261–270 of 512 posts
Earlier quoted context omitted.
The Signal desktop app doesn't require your phone to be turned on (once it's been "paired") by the way, as opposed to for example Whatsapp.
By desktop app you mean a website cosplaying as a desktop app.
Yes, I'm aware the desktop app is made with Electron. So what? I keep it running almost all the time and I've never had any performance issues with it.
Yes, Signal’s phone number requirement is bad. But, given that, the fact that they don’t store any messages on their side and everything is client side is still a huge benefit over a lot of other apps and still a huge step forward for privacy! Criticism is definitely important but I just wanted to put that out there that all things considered, Signal is still very much a good thing.
I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, abortion seekers, or dissidents. If you learn a contact phone number then you can buy their location history. Requiring phone numbers and requiring you share them with everyone you contact is brain dead. This alone is bad enough to abandon Signal but then consi…
Mind you, the last time I looked there are not alternate implementations of the signal protocol and even the usage of libsignald was frustrating due to continuous backwards compatibility breakage. I would love for a proper libpurple implementation.
This is a weird thread. There's a product that does secure messaging with usernames and only requires user/pass. It's called Keybase. If this is the product you want, then go use it. I don't understand why everyone wants Signal to be something it's not. I quite like Signal as they are and this "incident" demonstrates exactly what happens if a carrier gets compromised: nothing. Nothing happens. Signal decides not to t…
> I quite like Signal as they are and this "incident" demonstrates exactly what happens if a carrier gets compromised: nothing. Nothing happens. Signal decides not to trust any phone verifications from the period of compromise and requires affected numbers to reregister. cool, but entire carriers being compromised has never been a concern. it's state agencies forcing carriers to compromise individuals. >I don't under…
This is a weird thread. There's a product that does secure messaging with usernames and only requires user/pass. It's called Keybase. If this is the product you want, then go use it. I don't understand why everyone wants Signal to be something it's not. I quite like Signal as they are and this "incident" demonstrates exactly what happens if a carrier gets compromised: nothing. Nothing happens. Signal decides not to t…
> I quite like Signal as they are and this "incident" demonstrates exactly what happens if a carrier gets compromised: nothing. Nothing happens. Signal decides not to trust any phone verifications from the period of compromise and requires affected numbers to reregister. cool, but entire carriers being compromised has never been a concern. it's state agencies forcing carriers to compromise individuals. >I don't under…
As far as I'm away, Signal is used by plenty of people who may be targeted by state agencies. Has there been even one "High value target apprehended because Signal" headline?
Earlier quoted context omitted.
> Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break? I feel like you're mis-analyzing a social problem or some other design goal as a low-level technical problem. I don't know their real reason, but I can say that my email contact list is waaay messier and less curated than my phone contact list. It wou…
That seems like a problem that could easily be solved by sending fewer notifications. Do I really need to know if somebody has joined Signal until I actually want to talk to them? Isn't it better to have a larger pool of people with whom I can communicate securely using Signal? I'm mostly just confused because this is being presented as a technical limitation: using email addresses would supposedly "require Signal to…
I don't know what the real reason is, what I said was just something that popped into my head. Another comment mentioned spam-prevention as a reason (by making it infeasibly expensive), and that actually makes more sense. Honestly, there probably isn't just one reason, but a cluster of tradeoffs.
> Isn't it better to have a larger pool of people with whom I can communicate securely using Signal?
IMHO, the number people who care deeply enough about the phone number thing to boycott Signal is vanishingly small; not even a rounding error. Sure they're loud on HN or maybe even Twitter, but giving tiny but loud minorities whatever they demand is bad policy.
Earlier quoted context omitted.
By desktop app you mean a website cosplaying as a desktop app.
I didn't know Signal had a web app. Yes, I'm aware the desktop app is made with Electron. So what? I keep it running almost all the time and I've never had any performance issues with it.
Also it won't work on linux phones.
Earlier quoted context omitted.
I guess I have to rephrase myself: the API calls are authenticated, because the API endpoints will not consume anonymous requests. I'd be glad if you could point me to documentation proving that the messaging API uses completely different credentials than those for user login, and that the two are also disassociated.
Good luck finding documentation about the protocols and APIs used by signal. While every random cryptocurrency has a cryptography whitepaper, it seems that Signal does not.
The server and clients are open source: https://github.com/signalapp
Earlier quoted context omitted.
which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
It's unsafe. They could lock you out from your Signal account and impersonate you. Someone who does not know you changed your number, forgot about it or does not think about this could then send a message to the person who has your old phone number thinking it's you at the other end. Most people don't bother with the warning about the security number having changed. I also personally assume that the phone number of a…
If they (Signal) care about privacy, they need to drop the need for phone numbers to use their service, there are many ways of dealing with spam (rate limiting, captchas, ...), a true private/secure messenger app should not require any user identifiable info. And the argument of "Signal was the first e2ee messenger app to go mainstream, so they can keep ignoring user's privacy, .... yada yada..." is naive at best; th…
I second recommending Briar as a messenger. Codebase is well maintained. Specifications and documents are audited, as well as the official clients.
Earlier quoted context omitted.
>I refuse to use or recommend Signal due to blatantly bad design choices that put people that need privacy most at risk like security researchers, journalists, abortion seekers, or dissidents. I understand your concerns, and if I was a security researcher, journalist, abortion seeker or dissident, I wouldn't use Signal either. But, like the vast majority of us, I am not any of those things. As such, for my (and most…
With Matrix you can use F-Droid build of the client. And you don't really need to trust the server too much, right? Maybe it's not enough for Snowden, but it's better. I'm not saying "don't use Signal", in fact I still recommend it to non technical people, since it's just much simpler. But pointing at the flaws is a necessary requirement for them to be fixed