Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

311–320 of 410 posts

Re: You can change your number

#311

Post by charcircuit »

dylan604 wrote: post #216
charcircuit wrote: post #140

Earlier quoted context omitted.

Yes, you can.

Are you really going to request that deletion after every single sensitive conversation? That seems dumb. Also, are those deletions tracked? Like, do they say User A requested their conversation with User B and User C be deleted so that Mr Fed can still see that A B and C had that conversation? There's just so so many places to get tripped up by keeping data rather than just routing bits and never storing them.

>Are you really going to request that deletion after every single sensitive conversation?

Just delete them manually then.

Re: You can change your number

#312

Post by scyzoryk_xyz »

scotty79 wrote: post #67

Why would supposedly secure communicator use actual phone number as identifier is beyond me. And everybody does that, either phone number or email. The only software I could find for anonymous communication was old Polish communicator http://gg.pl which uses arbitrary numbers as identifiers I understand that startups are scared that they won't be able to build up userbase from scratch but come on! Discord and Slack d…

Ah GG - your number with them used to be just as important as your phone number in Poland.

I remember looking into this a few years back and the only issue I found was that the company that owns it now itself wasn’t entirely trustworthy.

Re: You can change your number

#313

Post by eitland »

godelski wrote: post #199
gst wrote: post #177

Earlier quoted context omitted.

> I think the real question is what "usernames" will look like. There were hints dropped that this could be stronger than a typical username (like what HN has). Quite a bit of code related to usernames has already been checked into Signal. Here's the username regexp and the method that checks if a username is valid: https://github.com/signalapp/Signal-Android/blob/a5e5a735800...

Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.

This is one of several things that Google had sorted elegantly before shuttering Google+:

It was trivial to create multiple pseudonyms and the only one who could unmask it was Google and whoever could force Google.

This of course meant you had to trust Google but compared to having to trust everyone that is still a huge improvement.

Re: You can change your number

#314

Post by thaumasiotes »

godelski wrote: post #293
thaumasiotes wrote: post #285

Earlier quoted context omitted.

> Edit: Lots of people are saying you can't share contact without revealing your identity. Does a 1-click link not solve this issue? If I post a signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g then I don't see how that would reveal my identity. Well, if you're under attack, the 1-click link will reveal your identity to the first person to click on the link. But that's entirely different from what you're asking for…

> Well, if you're under attack, the 1-click link will reveal your identity to the first person to click on the link. That's true, but much easier to defend against. Since you can talk in a semi-synchronous manner and we can have a high _probability_ that the correct person will be be the one clicking on the link. So if it works: Godelski: Hey, let's chat on Signal, my link is signal.me/#one-time-code/jdjkerfe2r3rfwse…

> If it doesn't work:

> Godelski: Hey, let's chat on Signal, my link is signal.me/#one-time-code/jdjkerfe2r3rfwseffre5ge5g

> Thaumasiotes: Hey, link seems bad

Sure, that interaction degraded gracefully. But your identity was also permanently compromised; it doesn't make sense to focus on how easy it was for me to say "hey, that didn't work". The reason the link went bad is that you disclosed your identity to someone you were specifically trying to keep it a secret from. This is an unforgivable flaw in the protocol.

>> you're on the much simpler problem of communicating in a way that is resistant to eavesdroppers

> We already have that. It's called E2EE.

Well, no. E2EE is the answer to resisting one particular eavesdropper. What you're trying to get at is called "public key cryptography", the system whereby two strangers can establish a secure channel without relying on an already-existing secure channel. E2EE has nothing to say about establishing secure channels; it just refers to the concept of using one.

Here's the system you actually want:

Godelski: Hey, let's chat on Signal, what's your PGP public key?.

Thaumasiotes: My PGP key is yyyyy.

Godelski: [encrypted for yyyyy: Here's how you can find me on Signal]

But notice that Signal doesn't participate in this exchange. Nor can it. I'm not on Signal, as far as you know; your messages to me have to use some other medium.

Re: You can change your number

#316

Post by pseudalopex »

__MatrixMan__ wrote: post #184
gardnr wrote: post #175

Can I sign up without a number? Why does Signal require an identifier that is very difficult and perhaps illegal to make anonymous?

Signal stores your contact list on your phone (and not on their servers). Unlike other devices, people typically only have one active phone at any time, which means that your contact list on your phone can be your contact list on any linked device (its primary, they're secondary). If they didn't anchor to something that they knew you only had one of, then it's not clear which of your devices should be authoritative.…

Mobile telephone subscriptions passed global population 7 years ago.[1] More than 1 phone is not so unusual.

End to end encrypted messages are harder than end to end encrypted contacts. Using phone numbers encourages people to use their phone's contacts app. Most people have theirs connected to Google or Apple. If they have other devices especially.

[1] https://archive.fo/6je9z

Re: You can change your number

#317

Post by shp0ngle »

scotty79 wrote: post #67

Why would supposedly secure communicator use actual phone number as identifier is beyond me. And everybody does that, either phone number or email. The only software I could find for anonymous communication was old Polish communicator http://gg.pl which uses arbitrary numbers as identifiers I understand that startups are scared that they won't be able to build up userbase from scratch but come on! Discord and Slack d…

It's kind of easy - spam.

Spam protection is hard. Forcing to use phone numbers is a "easy" protection against spam. It's harder to get thousands of SIMs than thousands of usernames.

Re: You can change your number

#318

Post by shp0ngle »

toast0 wrote: post #38
mlissner wrote: post #15

This is fine, but signal still doesn't tell you when the person you're sending to has uninstalled signal. Instead, your messages go into ether and you think the person is ignoring you. It blows my mind they haven't prioritized this. https://github.com/signalapp/Signal-Android/issues/11164

Applications can't determine when they're uninstalled. Or, not reliably anyway, and not while following platform guidelines. So the question becomes how to tell uninstalled vs left in a drawer, powered down, while on vacation.

They can determine when did the user logged in last. Signal already tracks this.

Re: You can change your number

#319

Post by emptysongglass »

gnud wrote: post #227
hndamien wrote: post #193

Earlier quoted context omitted.

https://getsession.org/ Already does all of these.

I clicked around a bit trying to find out who creates and runs Session. And of course it's built by someone pushing a new crypto currency. That made me really really sad.

That's because it's essential to providing incentives to the operators of the nodes where messages pass through. I know it's fashionable to hate on crypto because crypto but please try and see it from a utilitarian basis.

Session has a lot of cool things going for it. They managed to solve the problems of P2P (high battery life number one) with these incentivised traffic passing nodes. They improved on TOR and you can already use the fruits of its invention for general traffic.

The big problem as I see it is the team is all Australian. They'll need to find a way to pass stewardship to the community in time.

Re: You can change your number

#320

Post by godelski »

eitland wrote: post #313
godelski wrote: post #199

Earlier quoted context omitted.

Yeah I'm a little upset about this. It is just set up for birthday problems. I'd be happy if it was you handing out a random string or 1-time code and then you pick a username per chat. But a global username identifier isn't anonymous (not any more than a phone number anyways) and I do not believe is a good solution.

This is one of several things that Google had sorted elegantly before shuttering Google+: It was trivial to create multiple pseudonyms and the only one who could unmask it was Google and whoever could force Google. This of course meant you had to trust Google but compared to having to trust everyone that is still a huge improvement.

Yeah this is in the poll what I call medium anonymity. Honestly I think this is a great step. Even if I don't trust Signal, it is a much better step than the weak anonymity stance.
Post reply on HN