Twilio incident: What Signal users need to know • Hacker News Board

Re: Twilio incident: What Signal users need to know

#391

Post by mpol » Tue, Aug 16, 2022, 1:40 AM UTC

jorvi wrote: post #346

g_sch wrote: post #71

This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies. As far as I can tell, Signal uses Twilio only to send SMS for phone number verification. Verification happens when a user registers a n…

> This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies. I am assuming US or Germany. I can't remember which thing it was exactly but there was a huge privacy scare in the US at some point w…

You might be in a different bubble than I am in :)

Netherlands here. 80 contacts on my phone. 20 on Signal, of which 10 are quite normal people. Almost all 80 are on Whatsapp. No idea about Telegram.

Re: Twilio incident: What Signal users need to know

#392

Post by alldayeveryday » Tue, Aug 16, 2022, 1:42 AM UTC

jefftk wrote: post #387

alldayeveryday wrote: post #376

Earlier quoted context omitted.

Are you familiar with their API? We use their SMS auth service at my employer. Twilio is the one composing the outbound message including auth code. The API caller is not providing Twilio with an auth code and phone number. Twilio 100% knows which portion of the outgoing SMS is the auth code.

sorry, not familiar with an Auth API. About 5 years ago I worked at a company that used their API, but we just used it as a service for sending texts to specific numbers. (And mostly we used different services, because it was more expensive than our other options) Do we know that Signal was using the Twilio Auth product and not something custom on top of Twilio?

We do know. Check the texts you’ve gotten while signing into Signal. You’ll notice that they originate from short codes (like 22395) that are also used by other services like Discord, square pay, just to name two.

Furthermore, it still doesn’t matter whether Signal was using their authy service or not. There should be very tight data controls at Twilio where few employees would ever be able to retrieve clear text messages being sent to end users.

This incident is not getting nearly the attention it should imho.

Re: Twilio incident: What Signal users need to know

#393

Post by dcow » Tue, Aug 16, 2022, 1:44 AM UTC

stormbrew wrote: post #321

tptacek wrote: post #311

Earlier quoted context omitted.

Signal replaces messaging services that were all keyed by phone number. Use something else. I don't think anybody can do better than explaining why Signal works this way, and what the benefits are, vs. the (amply articulated) liabilities. This is one of the most boring repeated conversations that occurs on HN. It's incessant. Avoiding these incessant superficial conversations is, in fact, part of the premise of HN.

I agree, it's an exhausting repeated conversation. It's almost as if there's a frustrating unmet need with signal as it stands for a lot of people that isn't actually placated by the repetition of an argument about how they grow as a ~~business~~ (sorry, as a non-profit). And again, signal is the only thing that can talk to people on signal so "use something else" is not helpful.

Why are you saying they need to grow? You of all people are the first to admit that everyone you need to talk to already uses it.

Re: Twilio incident: What Signal users need to know

#394

Post by pseudo0 » Tue, Aug 16, 2022, 1:45 AM UTC

int_19h wrote: post #359

pseudo0 wrote: post #325

Earlier quoted context omitted.

Unless things have changed in the last few years, there are apparently countries in Europe that don't require registration: https://www.reddit.com/r/europe/comments/9ziqfi/european_cou... And that's a quite high regulation part of the world, I'd be surprised if South American or African countries were stricter.

Requiring SIM registration is nearly universal outside of Europe and NA. https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...

Great link, thanks. Interesting that my intuition was off, although I suppose it makes sense that regulations are loosest in countries with the strongest speech and privacy protections. Although I'm skeptical of how well the rules on paper are enforced in some of the countries listed as requiring registration. I have seen SIMs for sale at roadside stalls in a couple countries listed as requiring registration, and I don't think they were checking ID...

But it looks like the official answer is 36:

> Those without any SIM-card registration requirements are Bosnia and Herzegovina, Canada, Cabo Verde, Comoros, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Iceland, Ireland, Israel, Kiribati, Latvia, Liechtenstein, Lithuania, Maldives, Malta, Marshall Islands, Micronesia, Moldova, Namibia, the Netherlands, New Zealand, Nicaragua, the Philippines, Portugal, Romania, Serbia, Slovenia, Sweden, the United Kingdom, the United States, and Vanuatu.

Re: Twilio incident: What Signal users need to know

#395

Post by alldayeveryday » Tue, Aug 16, 2022, 1:47 AM UTC

ycombinator_acc wrote: post #43

>it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code That's a thing? If my number expires and gets reassigned to someone else, and they register for Signal, I'll get locked out of my account just like that? And they'll start getting all the messages that were addressed to me?

Services like Signal and WhatsApp can user 3P services that allow them to be notified when a phone number is rotated (given to a new user). They should ideally be doing this, I cannot verify if they are or not.

Second, Signal and other services have implemented secondary registration requirements such as a PIN, which they will require during a new device install or at other times.

Third, you can build models or crude business logic to identify when a number no longer appears used for a period of time. Carriers do not reassign a number immediately. Assigning a number thus one user cancelled, to another user, is seldom done before a 90 day hibernation period.

I used to work at a cell provider.

Re: Twilio incident: What Signal users need to know

#396

Post by ikawe » Tue, Aug 16, 2022, 1:51 AM UTC

ycombinator_acc wrote: post #80

ryukafalz wrote: post #45

Earlier quoted context omitted.

Your account is tied to your phone number so pretty sure that’s the case, yep!

That sounds horrible. Would I be SoL even if I had ticked "Registration Lock" prior to that?

No, this is exactly the kind of thing registration lock is intended to address.

If you enabled Registration Lock, your account cannot be hijacked by sms, provided you’ve been actively using your signal account within the last week.

There’s an automated keep-alive for the case that you still have signal installed but haven’t been sending/receiving any messages.

Re: Twilio incident: What Signal users need to know

#397

Post by dcow » Tue, Aug 16, 2022, 1:53 AM UTC

kortilla wrote: post #382

bigiain wrote: post #350

Earlier quoted context omitted.

> I use it. I use it because people I need to talk to are there This is exactly what makes it "your problem". Signal worked out a way to provide E2E messaging that practically everybody who cares and all their friends use. You can choose to accept their phone number requirement compromise and take advantage of that huge and growing network of users, or you can go your own way and somehow convince "the people you need…

> This is exactly what makes it "your problem". No, it’s still signal’s problem too. There is no reason to bootlick here. > Signal isn't perfect, but it's got very close to that, It’s really far from it. Being tied to SMS and phone numbers is a nearly fatal flaw.

Fatal by what definition? Signal appears quite successful if you simply look at it.

Re: Twilio incident: What Signal users need to know

#398

Post by dvzk » Tue, Aug 16, 2022, 2:10 AM UTC

awinter-py wrote: post #288

the recommended fix here is to add a PIN + enable registration lock IIRC signal PIN was very controversial back in the day because they were 1) forcing users to do it and 2) forcing them to opt in to some data collection as part of creating a PIN. Signal backed down on requiring a PIN, but now it's unclear from their settings page whether setting a PIN will share data as well. The marketing copy on my droid device sa…

From my 5-minute reading of the Signal source code it seems that disabling the PIN results in the generation of a random 256-bit master key for cloud storage encryption:

https://github.com/signalapp/Signal-iOS/blob/main/SignalServ...

The primary developer has stated previously that cloud storage is still used even with the PIN disabled:

https://community.signalusers.org/t/beta-feedback-for-the-up...

Re: Twilio incident: What Signal users need to know

#399

Post by Volundr » Tue, Aug 16, 2022, 2:14 AM UTC

KAMSPioneer wrote: post #386

Volundr wrote: post #372

Earlier quoted context omitted.

From the comment I'm replying to: > You can already see it with several countries' response to covid. Perhaps the commenter was going for something else, but at least where I'm at we've had two straight years of people insisting they are muzzles, an infringement on our god-given rights, and the beginning of a slippery slope to tyranny. Perhaps the commenter meant something else, but since they didn't spell out what s…

Fair enough, I suppose. I immediately thought of (what I consider to be) excessive lockdowns and enforcement in countries like Australia, but I can see how you went to masks.

It certainly could be. But even then I'm not sure I consider measures attempting to control a pandemic the height of tyranny. I realize this might sound like I'm pro-lockdown, I'm not, I actually think most countries completely botched their handling with measures both insufficient to have sufficient impact on the actual spread, while limiting enough to ensure significant damage from the measures themselves.

I also take issue with the idea of gun (or rocket launcher ownership) ownership as a means of prevention. I mean look at the top countries for (citizen) gun ownership. Sure you've got the US, Serbia, Canada, Uruguay, Finland up there, not bad, But you've also got Yemen at #3 and Lebanon and #11. If that's the kind of "freedom" private gun ownership ensures, then I'm not buying.

And again I'm not even that pro gun control. I think you should be required to get a background check to get one, I think you should be required to be trained on their use and safety, and I think you should be required to take reasonable measures to protect your firearms against theft. I'd say that's it, but I suppose I'm also against mail order rocket launchers. But for the most part, having met those requirements I think you should be able to buy what you want (within reason, again let's skip the rocket launcher). But as protection against government tyranny? Doubt.

Re: Twilio incident: What Signal users need to know

#400

Post by stormbrew » Tue, Aug 16, 2022, 2:16 AM UTC

dcow wrote: post #366

stormbrew wrote: post #301

Earlier quoted context omitted.

You've said something like this many many times and I just don't see the logic of the question. You're talking about a feature that you admit is a privacy compromise and then comparing it to an absolutely maximalist alternative, or a world where people only connect in literally one way (through their phone contact lists). Is it really so hard to imagine that other compromises may be possible, or even coexist? The ans…

I'm not comparing to some absolutely maximalist alternative. I'm asking how you get an equivalent product experience without the compromise (which would make everyone happy). I strongly believe the UX afforded by the compromise is how Signal has won all its users. The threat model and all it entails is the value prop. I genuinely believe there is a lot of commentary on this thread from people who have never designed…

> I genuinely believe there is a lot of commentary on this thread from people who have never designed a secure system.

Gosh that's quite the conclusion. I hope my employer never finds out about this discovery of my competency based on some comments on a message board.

I think you've very much lost the thread of what I'm saying here, because at no point have I suggested anything about 100% security or 100% privacy. It would actually be pretty weird for me to be advocating for that while also asserting that you're making maximalist arguments.

I also never said email is inherently more private than phone. I assert that it's a different privacy tradeoff, and one that I'm more comfortable with for various reasons. I could get into those if you want but I don't think they're relevant. (1) is the more interesting question in the end. (3) is just "it's open source you can fix it yourself!" which is .. not very useful on any level. Yes, I can go make my own signal-based platform and talk to precisely no one over it. No I'm not interested in doing that. I've been to the social network rodeo and have the mental scars to prove it.

So ok, assuming we go with email addresses as the alternative mechanism, and the email addresses still require verification same as the phone numbers, and you still have to mutually have each other on our contact lists to communicate through signal: How, specifically, has the threat model been weakened?