News for hackers. Stuff that matters.
Re:Signal Technology Foundation is now open for donations by oil25 on Thursday October 24, 2019 @07:02PM (#21350071)
> it insists on me giving more permissions to Google services

Can you clarify what you mean? I use Signal without Google Play Store/Services and am curious about said requirement.

> it relies on me a phone number as an ID

I dislike this also, but what's the alternative? A phone number is (usually) a long-lived, relatively immutable identifier which is convenient, memorable and portable. It is highly usable and that may be more important than other considerations.

Re:Signal Technology Foundation is now open for donations by h91wka on Thursday October 24, 2019 @07:11PM (#21350123)
> but what's the alternative

Making phone and e-mail optional, and being a tier-1 identity. That's what Matrix does.

Re:Signal Technology Foundation is now open for donations by maksim-m on Thursday October 24, 2019 @07:17PM (#21350159)
Then Signal have to store your social graph on the server in plaintext. It's not what's expected from a private messenger.
Re:Signal Technology Foundation is now open for donations by dbrgn on Thursday October 24, 2019 @07:41PM (#21350311)
Storing the social graph is not required at all. For example, Threema creates a random alphanumeric identity that is linked to your public key (instead of linking the phone number directly to your public key). It's possible to optionally link your hashed phone number and/or e-mail to your identity. Finding your friends can be done by comparing hashes of the data in your address book with the hashes linked to the identities. Those address book hashes never need to be persisted anywhere on the server, an in-memory comparison is sufficient, then the data can be thrown away. If you wish to stay anonymous, just ask people to add you manually by typing in your identity (or by scanning your public key QR code, which also results in verification / trust).
Re:Signal Technology Foundation is now open for donations by h91wka on Friday October 25, 2019 @03:52AM (#21352777)
Could you elaborate? I don't follow your reasoning here.
Re:Signal Technology Foundation is now open for donations by est31 on Thursday October 24, 2019 @09:32PM (#21350956)
> I use Signal without Google Play Store/Services

Can you talk about battery requirements? For me, it proved to be a major battery drain to the point I uninstalled Signal. I don't seem to be the only one with this issue [1].

[1]: https://github.com/signalapp/Signal-Android/issues/6898

Re:Signal Technology Foundation is now open for donations by mattl on Thursday October 24, 2019 @07:09PM (#21350116)
An email address? A username?
Re:Signal Technology Foundation is now open for donations by oil25 on Thursday October 24, 2019 @07:14PM (#21350142)
For most users, I think maintaining exclusive ownership of a phone number is much easier than securing their email account or a traditional username+password credential, so posit it's a natural fit for a secure mobile messenger.
Re:Signal Technology Foundation is now open for donations by jen_h on Thursday October 24, 2019 @09:33PM (#21350963)
It's not a natural fit for a secure mobile messenger if you want to stay anonymous. For some of us, security == anonymity. Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails.

And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.

Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:09AM (#21352084)
> For some of us, security == anonymity.

I don't follow. How is security equal to anonymity? If anything, security is what enables privacy, which could enable anonymity. There are plenty of circumstances where you need security, but not anonymity - for example a message to your partner. Of course if you do need anonymity, there's a lot more involved than simply installing a "secure app" or anything of that sort.

> Tying your identity to a phone number that can only be obtained by handing a telecom your government identity documents fails.

I don't know about that in the US. I was able to open a pre-paid T-Mobile account to use with my LineageOS Android device without identity verification. Perhaps it is different elsewhere now?

> And I don't know if anyone else has mentioned this, but uploading entire contact lists should also not be considered a natural feature of a secure mobile messenger.

That sounds troubling, is it what Signal does? Would like to read more about that - is there a Github issue for reference?

Re:Signal Technology Foundation is now open for donations by jen_h on Friday October 25, 2019 @01:38AM (#21352196)
I’ve got this crazy feeling that you’re not asking these questions in good faith, especially if you don’t understand how anonymity is important for people using secure messengers or need a Github issue to inform you about a feature long-discussed in the app.
Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:59PM (#21357539)
It was asked in good faith and I did explain my reasoning for why anonymity and security are different concepts. Have you got a citation for the claim that Signal "uploads entire contact lists" or was this just FUD?
Re:Signal Technology Foundation is now open for donations by jen_h on Friday October 25, 2019 @07:13PM (#21360152)
https://en.wikipedia.org/wiki/Signal_(software)#Contact_disc...

https://support.signal.org/hc/en-us/articles/360007319011-Ed...

https://signal.org/blog/contact-discovery/

But if you don't believe anonymity is an important component for security, you probably think hashes uploaded and deleted are perfectly secure, too, so we're probably not going to come to any agreement here.

Personally, I do wish they'd decouple from phone numbers and allow users an option not to transmit hashes for their entire contact list. I don't think these are unreasonable features for a messenger that's supposed to be designed for privacy and activism.

Re:Signal Technology Foundation is now open for donations by dbrgn on Thursday October 24, 2019 @07:43PM (#21350320)
Maybe for a secure messenger, but for a private one? It bugs me that I need to share my phone number with people that I want to contact on Signal, especially since Signal claims to focus on privacy. A private messenger should be usable anonymously, shouldn't it?
Re:Signal Technology Foundation is now open for donations by oil25 on Friday October 25, 2019 @01:03AM (#21352054)
> A private messenger should be usable anonymously, shouldn't it?

It would make a good feature, but anonymity is not a requirement for privacy. I want my connection to the bank's website to be private, but there's no need for it to be anonymous. Signal offers a lot of advantage over traditional SMS with familiar usability. It doesn't perfectly solve everyone's threat model for privacy and anonymity, and doesn't have to.