230, or not 230? That is the EARN IT question • Hacker News Board

Re: 230, or not 230? That is the EARN IT question

#11

Post by lotyrin » Wed, Apr 08, 2020, 6:35 PM UTC

doomrobo wrote: post #6

seemslegit wrote: post #4

Earlier quoted context omitted.

That's hardly helpful if I just don't want people who happen to have my number to know I'm using signal.

How would a messaging app work without contact discovery? You try a friend's number, and see if the message goes through? Well if that's what you want, then you can do this for all your phonebook numbers, and all the ones that go through are on Signal, and all the ones that error are not. Oops, you've reinvented contact discovery.

I guess I just don't value "contact discovery" as a feature?

I just don't see it as a casual thing the way the target users of these apps apparently do.

I want to explicitly control, per any form of communication, each person who is to be made to know that I operate that form of communication and whether or not that form of communication with me is open to them.

I do not want to open up a new app and have a large populated list of past acquaintances appear, I absolutely do not want to appear in such a list, I would rather not use a given app than risk having someone show up messaging me uninvited.

Re: 230, or not 230? That is the EARN IT question

#12

Post by eximius » Wed, Apr 08, 2020, 6:41 PM UTC

AndyMcConachie wrote: post #9

seemslegit wrote: post #2

Is signal still demonstrating their commitment to my privacy by notifying everyone with my number in their phone contacts who is also on signal when I join ?

Why is this downvoted?

Contact Discovery is not seen as privacy invasive, I guess. It says, X has Signal, but that's it. So I see how it is, strictly speaking, broadcasting 'private' information, but it is hard to care terribly. I'm far more concerned by the privacy of my conversations than the fact I at one point installed signal.

Re: 230, or not 230? That is the EARN IT question

#13

Post by clarkevans » Wed, Apr 08, 2020, 6:41 PM UTC

AndyMcConachie wrote: post #9

seemslegit wrote: post #2

Is signal still demonstrating their commitment to my privacy by notifying everyone with my number in their phone contacts who is also on signal when I join ?

Why is this downvoted?

Perhaps the parent is downvoted not because of the underlying content of the message, but because of the black/white framing.

Every tool has a barrier to use, and even with a strong commitment to security/privacy, Signal seems to have decided that it's more beneficial for their users know which one of their friends are on Signal, than there is potential for abuse. Further, there may come a time where this calculus changes, for example, if spammers arrive on the Signal platform and start decreasing usability.

Re: 230, or not 230? That is the EARN IT question

#14

Post by seemslegit » Wed, Apr 08, 2020, 6:44 PM UTC

eximius wrote: post #12

AndyMcConachie wrote: post #9

Earlier quoted context omitted.

Why is this downvoted?

Contact Discovery is not seen as privacy invasive, I guess. It says, X has Signal, but that's it. So I see how it is, strictly speaking, broadcasting 'private' information, but it is hard to care terribly. I'm far more concerned by the privacy of my conversations than the fact I at one point installed signal.

See, there's an apparently archaic concept in software called user preference - they could ask people upon joining if they want to be contact-discoverable or not.

Re: 230, or not 230? That is the EARN IT question

#15

Post by ocdtrekkie » Wed, Apr 08, 2020, 6:46 PM UTC

EARN IT is pretty disingenuous in how it is designed, of course, but I am all for making it harder and harder to retain Section 230 immunity: It's a mistake that we allow it in the first place.

We should indeed continue to erode the eligibility for Section 230 to the point that either the limitations of remaining eligible for immunity makes it easy for competitors to produce better offerings without immunity, or that these companies accept legal responsibility for their actions as a cost to doing business the way they want to. Perhaps this is a vehicle upon which we gradually sunset immunity-reliant platforms.

Section 230's supporters constantly push hilariously insane narratives about it's importance, suggesting that without it companies would be inherently violating the law any time one of their users violated the law, or that taking reasonable measures to prevent platform abuse is "impossible" at the scale Big Tech operates at.

It's more than past time that we regulate tech companies and hold them responsible for massive abuses permitted by their platforms just as we regulate every other sector of business.

Re: 230, or not 230? That is the EARN IT question

#16

Post by TheAdamAndChe » Wed, Apr 08, 2020, 6:46 PM UTC

lotyrin wrote: post #11

doomrobo wrote: post #6

Earlier quoted context omitted.

How would a messaging app work without contact discovery? You try a friend's number, and see if the message goes through? Well if that's what you want, then you can do this for all your phonebook numbers, and all the ones that go through are on Signal, and all the ones that error are not. Oops, you've reinvented contact discovery.

I guess I just don't value "contact discovery" as a feature? I just don't see it as a casual thing the way the target users of these apps apparently do. I want to explicitly control, per any form of communication, each person who is to be made to know that I operate that form of communication and whether or not that form of communication with me is open to them. I do not want to open up a new app and have a large pop…

That's great! Signal may not be for you then, which is okay.

Re: 230, or not 230? That is the EARN IT question

#17

Post by TechBro8615 » Wed, Apr 08, 2020, 6:48 PM UTC

seemslegit wrote: post #2

Is signal still demonstrating their commitment to my privacy by notifying everyone with my number in their phone contacts who is also on signal when I join ?

Telegram does the same thing. In fact, so does Instagram, which I find most egregious, since it asks for your number for 2FA purposes then notifies anyone who has your number saved that you’ve joined.

Every coach, recruiter, drug dealer or one night stand I’ve had in my life doesn’t need to know when I sign up to Instagram. Some of them might not have even had my real name until they got that notification.

IMO this should be illegal, now that I think about it.

Re: 230, or not 230? That is the EARN IT question

#18

Post by ape4 » Wed, Apr 08, 2020, 6:48 PM UTC

eximius wrote: post #12

AndyMcConachie wrote: post #9

Earlier quoted context omitted.

Why is this downvoted?

Contact Discovery is not seen as privacy invasive, I guess. It says, X has Signal, but that's it. So I see how it is, strictly speaking, broadcasting 'private' information, but it is hard to care terribly. I'm far more concerned by the privacy of my conversations than the fact I at one point installed signal.

But it means they have slurped all your contacts. How are they stored? Who are they shared with? etc

Re: 230, or not 230? That is the EARN IT question

#19

Post by doomrobo » Wed, Apr 08, 2020, 6:49 PM UTC

seemslegit wrote: post #8

doomrobo wrote: post #6

Earlier quoted context omitted.

How would a messaging app work without contact discovery? You try a friend's number, and see if the message goes through? Well if that's what you want, then you can do this for all your phonebook numbers, and all the ones that go through are on Signal, and all the ones that error are not. Oops, you've reinvented contact discovery.

A. You can design it in such a way so that sending a message to a non-user is indistinguishable from having a user see it and not reply/acknowledge it. B. You can exchange identifiers with people whom you want to communicate it just like with any other non-phone-based system: "Hey I'm @username on signal", "Cool, I'm @username2" - composes well with method A.

Solution A does not compose well with how Signal does encryption. In order to make this indistinguishable, Signal would basically have to man-in-the-middle all non-existent users. And if one of those users signed up for Signal it would have to stop man-in-the-middling them, causing all the people who were talking with their ghost to observe a key change. It's complicated at best, and sketchy at worst.

Solution B ties in to a bigger argument I won't address

Re: 230, or not 230? That is the EARN IT question

#20

Post by andrewzah » Wed, Apr 08, 2020, 6:57 PM UTC

doomrobo wrote: post #6

seemslegit wrote: post #4

Earlier quoted context omitted.

That's hardly helpful if I just don't want people who happen to have my number to know I'm using signal.

How would a messaging app work without contact discovery? You try a friend's number, and see if the message goes through? Well if that's what you want, then you can do this for all your phonebook numbers, and all the ones that go through are on Signal, and all the ones that error are not. Oops, you've reinvented contact discovery.

> How would a messaging app work without contact discovery?

"Hey, add me on telegram, my username is @andrewzah". This isn't a hard problem.

I don't know why we decided apps hoovering up our contact lists in exchange for convenience was so important. For an app that touts itself as private and secure, I still had to explain to my brother why giving it his contact list wasn't a good idea.