Please, stop using phone numbers. There is no reliable way to hold a phone number. The messaging protocols are insecure. If your service uses phone numbers or SMS, that means it's not secure or reliable.
Twilio incident: What Signal users need to know
21–30 of 512 posts
Re: Twilio incident: What Signal users need to know
#22Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
[deleted]
Re: Twilio incident: What Signal users need to know
#23So that means for the duration of the attack active contacts and groups were exposed?
No. When you sign up to Signal, they send you a text message verification code. This is done via a service called "Twilio."
The attackers were able to view outgoing Twilio messages, so they could enter your number on the registration screen, read the code that Twilio sent to you, then use that cod to complete the sign up process.
Attackers were not able to view information about your current Signal account (if present) through this SMS service.
Re: Twilio incident: What Signal users need to know
#24Earlier quoted context omitted.
How do you deal with spam without requiring a phone number to register?
Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up…
> It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers.
This makes sense for contact discovery, which is important for normal people who just want a chat app that works.
But there are a very important segment of signal users, people with an elevated threat model, who I would be willing to bet a good portion of them would gladly sacrifice contact lists if it meant not having to share their phone number.
Re: Twilio incident: What Signal users need to know
#25Re: Twilio incident: What Signal users need to know
#26Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.
It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but requires Signal to keep a database of contacts serverside. That's untenable for Signal's threat model.
Re: Twilio incident: What Signal users need to know
#27Earlier quoted context omitted.
How do you deal with spam without requiring a phone number to register?
Who is dealing with the spam SMS messages I get all year round? Phone numbers do not stop spam, they are used to distribute it. I know I received no spam when I had Google Talk... It is a solvable problem that I guess benefits nobody in power to solve.
Spam is one of the major reasons people don’t use sms. “The product Were replacing sucks so our product can suck too”
Re: Twilio incident: What Signal users need to know
#28"...Twilio, the company that provides Signal with phone number verification services..." Perhaps this is why Twilio (and Twilio-issued) VoIP numbers work so well for Signal when I don't want to use the number issued by my cellular carrier? Kinda hard to SIM-swap me if you don't know my real phone number.
Do they offer numbers you can use that way or do you just use their APIs with a minimal app?
I spin up a number and verify it can receive SMS (which it forwards to me via email). Since I need receive-only, this is fine. No need to futz with APIs or apps.
Re: Twilio incident: What Signal users need to know
#29Earlier quoted context omitted.
How do you deal with spam without requiring a phone number to register?
Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up…
> or allow Signal to keep a serverside database of contacts ready at all times for users who log in. This is what other messaging services do, and the result is that the servers have a plaintext log of who talks to who on their service, which is the most valuable information a secure messaging service can make available
Why couldn't they just keep using the current system, alongside usernames, for phone number contact discovery? Of course for those who opt into it; imo that's what it should be.
Re: Twilio incident: What Signal users need to know
#30Earlier quoted context omitted.
How do you deal with spam without requiring a phone number to register?
Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up…
Users having to add their contacts each time they set Signal up on a new phone, should the app keep its own client-side contact book, doesn't sound like hassle.
Could you please explain how Signal does not have a social network map, when 1) user accounts are equal to mobile phone numbers, and 2) Signal servers route messages between user accounts.