Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

391–400 of 410 posts

Re: You can change your number

#391

Post by colordrops »

sa1 wrote: post #388
colordrops wrote: post #377

Earlier quoted context omitted.

I trust bloom filters more than SGX. I assume they stopped using bloom filters because of performance or reliability reasons? Also, aren't most mobile processors not Intel? How would SGX be used?

Here you go: https://signal.org/blog/private-contact-discovery/

Thanks for being patient and providing links.

How do we know the closed source version of signal on the app stores is using the same MRENCLAVE as the one from the open source server?

Also, my understanding as to why a contact graph is needed at all is because signal wants to increase their virality. Couldn't we forgo this unnecessary feature? Signal could generate a long enough key locally, and if you want to add another signal user, the client could send it automatically to a contact through SMS. The client on the other side could automatically read the key through SMS and add the contact. Or the user could manually send the key through any mechanism they wanted.

A third note, trusting SGX assumes that 1. it has no bugs, and 2. it has no backdoors, 3. Signal server code has no bugs, 4. Signal server code has no backdoors. The first two of these are not strong guarantees, especially considering that it's not open source, intel doesn't have a great track record, and nation state actors have been involved in weakening these sorts of features in the past. At least with the Signal server code you can audit it.

Re: You can change your number

#392

Post by alfiedotwtf »

wolverine876 wrote: post #243
alfiedotwtf wrote: post #149

It would be nice if it didn't require a phone number. My daughter doesn't have a phone, but I would still like to use Signal with her when she's on a wifi-connected iPad.

Regarding your specific issue: You could get your daughter a VOIP number, which can run as an app on the iPad. VOIP numbers can process text messages too, which should enable Signal's confirmation message.

Oh! Thanks, I never actually thought of that. Awesome

Re: You can change your number

#393

Post by ttybird2 »

sneak wrote: post #367
ttybird2 wrote: post #365

Earlier quoted context omitted.

In many countries the government and the company that you register the number with need to know who you are (or can deduce it from the place where you are connecting).

Yes, but people in those countries can buy a US VoIP number from a US vendor for $2 and use that as their Signal number. You don't need to use a GSM number, and you don't need to use the country code in which you live. The fact is, mostly anonymous phone numbers are available on the internet for use with Signal, and Signal (correctly) does not discriminate on country code or "type" of number. Any number that can rece…

Could you suggest such a provider that accepts cryptocoins? I honestly was not aware that I could do that.

Re: You can change your number

#394

Post by sa1 »

colordrops wrote: post #391
sa1 wrote: post #388

Earlier quoted context omitted.

Here you go: https://signal.org/blog/private-contact-discovery/

Thanks for being patient and providing links. How do we know the closed source version of signal on the app stores is using the same MRENCLAVE as the one from the open source server? Also, my understanding as to why a contact graph is needed at all is because signal wants to increase their virality. Couldn't we forgo this unnecessary feature? Signal could generate a long enough key locally, and if you want to add ano…

You've hit upon the limits of Signal and other messengers.

The version on app stores is not a closed source version. However it is a binary, and there might be questions on build reproducibility. I do not know the answer to this nor the answer to your MRENCLAVE question.

Virality is because of their philosophy - their first goal is to end mass surveillance, not provide custom software for preventing individual surveillance. The quicker everyone in the world is using E2E, not only is there less mass surveillance, contact discovery leaks zero additional information at that point.

Concerns with SGX are real - but it remains the state-of-the-art - your criticism assumes that the competitors do any better, at this point they do not. They have traditional backends or are as flawed. Signal is doing the hard work on researching solutions at this point, the others are not as close.

> Signal could generate a long enough key locally, and if you want to add another signal user, the client could send it automatically to a contact through SMS. The client on the other side could automatically read the key through SMS and add the contact. Or the user could manually send the key through any mechanism they wanted.

This is what happens when contacts verify each other through QR codes on Signal. But this mechanism does not solve your problem nor are you solving the problem Signal wanted to solve - minimizing data on servers. Even with keys, servers still has to route messages, and with your solution they'll have to maintain a user database.

Re: You can change your number

#395

Post by colordrops »

sa1 wrote: post #394
colordrops wrote: post #391

Earlier quoted context omitted.

Thanks for being patient and providing links. How do we know the closed source version of signal on the app stores is using the same MRENCLAVE as the one from the open source server? Also, my understanding as to why a contact graph is needed at all is because signal wants to increase their virality. Couldn't we forgo this unnecessary feature? Signal could generate a long enough key locally, and if you want to add ano…

You've hit upon the limits of Signal and other messengers. The version on app stores is not a closed source version. However it is a binary, and there might be questions on build reproducibility. I do not know the answer to this nor the answer to your MRENCLAVE question. Virality is because of their philosophy - their first goal is to end mass surveillance, not provide custom software for preventing individual survei…

I have heard that one of Signal's goals are mass adoption, so it's presumed that some compromise is required to make this happen. I hope they continue to push the envelope toward more transparency. This was an enlightening and educational discussion. thank you.

Re: You can change your number

#396

Post by snowgrove »

sneak wrote: post #368
snowgrove wrote: post #359

Earlier quoted context omitted.

Yup, and I don’t care. If I ever organize a protest I’ll do it on Signal, or another end-to-end encrypted platform. For daily banter I’ll use whatever a majority of my friends prefer. That’s currently Discord for the above-mentioned reasons.

You know that. It's unlikely that all of the rest of the people who join Discord because "all of their friends are on it" that your presence there influenced know that, and in many possible future scenarios, you and others' presence there directly contributes to the harm that may befall them as a result of their loss of privacy thereby. https://www.brainyquote.com/quotes/cardinal_richelieu_183310 It's also impossible…

It’s not polite to assume ignorance of all this on the part of my friends, either, but here you are.

If Signal didn’t suck as much, my friends wouldn’t have left and I wouldn’t have followed them. It’s really that simple.

Re: You can change your number

#397

Post by itake »

toastercup wrote: post #262
athrun wrote: post #231

Earlier quoted context omitted.

My understanding is that your profile username is made visible if: - the person is in your own contact list - you create a conversation with them - you accept a conversation from them see: https://support.signal.org/hc/en-us/articles/360007459591

Nice. Sounds like the same rules apply to profile pictures as well. That feels like a step in the right direction, but it still means that by having family/coworkers/college buddies/etc in your contacts, they can see your profile picture and username. I know this can be a sticking point for some. It would be great if Signal introduced finer-grained privacy controls so it could appeal to an even wider audience.

You can download leaked phone numbers of millions of ppl and add them to your phone's address book (iOS limits contacts to 50k). I don't think this is very secure.

Re: You can change your number

#398

Post by tgsovlerkhgsel »

TacticalCoder wrote: post #145
tgsovlerkhgsel wrote: post #133

Earlier quoted context omitted.

They're also critical to getting people to move from WhatsApp. Next time when Facebook pulls something user-hostile (e.g. monetization with ads, yet another privacy policy change for the worse, ...) some people will simply install Signal. If they use phone numbers as (an) identifier, two people who do this independently can immediately switch to Signal. If A convinces B to switch, and C convinces D to switch, B and D…

> Next time when Facebook pulls something user-hostile ... In my opinion with or without FB putting anything more hostile people are moving, in drones, to Telegram. I see regular people (non-tecchies at all) in my friends' circle joining Telegram regularly. I'm not saying TG is better than Signal but I think TG's userbase is many orders of magnitude bigger than Signal's.

These trends tend to be "local" to some extent. Sometimes country based, but I've heard of cities where different schools had different messengers (back in the ICQ/MSN etc. days). In the end, people use what their circle of friends uses.

In Switzerland for example Threema is popular. In many countries you still can't really exist without Whatsapp. In China, Wechat. In Taiwan I believe you use Line if you want to have any friends (or reach businesses). In the US, iMessage with a fallback to SMS is popular, while it's rare in Europe because the SMS fallback would bankrupt you due to per-SMS charges.

Re: You can change your number

#399

Post by athrun »

itake wrote: post #397
toastercup wrote: post #262

Earlier quoted context omitted.

Nice. Sounds like the same rules apply to profile pictures as well. That feels like a step in the right direction, but it still means that by having family/coworkers/college buddies/etc in your contacts, they can see your profile picture and username. I know this can be a sticking point for some. It would be great if Signal introduced finer-grained privacy controls so it could appeal to an even wider audience.

You can download leaked phone numbers of millions of ppl and add them to your phone's address book (iOS limits contacts to 50k). I don't think this is very secure.

No, that would only allow them to see your name, but you still wouldn't see their names unless they add you.

Re: You can change your number

#400

Post by sneak »

ttybird2 wrote: post #393
sneak wrote: post #367

Earlier quoted context omitted.

Yes, but people in those countries can buy a US VoIP number from a US vendor for $2 and use that as their Signal number. You don't need to use a GSM number, and you don't need to use the country code in which you live. The fact is, mostly anonymous phone numbers are available on the internet for use with Signal, and Signal (correctly) does not discriminate on country code or "type" of number. Any number that can rece…

Could you suggest such a provider that accepts cryptocoins? I honestly was not aware that I could do that.

I have used jmp.chat before, but there are some hoops. I think dtmf.io once accepted cryptocurrency, as well.
Post reply on HN