News for hackers. Stuff that matters.
Re:Signal Technology Foundation is now open for donations by neiman on Thursday October 24, 2019 @06:57PM (#21350044)
I would love to use Signal, but I have two issues with it.

One, it insists on me giving more permissions to Google services, where it's very difficult to go around this requirements.

But worse, it relies on me a phone number as an ID. I keep changing my phone number, I don't wanna share my phone number, and I really think that the computer in my pocket should finally be completely separated from this old concept of a phone. Please give me another way to open a Signal account.

Re:Signal Technology Foundation is now open for donations by el_dev_hell on Thursday October 24, 2019 @07:46PM (#21350334)
> But worse, it relies on me a phone number as an ID

This is the sole complaint I have with Signal (and one of many complaints with Telegram).

It's impossible to create an anon account, which I imagine would be very important for someone needing a secured messaging service in mainland China, for example.

Re:Signal Technology Foundation is now open for donations by cartoonworld on Friday October 25, 2019 @12:01AM (#21351755)
I really love signal and I, too, fully agree with this sentiment.

I have managed to keep a phone number for almost double-digit years. It would be amazing to not have to use my telco as the source of identity for my Signal communications. If Signal could change this one thing and allow (or maybe somehow prefer?) it to be linked to a mobile number it would have real feature advantages over all of the other random chat apps for phones. Signal call quality is jaw droppingly good, but thats hard to sell at the gas station or water cooler.

As it stands people I refer to Signal usually have a preferred chat app (which is unfortunately often facebook messenger) or SMS. IOS people have no reason to use it other than the amazing privacy benefits, and android people seem to be on whatever their mom isn't.

I would pay to not have to use my phone number for this service.

Re:Signal Technology Foundation is now open for donations by goatsi on Friday October 25, 2019 @12:28AM (#21351890)
You think making contact discovery much more difficult for people will make them more likely to select Signal as their preferred chat app? Especially if you are asking them to replace Facebook Messenger. If they are willing to message people using their real name, I don't think hiding their phone number from them will be a great draw.
Re:Signal Technology Foundation is now open for donations by cartoonworld on Friday October 25, 2019 @09:33PM (#21361003)
I totally agree, but I also totally disagree that supporting this alternate use case will make the app worse for naive, regular users to discover their grandma is on Signal.

Im asking for an alternative canonical source of identity other than an extremely trustworthy telco.

Some other conglomerated examples are: Scanning a QR code in person to initiate discovery, or querying other data in the phone's "contacts" PIM app for example, email, or more imaginatively, keybase, or maybe mail out QR codes to residential address for a nominal fee?

Re:Signal Technology Foundation is now open for donations by jammygit on Thursday October 24, 2019 @09:13PM (#21350859)
If could be very relevant for journalists in general. I wonder if they just use burner phones in conjunction with it
Re:Signal Technology Foundation is now open for donations by jtl999 on Thursday October 24, 2019 @08:16PM (#21350502)
I wish Signal would have a decent desktop client. I spend most of the time on a standard "computer" and not on my phone, and I'm sure others do as well.
Re:Signal Technology Foundation is now open for donations by faitswulff on Thursday October 24, 2019 @09:36PM (#21350986)
What is the desktop client missing? I use it every day.
Re:Signal Technology Foundation is now open for donations by johnchristopher on Friday October 25, 2019 @04:34AM (#21352977)
One of my main correspondent has memory leaks with signal desktop and messages sync between my android phone, Windows and Linux is all out of whack.
Re:Signal Technology Foundation is now open for donations by _Codemonkeyism on Friday October 25, 2019 @12:49AM (#21351996)
My has often problems seeing messages on her desktop client while they do appear on her phone.
Re:Signal Technology Foundation is now open for donations by 0x006A on Friday October 25, 2019 @05:18AM (#21353201)
the desktop client only supports chat, no audio / video calls.
Re:Signal Technology Foundation is now open for donations by Mengkudulangsat on Thursday October 24, 2019 @09:39PM (#21351006)
Wouldn't we have to wait for Decentralized Identifiers for that? I doubt the OSS project can do customer service when things go wrong.
Re:Signal Technology Foundation is now open for donations by oil25 on Thursday October 24, 2019 @07:02PM (#21350071)
> it insists on me giving more permissions to Google services

Can you clarify what you mean? I use Signal without Google Play Store/Services and am curious about said requirement.

> it relies on me a phone number as an ID

I dislike this also, but what's the alternative? A phone number is (usually) a long-lived, relatively immutable identifier which is convenient, memorable and portable. It is highly usable and that may be more important than other considerations.

Re:Signal Technology Foundation is now open for donations by h91wka on Thursday October 24, 2019 @07:11PM (#21350123)
> but what's the alternative

Making phone and e-mail optional, and being a tier-1 identity. That's what Matrix does.

Re:Signal Technology Foundation is now open for donations by maksim-m on Thursday October 24, 2019 @07:17PM (#21350159)
Then Signal have to store your social graph on the server in plaintext. It's not what's expected from a private messenger.
Re:Signal Technology Foundation is now open for donations by dbrgn on Thursday October 24, 2019 @07:41PM (#21350311)
Storing the social graph is not required at all. For example, Threema creates a random alphanumeric identity that is linked to your public key (instead of linking the phone number directly to your public key). It's possible to optionally link your hashed phone number and/or e-mail to your identity. Finding your friends can be done by comparing hashes of the data in your address book with the hashes linked to the identities. Those address book hashes never need to be persisted anywhere on the server, an in-memory comparison is sufficient, then the data can be thrown away. If you wish to stay anonymous, just ask people to add you manually by typing in your identity (or by scanning your public key QR code, which also results in verification / trust).
Re:Signal Technology Foundation is now open for donations by h91wka on Friday October 25, 2019 @03:52AM (#21352777)
Could you elaborate? I don't follow your reasoning here.
Re:Signal Technology Foundation is now open for donations by est31 on Thursday October 24, 2019 @09:32PM (#21350956)
> I use Signal without Google Play Store/Services

Can you talk about battery requirements? For me, it proved to be a major battery drain to the point I uninstalled Signal. I don't seem to be the only one with this issue [1].

[1]: https://github.com/signalapp/Signal-Android/issues/6898

Re:Signal Technology Foundation is now open for donations by mattl on Thursday October 24, 2019 @07:09PM (#21350116)
An email address? A username?
Re:Signal Technology Foundation is now open for donations by oil25 on Thursday October 24, 2019 @07:14PM (#21350142)
For most users, I think maintaining exclusive ownership of a phone number is much easier than securing their email account or a traditional username+password credential, so posit it's a natural fit for a secure mobile messenger.
Re:Signal Technology Foundation is now open for donations by jen_h on Thursday October 24, 2019 @09:33PM (#21350963)
It's not a natural fit for a secure mobile messenger if you want to stay anonymous. For some of us, security == anonymity. Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails.

And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.

Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:09AM (#21352084)
> For some of us, security == anonymity.

I don't follow. How is security equal to anonymity? If anything, security is what enables privacy, which could enable anonymity. There are plenty of circumstances where you need security, but not anonymity - for example a message to your partner. Of course if you do need anonymity, there's a lot more involved than simply installing a "secure app" or anything of that sort.

> Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails.

I don't know about that in the US. I was able to open a pre-paid T-Mobile account to use with my LineageOS Android device without identity verification. Perhaps it is different elsewhere now?

> And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.

That sounds troubling, is it what Signal does? Would like to read more about that - is there a Github issue for reference?

Re:Signal Technology Foundation is now open for donations by jen_h on Friday October 25, 2019 @01:38AM (#21352196)
I’ve got this crazy feeling that you’re not asking these questions in good faith, especially if you don’t understand how anonymity is important for people using secure messengers or need a Github issue to inform you about a feature long-discussed in the app.
Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:59PM (#21357539)
It was asked in good faith and I did explain my reasoning for why anonymity and security are different concepts. Have you got a citation for the claim that Signal "uploads entire contact lists" or was this just FUD?
Re:Signal Technology Foundation is now open for donations by jen_h on Friday October 25, 2019 @07:13PM (#21360152)
https://en.wikipedia.org/wiki/Signal_(software)#Contact_disc...

https://support.signal.org/hc/en-us/articles/360007319011-Ed...

https://signal.org/blog/contact-discovery/

But if you don't believe anonymity is an important component for security, you probably think hashes uploaded and deleted are perfectly secure, too, so we're probably not going to come to any agreement here.

Personally, I do wish they'd decouple from phone numbers and allow users an option not to transmit hashes for their entire contact list. I don't think these are unreasonable features for a messenger that's supposed to be designed for privacy and activism.

Re:Signal Technology Foundation is now open for donations by dbrgn on Thursday October 24, 2019 @07:43PM (#21350320)
Maybe for a secure messenger, but for a private one? It bugs me that I need to share my phone number with people that I want to contact on Signal, especially since Signal claims to focus on privacy. A private messenger should be usable anonymously, shouldn't it?
Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:03AM (#21352054)
> A private messenger should be usable anonymously, shouldn't it?

It would make a good feature, but anonymity is not a requirement for privacy. I want my connection to the bank's website to be private, but there's no need for it to be anonymous. Signal offers a lot of advantage over traditional SMS with familiar usability. It doesn't perfectly solve everyone's threat model for privacy and anonymity, and doesn't have to.