Reminder that while apps like signal are more convenient for every day use, if you want to have a way to message certain people when communications are being blocked, you should setup Briar[1] with your friend group. It connects over Tor when you have internet access, but can also pass messages ad hoc over WiFi or bluetooth, so that messages can be distributed across a group.

1. https://briarproject.org/

Disaster radio through LORA https://disaster.radio/learn/hardware/ 15 to 30 euros for hardware, 20 for antenna, 10 to 95 km range. Also https://meshtastic.letstalkthis.com/

I'm unfamiliar with radio tech but is the date being sent over these radios encrypted?

Meshtastic is encrypted.

Is the data transmitted over copper/Ethernet encrypted?

GP's question is legitimate: with e.g. amateur radio, in the US at least, (privately) encrypted communications are legally prohibited.

Regardless, please avoid snark on HN. It does not add value to the conversation.

It's called the Socratic method. The snark is in your head.

Encrypted digital transmission over Lora is legal in the US.

I want to love these things but the first one appears to be unfinished, and the second has hardware you have to assemble and then depends on an android app that appears to be quite flaky from the reviews. I would very much like a radio enabled encrypted communications system to complement Briar, but both of these look extremely iffy currently.

Since there is no obvious disclaimer on the page, I'll add one here for good measure: In most jurisdictions, broadcasting on long-range frequency bands is not permitted without a license. I absolutely encourage people to get involved in this topic, but don't forget to check your local regulations.

Regarding regulations LORA tries to address that problem, from Wikipedia:

LoRa uses license-free sub-gigahertz radio frequency bands like 433 MHz, 868 MHz (Europe), 915 MHz (Australia and North America), 865 MHz to 867 MHz (India) and 923 MHz (Asia).

I wouldn't exactly call those long range frequencies. 20m minimum, moving into 40m, 80m, and 160m for global coverage.

There should be a really wide (geographically), and at the same time not too sparse network of Briar users for sending messages with it to make sense practically.

This seems very much like APRS wrapped in encryption, no?

That is so cool.

This one person--with no people responding "also me!"--says they were logged out of multiple services in different jurisdictions at once, so while the underlying issue of a login mechanism somehow tied to SMS access is certainly an issue, I personally, so far as makes sense from this one data point, find it unlikely that this had anything to do with the coup.

This is a very valid point.

If you're logged into at least one device with telegram, the sign in code for the a device first comes to the logged in device, instead of coming via SMS. The 6 digit code comes from a verified 'Telegram' account over the internet, thus avoiding the security or connectivity issues of SMS.

Yes but if soemone else interfere sms they can effectively reset the account

You cannot terminate older sessions from a newer device immediately. There is a waiting period to delete the other sessions or delete the account.

No I mean if you forget your 2fa they allow you to start from scratch

Did Signal give solid reasoning for disallowing accounts and usage without an attached cell phone number? (I assume the question comes up frequently, but I don't know the answer)

Moxie has publicly tweeted that they're working on supporting Signal without phone numbers, e.g. here [1] and here [2]:

[1]: https://twitter.com/moxie/status/1280904362999476226

[2]: https://twitter.com/moxie/status/1348031542606454785

Using phone numbers as identifiers for encrypted messages is the core feature of Signal. It was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was literally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.

The problem is that in the years since Signal was launched like that, more and more countries around the world are requiring you to show ID to buy a SIM card, and then a copy of that ID is made and sent on to the authorities. So, the state has a one-to-one correlation between phone numbers and individuals, and so it can see who is using Signal.

So? Signal is just a messaging client. The goal of Signal is to get it widely used by as many people as possible, so that it's a totally normal thing to have on your phone.

If a country has gotten to the point that you would be targeted just for having an app installed, just changing to usernames wouldn't be enough, as users could be easily detected through network logging (thanks AWS and Google for killing domain fronting [0]). Your usecase sounds like it needs an app like Briar.

[0] https://news.ycombinator.com/item?id=16970199

> Signal is just a messaging client.

It's pushed as a secure messaging client, and so when it doesn't meet the standards for that people will mention it so potential users have the information needed for a risk assessment.

Security =/= Anonymity.

Only phone numbers: your own contact list IS the social graph. You lose your SIM card, you lose your friends.

Usernames: Signal needs to store your social graph (in a privacy preserving fashion) on a central server.

So, paradoxically, phone numbers were the easiest and most secure option to start with.

This is the core routing issue. If you don't have centralized system to locate a "user", then the only alternative is to broadcast all messages to everyone, which is not a scalable solution.

Actually, there must be methods for distributed routing. How does TOR finally map a hidden service to an IP address?

Maybe there can be a dynamic DNS service for user accounts on an anonymous messaging network?

Distributed Hash Tables

I think it was (1) fighting spam and (2) the social graph already exists due to contact books.

I think officially it’s just (2) and (1) is just a side effect, but I think it’s secretly more about (1)

From what I gather, the phone number is only used for identification of a user account. Can't exactly remember where I came across this information (probably an ama from their team on reddit) but Signal have recently said they are looking for ways to make the above not a requirement for its users.

I don't see this sim lockdown being a problem unless you want to create a new account or for some reason your account has been logged out requiring 2FA. In my understanding, telegram also asks for SMS for 2FA on re-login. Though the 2FA code will be simultaneously sent to any other device you've logged the account in.

I got $10 verizon prepaid and set up my whatsapp and signal that way.

Unfortunately in many countries even prepaid SIM cards are directly tied to government ID verification. I know this has been discussed many times, but I agree that it would be nice to be able to use Signal for secure communications without a phone number.

I find it interesting that Germany is one country which does this. A country which has strict privacy regulations and people prefer to use cash rather than cards, but they are happy to carry a device which can track their every movement and is tied to their government identification. This isn't an EU thing, there are quite a few EU countries where you can buy and activate a SIM without any ID.

Have there been any cases where the people have spoken out against such regulations, and they have been reversed?

The history of terrorists using pre-paid SIMs/phones for both coordination and remote bomb detonation has necessitated this.

Horse hockey. They'll still do the same thing, there'll just be larger networks of individuals who activate a SIM and then swap it with someone else. The terrorist excuse is no excuse at all. It's just a pragmatist's paving stone on the path to hell and tyranny.

That seems kind of silly given you can easily buy a SIM card from eBay for another country that doesn't have such requirements.

I wonder what caused force log out in the first place? I have a Signal account logged in and then SIM card was removed from the phone, and Signal still works (of course I'm not in MMR).

This is why using multiple burner SMS accounts from various countries, I understand why most apps use filters of known SMS numbers but this is why this can be a pretty big deal.

Sometimes you can get logged out going from wifi to LTE/mobile data on either of those apps, I have had that happen, and this can create issues like this which means you will have to create another account and may not have your contact list etc... which is impossible if you're trying to use your mobile number you use.

It's kind of crazy that all of our over-paranoid back ups and ad-hoc solutions have been so damn necessary for even the normal person in the last 10 years, be it PgP, burner sms numbers, cryptocurrency, apps like TG and Signal etc...

As some have mentioned Moxie said he wants to move away from phone based accounts, and now that Elon sent him a ton of new users from all walks of Life that this may need to be accelerated, which from what I garnered from his podcast with JR it's just not well staffed and is in need of some your guys' talents.

It’s difficult to get burner SMS numbers and also to activate a SIM from abroad.

Some eBay traders will sell activated SIMs but you are essentially trusting a third party.

> It’s difficult to get burner SMS numbers and also to activate a SIM from abroad.

Agreed, to an extent.

But not if you know how to do the legwork; I have 4 active Telegram/Signal accounts on sveral devices using apps that allowed me to register and acquire a US/EU based mobile number.

I completely lost al ofl those passwords and access to those old numbers (didn't use them after activation years ago) but it certainly is possible if you do the legwork.

How would that happen?

I’m not sure. For the record, it could just be a bug or an unexpected edge case, not necessarily a specific government intervention, but regardless it does seem more fragile than it should be considering Signal’s ethos.

For the military to have done that on purpose they would have to have had external help with planing. It's to high level.

So I'd assume accidentally with something about the cell phones changing making Signal and Telegraph want to re-authenticate.

Or the person has cleared their phone for obvious reasons which also logged them out.

Not sure if this is relevant but the Tatmadaw are majority owners of Mytel, which has one of the largest networks in subscriber base and hardware infrastructure. They never really gave up control of Myanmar in a strategic sense.

OK I'm really confused why no one points out that signal allow you to block registration over your number.

If you are afraid of government interferance and too lazy to usw xmpp/Matrix why wouldn't you configure at least signal securely?

Threema does not have this issue. If it would be free it would be a better choice as it does not need a mobile number. For people in the west the cost is so low but still many refuse because it 'should be free'.

We've banned this account for flamewar. That's not ok regardless of which side you're flaming for.

See https://news.ycombinator.com/item?id=25986226.

There’s a difference between “not working” and “my device’s authentication token was revoked.” She notes that WhatsApp continues to work.

That's as good a sign as any that you shouldn't be using Whatsapp.

...yes, that is a perfectly normal conclusion to draw.

To spell it out, if whatsapp were considered a threat they'd block it just like they block Signal.

Not necessarily. It could be that whatsapp is popular enough that blocking it would increase the risk to this regime more than not blocking it.

Its Burma, the guy is lucky to have electricity and a phone signal in the first place...