being done by client-attested code on SGX e…

> With usernames, the contact graph has to be stored on their servers.

Are you suggesting that there isn't a contact graph on their servers? How exactly do they route from one user to another? It's certainly not P2P.

If you are suggesting that we should trust them just because it could work without them storing who I've contacted, you are mistaken. The whole point of private messaging is to obviate the need for trust. The code should be auditable/open source, and everything on the server should be either transparent, or assumed to be compromised. They certainly do send your contact graph to their servers, and whether they say they discard it or not is irrelevant. In the context of privacy, you must assume your data is persisted once it is behind a curtain you have no visibility into.

Re: You can change your number

#304

Post by tomcooks »

godelski wrote: post #211
scotty79 wrote: post #169

Earlier quoted context omitted.

My anonimity is huge contributing factor to my sense of privacy. I don't care if you seen my dick if you have no way of knowing it was mine.

I think the question of how to be anonymous is quite hard though. I wouldn't exactly call our usernames here anonymous.

You chose your username here and in most other places. You can even change it easily on many platforms. Your username doesn't require you to show your ID and have your calls tapped and traced towards your person.

Do you want me to continue?

Re: You can change your number

#305

Post by 3np »

thaumasiotes wrote: post #281
godelski wrote: post #225

Earlier quoted context omitted.

> I don't understand how you think those two actions could be theoretically separated. Suppose Signal generates a one-click (or even temporary) link. I can share that link that'll connect. That can accomplish the same thing as a signal.me address. Onetime links are definitely a thing. I'm sure people that know more can share even more creative ways to accomplish this. Someone has to have some fancy ZKP method for ini…

> Seems you're passing the buck. Making it a "not my problem" issue and I think this is a big enough problem that it would make platforms like NYT wary of using such a system. How? So you've got your account with a display name of "NYT_Whistleblower". Now... how does somebody else find it by accident?

Ever heard of typosquatting?

Re: You can change your number

#306

Post by dredmorbius »

wolverine876 wrote: post #283
godelski wrote: post #199

Earlier quoted context omitted.

Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.

> a global username identifier isn't anonymous (not any more than a phone number anyways) A Signal username is global to Signal communication; a phone number is global to far more.

Numerous widely-used identifiers were originally scoped narrowly.

Scope tends to widen.

Re: You can change your number

#307

Post by godelski »

tomcooks wrote: post #304
godelski wrote: post #211

Earlier quoted context omitted.

I think the question of how to be anonymous is quite hard though. I wouldn't exactly call our usernames here anonymous.

You chose your username here and in most other places. You can even change it easily on many platforms. Your username doesn't require you to show your ID and have your calls tapped and traced towards your person. Do you want me to continue?

> Do you want me to continue?

Yes actually.

The problem I'm seeing here with the responses is that people are only thinking of "one move." That first move is creating a anonymous username. Yay. Easy. Now here's the problem. How do I share that while staying anonymous? What conditions do I need? If I can only have one username for all of Signal, does that create a bigger problem? There's a few more "moves" for you and these are what I'm looking for answers to.

Re: You can change your number

#308

Post by 3np »

grawprog wrote: post #222
godelski wrote: post #213

Earlier quoted context omitted.

Actually there are two main problems I'm referring to. You identified one of them. If I want to stay anonymous, I'm really asking how to compartmentalize chats and groups of people. We have different identities with different groups and use different names with them. The other problem is actually the act of sharing a username. If my username is "godelski" then yeah, I can share it on HN and Reddit where I use that us…

There's always going to be tradeoffs when you're dealing with online anonymity. On the far anonymous end you've got 4Chan style anonymity, no permanent or any ID at all. Keeping track of individual people is nearly impossible. Conversations are chaotic and hard to follow. Pretty solid privacy. I guess the next step up would be per conversation/thread/group whatever ID, you trade a small amount of privacy for improved…

Also worth explicitly mentioning SSB-style cryptographic “implicit identity”.

Connecting consists of exchanging public keys (which can be global per person, or compartmentalized per contact/conversation).

Rather than a central server relating messages to the right peers, there’s a global feed where you attempt to decrypt everything and the ones which succeed are obviously addressed at you.

The benefit here is that not even a central server operator like Signal can trivially tie messages or chat identities to peers.

Re: You can change your number

#309

Post by dathinab »

advisedwang wrote: post #66
yusmary wrote: post #45

All that is cool, but I don't want Signal to advertise my presence to anybody that has my phone number when I first log in after a fresh install. I have only a handful of people that know and we negotiated that face to face prior, Signal breaks that trust

Can you explain this a bit more? Am I correct in understanding that you feel it hurts you when your contacts find out that you have signal installed, hence why signal shouldn't do it? What is the impact of someone who has your phone number knowing you are available over Signal? Are there communities out there where someone being on signal is a red flag?

Like people you don't want to have contact with but have your old number being remained that you exists and starting to annoy or harasser you again.

And pleas don't respond with "you could just block them" that not in line with how the psych of many, especially vulnerable people work.

Also pleas don't respond with "you can just change your number", for many people changing their number is hard which again for some vulnerable people can mean it's basically impossible.

Sure it's not a "my whole live will be messed up because of it" feature, but it easily can be very very unpleasant.

Like as an harmless example I know someone who completely changed their live and do not really want to have contact with anyone from their old circle of friends (not because of them being bad people, but because of the memories this includes). But they are to polite and insecure to outright block them, similar changing the number isn't an option for them. And guess what happened recently Signal told me: Hy person X joined Signal. I knew better then to contact them, but I wouldn't be surprised if this caused them quite a bit of distress/discomfort.

Anyway, I'm fine that people which have my number can write me over signal, or that their app knows when the number is changed, to warn if the old number is used and hint at you when you try to contact the old number. I'm not happy about Signal (and others) actively telling everyone "Hy this person did [join|change number]". It's unnecessary and for some people harmful.

Re: You can change your number

#310

Post by charcircuit »

psanford wrote: post #241
wolverine876 wrote: post #152

Earlier quoted context omitted.

How is Discord more convenient? I don't mean the question critically, but I wonder what a sophisticated user sees in Discord when Signal seems, to me, as convenient as texting and calling.

Discord has your full chat history in a conveniently searchable server side database. When new people join a channel in your discord server, they call see the full chat history so they can get fully caught up. You can use discord on multiple devices at the same time without the devices needing to directly sync with each other (because the state is stored on the server).

>When new people join a channel in your discord server, they call see the full chat history so they can get fully caught up.

FYI there is a permission to disable this for a channel

Post reply on HN