Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twilio incident: What Signal users need to know

support.signal.org

Post reply on HN
Print view View original

31–40 of 512 posts

Re: Twilio incident: What Signal users need to know

#31

Post by tjoff »

tptacek wrote: post #15
colinmhayes wrote: post #5

Earlier quoted context omitted.

How do you deal with spam without requiring a phone number to register?

Signal doesn't ask for phone numbers simply to combat spam; the phone number isn't an elaborate captcha. Rather, as this article repeatedly points out, Signal doesn't keep your contact lists and other data available to its servers. It uses phone numbers because phones already have contact lists, stored clientside, keyed by those numbers. To replace the numbers with usernames, Signal users would have to either give up…

You forgot the part where joining signal "conveniently" discloses that to everyone - with no way to opt out(!).

Also, everyone not sharing their contacts with the signal app already have that UX. Minus the privacy benefits of course.

Re: Twilio incident: What Signal users need to know

#32

Post by daneel_w »

tptacek wrote: post #26
daneel_w wrote: post #17

Earlier quoted context omitted.

I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.

It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but re…

The sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone.

Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm sure.

Re: Twilio incident: What Signal users need to know

#33

Post by potatototoo99 »

tptacek wrote: post #26
daneel_w wrote: post #17

Earlier quoted context omitted.

I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.

It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but re…

Why would contacts need to be saved though? If I change my phone, I expect my contacts will be copied in some manner, and they'll be available on the new phone. Why would a messaging app need a persistent social network of contacts?

Re: Twilio incident: What Signal users need to know

#34

Post by tptacek »

daneel_w wrote: post #32
tptacek wrote: post #26

Earlier quoted context omitted.

It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but re…

The sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone. Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm…

That's a good way to build a secure messaging app nobody ever uses.

Re: Twilio incident: What Signal users need to know

#35

Post by croes »

rt4mn wrote: post #8
colinmhayes wrote: post #5

Earlier quoted context omitted.

How do you deal with spam without requiring a phone number to register?

Give people the option to pay. I would gladly pay $100 one time fee if it meant I could avoid having a phone number associated. https://jmp.chat is a great work around but I would rather just have an email address or ideally nothing but a receipt directly associated with my signal account.

Isn't email even worse for security?

Re: Twilio incident: What Signal users need to know

#37

Post by input_sh »

dylan604 wrote: post #7
AdmiralAsshat wrote: post #3

Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?

which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?

They mention it, use registration lock: https://support.signal.org/hc/en-us/articles/360007059792-Si...

Basically if someone tries to register to Signal with your phone number they'll need to enter that PIN Signal consistently reminds you of.

Re: Twilio incident: What Signal users need to know

#38

Post by teraflop »

tptacek wrote: post #26
daneel_w wrote: post #17

Earlier quoted context omitted.

I've been complaining about the glaring privacy/integrity problem in their SMS-based account verification scheme for years. I don't think any snafu can make them reconsider. It would forfeit the valuable social network mapping they've already poured millions of dollars into through sending verification SMSes.

It's not so much "valuable social network mapping" as it is "the only social network available to Signal", by design. Without phone numbers, they can't use clientside contact lists (they can build their own, of course, but if it's strictly clientside it won't sync, and so it won't work for most of their users). The alternative design, which HN would wildly prefer, admits to usernames or email address accounts, but re…

After countless discussions of Signal on HN, I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list. Surely, in either case the identifier can be treated as an opaque string, right?

Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break? By saying "without phone numbers, they can't use clientside contact lists", you seem to be suggesting that something would break, but I can't imagine how, unless it's as trivial as a database constraint that says "this field must contain only digits".

Re: Twilio incident: What Signal users need to know

#39

Post by Aachen »

capableweb wrote: post #9
colinmhayes wrote: post #5

Earlier quoted context omitted.

How do you deal with spam without requiring a phone number to register?

One option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.

I don't see the difference between some Isabelle showing up as someone to accept or deny, or some Isabelle with a "I'm a hot single in your area, click this link" message so I'm sure it's spam.

On Telegram this is rampant, on average probably one person per day. It shifted from e-gold scams to sex since a few months, but both are still present. People that aren't in big groups (where the spammers scrape user IDs) have zero problems, so the trick is revealing your random identifier only to those you want to contact you. Phone number identifiers are the antithesis to spam protection: we keep our ranges just full enough that we can't shorten it by a digit, but empty enough that we have small growth possibilities. You're very likely to hit a subscriber, by design, by trying random numbers.

Re: Twilio incident: What Signal users need to know

#40

Post by 8ytecoder »

tptacek wrote: post #34
daneel_w wrote: post #32

Earlier quoted context omitted.

The sane alternative is that it could keep a client-side contact book that users would be responsible for managing entirely on their own, including when setting the app up on a new phone. Addendum: also, there is nothing preventing this type of contact book data from being backed-up/synced to a new phone, like any other data and settings of any other app. iOS has this feature since like 7 years now. Android, too, I'm…

That's a good way to build a secure messaging app nobody ever uses.

Signal still assumes you manage your contacts no? It happens via iCloud or a google account today.
Post reply on HN