Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Registration without a phone number on Signal will use zero-knowledge proofs

community.signalusers.org

Post reply on HN
Print view View original

11–20 of 201 posts

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#11

Post by opan »

atiq-ca wrote: post #2

Signal still uses proprietary blob and uses google/apple service for notifications. Use molly.im instead which has solved these problems.

I was using Silence from F-Droid for a while back in the day because of these issues, but the lack of interop and needing to make everyone move again soured me on the whole thing. I would rather just get people on XMPP or Matrix and not use some sketchy phone-first app at all. For SMS I use Fossify Messages, which I think was a fork of QKSMS. I don't use SMS as primary or sensitive comms, only as needed. Same as email, basically, but less useful.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#13

Post by user3939382 »

I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#14

Post by ggm »

For those who missed it, unrelated to this specific ZKP thing the release cycle also now permits Android tablets without a SIM to be first-class adjunct devices without using wierd tricks or alternate clients. It may permit them to be the initiation/sign-on device, which would invoke the ZKP, but the point for me as an existing phone number denominated user, the point is I can be on my tablet with true signal now. Nothing against molly, wanted it in the base.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#15

Post by bawolff »

user3939382 wrote: post #13

I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".

Viewing any security thing as a binary is the wrong way to look at it. Figure out your adversaries, how much power they have and what they are willing to spend. Make your decisions from there.

I personally think signal is sufficient for the threats the average person is concerned about, but that is a decision each individual has to make for themselves.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#16

Post by nosioptar »

opan wrote: post #11
atiq-ca wrote: post #2

Signal still uses proprietary blob and uses google/apple service for notifications. Use molly.im instead which has solved these problems.

I was using Silence from F-Droid for a while back in the day because of these issues, but the lack of interop and needing to make everyone move again soured me on the whole thing. I would rather just get people on XMPP or Matrix and not use some sketchy phone-first app at all. For SMS I use Fossify Messages, which I think was a fork of QKSMS. I don't use SMS as primary or sensitive comms, only as needed. Same as emai…

I really liked silence. I stopped using it when f-droid said the source code was no longer available. Fossify messages is the best replacement I've found.

(I dont bother with encrypted messenging apps. I prefer to assume that anything I do on my phone is doubleplus unprivate. If I want privacy, I head over to my computer.)

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#17

Post by mmooss »

opengrass wrote: post #12

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

What about their built-in cryptocurrency? It's a perfect use for it. They could require payment post-install yet before message can be sent.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#18

Post by purpleidea »

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#19

Post by opengrass »

ggm wrote: post #14

For those who missed it, unrelated to this specific ZKP thing the release cycle also now permits Android tablets without a SIM to be first-class adjunct devices without using wierd tricks or alternate clients. It may permit them to be the initiation/sign-on device, which would invoke the ZKP, but the point for me as an existing phone number denominated user, the point is I can be on my tablet with true signal now. No…

You can already do that without being a trusted device.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#20

Post by 420official »

user3939382 wrote: post #13

I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".

Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not?

I concede that if you can't trust the device itself you can't trust anything running on it, but why have you resigned yourself to that? And how does that reflect on signal at all?

Post reply on HN