11–20 of 512 posts
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
To replace the numbers with usernames, Signal users would have to either give up contact lists altogether (at which point nobody would use the service), or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available to a state-level adversary.
Earlier quoted context omitted.
How do you deal with spam without requiring a phone number to register?
One option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.
That also sounds like a good way to limit adoption as well, at least for anyone with more the N contacts, particularly >= 2N as that means likely a minimum waiting period before you can transfer over "more" contacts since some people will never accept/reject the invite because they don't use the app much.
If it were me and I had to wait on others to accept or reject my invite before I can continue transferring contacts, I'm gonna move on.
Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
>Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered. I wonder if this was a curious attacker trying to see what they could do with their access, or a targeted attack.
"...Twilio, the company that provides Signal with phone number verification services..." Perhaps this is why Twilio (and Twilio-issued) VoIP numbers work so well for Signal when I don't want to use the number issued by my cellular carrier? Kinda hard to SIM-swap me if you don't know my real phone number.
So that means for the duration of the attack active contacts and groups were exposed?