Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Registration without a phone number on Signal will use zero-knowledge proofs

community.signalusers.org

Post reply on HN
Print view View original

21–30 of 201 posts

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#21

Post by Cider9986 »

rkagerer wrote: post #7
Cider9986 wrote: post #4

Earlier quoted context omitted.

Molly is a security-hardened Signal client only on Android for people unfamiliar. They went through a period of not updating (there were no security updates during that time afaict), but now releases should happen faster on top of Signal. In Molly there's three options. Google Play Services, WebSocket, and UnifiedPush. I use the WebSocket and Molly has used >1% of battery since the last full charge so it doesn't seem…

If you're using WebSocket, how do Google and Apple see metadata? Can someone explain why it's so difficult to make a decent chat app divorced from their ecosystems?

I'm talking about using play services or Apple's version. Signal falls back to a WebSocket if you don't have play services installed.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#22

Post by mmooss »

420official wrote: post #20
user3939382 wrote: post #13

I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".

Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not? I concede that if you can't trust the device itself you can't trust anything running on it, but why have you resigned yourself to that? And how does that reflect on signal at all?

> Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not?

While I disagree with these critiques of Signal, the surveillance networks can capture metadata - who talks to who and when - without breaking E2E. The metadata is as valuable as the data.

I think Signal has a feature to protect users, but I can't imagine how it works if the attacker can see all parties' Internet connections.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#23

Post by Cider9986 »

mmooss wrote: post #17
opengrass wrote: post #12

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

What about their built-in cryptocurrency? It's a perfect use for it. They could require payment post-install yet before message can be sent.

Nobody uses that and I think it was pre-mined. They should have implemented Monero but the UX isn't there. Maybe a Monero light wallet server run by Signal.

They probably avoided Monero to not attract the additional scrutiny. They don't even accept donations in Monero.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#24

Post by Cider9986 »

opengrass wrote: post #12

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

It says something about Play Billing being used specifically to mitigate spam?

I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#25

Post by s0ss »

purpleidea wrote: post #18

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

I’m not sure their tax status is the justification your argument needs.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#26

Post by [deleted] »

Cider9986 wrote: post #24
opengrass wrote: post #12

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

It says something about Play Billing being used specifically to mitigate spam? I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

[deleted]

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#28

Post by ggm »

opengrass wrote: post #19
ggm wrote: post #14

For those who missed it, unrelated to this specific ZKP thing the release cycle also now permits Android tablets without a SIM to be first-class adjunct devices without using wierd tricks or alternate clients. It may permit them to be the initiation/sign-on device, which would invoke the ZKP, but the point for me as an existing phone number denominated user, the point is I can be on my tablet with true signal now. No…

You can already do that without being a trusted device.

For the longest time, you couldn't. It wasn't until this release I realised that had changed. If it changed before, it wasn't well communicated to me as an Android signal user. I was on beeper and then molly precisely because there was so little traction on changing this. You could install signal fine, but you couldn't QR code or secret phrase mesh it with your android handset. Oddly, iPad meshed fine with iPhone or Android, and OSX desktop likewise. Just Android tablet which didn't.

Do you think this changed in over 18 months? I think it changed in under 18 months.

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#29

Post by opengrass »

Cider9986 wrote: post #24
opengrass wrote: post #12

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

It says something about Play Billing being used specifically to mitigate spam? I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

Add ability to pay for a signal login.

https://github.com/signalapp/Signal-Android/commit/7da3357b5...

Re: Registration without a phone number on Signal will use zero-knowledge proofs

#30

Post by [deleted] »

purpleidea wrote: post #18

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

[deleted]
Post reply on HN