News for hackers. Stuff that matters.
Re:Twilio incident: What Signal users need to know by teraflop on Monday August 15, 2022 @01:50PM (#32472938)
After countless discussions of Signal on HN, I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list. Surely, in either case the identifier can be treated as an opaque string, right?

Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break? By saying "without phone numbers, they can't use clientside contact lists", you seem to be suggesting that something would break, but I can't imagine how, unless it's as trivial as a database constraint that says "this field must contain only digits".

Re:Twilio incident: What Signal users need to know by tablespoon on Monday August 15, 2022 @02:11PM (#32473236)
> Or in other words: suppose the definition of "phone number" was expanded to include alphanumeric characters and @. What aspect of Signal's current design would break?

I feel like you're mis-analyzing a social problem or some other design goal as a low-level technical problem.

I don't know their real reason, but I can say that my email contact list is waaay messier and less curated than my phone contact list. It would probably be annoying is I'd get a "So-and-so joined Signal!" notification for a bunch of randos I've emailed once and had their email auto-added to my address book.

Re:Twilio incident: What Signal users need to know by teraflop on Monday August 15, 2022 @02:24PM (#32473388)
That seems like a problem that could easily be solved by sending fewer notifications. Do I really need to know if somebody has joined Signal until I actually want to talk to them? Isn't it better to have a larger pool of people with whom I can communicate securely using Signal?

I'm mostly just confused because this is being presented as a technical limitation: using email addresses would supposedly "require Signal to keep a database of contacts serverside". I don't understand how or why that's true.

Re:Twilio incident: What Signal users need to know by tablespoon on Monday August 15, 2022 @05:07PM (#32475387)
> That seems like a problem that could easily be solved by sending fewer notifications. Do I really need to know if somebody has joined Signal until I actually want to talk to them?

I don't know what the real reason is, what I said was just something that popped into my head. Another comment mentioned spam-prevention as a reason (by making it infeasibly expensive), and that actually makes more sense. Honestly, there probably isn't just one reason, but a cluster of tradeoffs.

> Isn't it better to have a larger pool of people with whom I can communicate securely using Signal?

IMHO, the number people who care deeply enough about the phone number thing to boycott Signal is vanishingly small; not even a rounding error. Sure they're loud on HN or maybe even Twitter, but giving tiny but loud minorities whatever they demand is bad policy.

Re:Twilio incident: What Signal users need to know by teraflop on Monday August 15, 2022 @05:34PM (#32475691)
Sorry, just to clarify: I didn't mean "it's better if people who don't want to give out their phone number can use Signal" (although I happen to think that's also true).

What I meant was: "it's better if I can use Signal to communicate with people even if all I know is their email address".

Re:Twilio incident: What Signal users need to know by veeti on Monday August 15, 2022 @02:43PM (#32473606)
Of course there is no real reason Signal should be spamming anybody with these crap "notifications" in the first place. Who wants to wake up at 1 AM to know some dude they texted years ago is now on Signal?
Re:Twilio incident: What Signal users need to know by stormbrew on Monday August 15, 2022 @04:36PM (#32475029)
> I'd get a "So-and-so joined Signal!" notification for a bunch of randos

One of the reasons I wish I could use something other than my phone number and access to my contact list to work with signal is these notifications creep me the fuck out and I would rather never get them, or have anyone get them about me.

I'm fine with it being a feature for people who want it, but I don't. I want to make my own damn choices about who I talk to through it.

Re:Twilio incident: What Signal users need to know by verall on Monday August 15, 2022 @03:34PM (#32474239)
Noone wants those messages
Re:Twilio incident: What Signal users need to know by spurgu on Monday August 15, 2022 @02:09PM (#32473206)
> I have yet to see an explanation for why Signal can use phone numbers from a client-side contact list, but not email addresses from a client-side contact list

OS functionality? There no "Grant access to Gmail contacts" (= email addresses) on Android/iOS, so that client-side list would have to be manually maintained, while (practically) everyone already has a contact list containing phone numbers of their friends.

That said I don't see why a user would have to have a stored social network at all, why can't it simply be opt-out?

Re:Twilio incident: What Signal users need to know by teraflop on Monday August 15, 2022 @02:21PM (#32473361)
At least on Android, any application that I give permission to access my contact list can see email addresses for the client-side contacts that are synced with my Gmail account. Maybe iOS behaves differently?
Re:Twilio incident: What Signal users need to know by spullara on Monday August 15, 2022 @02:07PM (#32473172)
People don't have email addresses in their contact lists because all their email contacts are stored on Google servers.
Re:Twilio incident: What Signal users need to know by xorcist on Monday August 15, 2022 @03:02PM (#32473813)
Having the ability to identify by other strings than "phone number" wouldn't take away any functionality, just add it. It would be possible to communicate with devices that have email but not phone numbers (children without SIM cards, for example).

But this is all moot because phone numbers aren't just opaque binary strings. They are more useful than other forms of identification.

Re:Twilio incident: What Signal users need to know by spullara on Wednesday August 17, 2022 @02:29PM (#32499968)
That isn't why Signal uses phone numbers. It uses phone numbers because users have a local list of phone numbers they communicate with and Signal can use that to determine if people you communicate with are on Signal. If there was a reliable local list of email addresses they could use that but most people use cloud email now and don't have their email addresses they communicate with on their device.