News for hackers. Stuff that matters.

A comment on Twilio incident: What Signal users need to know. Parent comment

Re:Twilio incident: What Signal users need to know by nobody9999 on Monday August 15, 2022 @03:59PM (#32474622)
>That doesn't make any sense. Signal did the total opposite. It started keeping sensitive user data in the cloud including your name, your photo, your phone number, and a list of your contacts. It stores that data on their servers permanently.

This is the first I've heard of that. And if it's true, it's a big problem.

Is there any documentation of this behavior that you can direct me to?

[ Parent | on HN ]
Re:Twilio incident: What Signal users need to know by autoexec on Monday August 15, 2022 @04:13PM (#32474787)
You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service.

https://community.signalusers.org/t/proper-secure-value-secu...

https://community.signalusers.org/t/what-contact-info-does-t...

https://community.signalusers.org/t/can-signal-please-update...

https://community.signalusers.org/t/dont-want-pin-dont-want-...

https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac...

[ Parent | on HN ]
Re:Twilio incident: What Signal users need to know by nobody9999 on Monday August 15, 2022 @04:56PM (#32475257)
>You aren't alone. There are a ton of people who have no idea Signal has been collecting and storing sensitive user data on their servers. There was a ton of discussion about it when the update rolled out and a lot of backlash from their users, which they ignored. They've since refused to update their privacy policy as well which I personally see as a canary warning users to avoid their service.

Edit: This bit is apparently not the case. And more's the pity.

====Section affected by edit=========

I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about.

==== End section affected by edit=========

Which isn't a new change (IIUC, PIN disablement was introduced ~2 years ago). I'd say that using the PIN functionality should be opt-in rather than opt-out, so in that respect I agree.

Further, Signal should probably update their policy documents to reflect the current state of affairs.

But I stand by my previous comment[1].

[0] https://support.signal.org/hc/en-us/articles/360007059792#pi...

[1] https://news.ycombinator.com/item?id=32474579

[ Parent | on HN ]
Re:Twilio incident: What Signal users need to know by autoexec on Monday August 15, 2022 @05:01PM (#32475325)
> I can't (and wouldn't try to) speak for anyone else, but if you disable the PIN functionality[0], Signal doesn't upload the information you're talking about.

This is also incorrect. If you opt out of setting a pin, Signal creates a pin for you and uses that to encrypt the data it uploads to their servers. Again, not your fault. Signal has gone out of their way to avoid answering direct questions about this in a plain way.

See: https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...

[ Parent | on HN ]