News for hackers. Stuff that matters.
Re:Signal is secure, as proven by hackers by 8organicbits on Friday October 07, 2022 @12:51PM (#33123856)
Is there another technique for effortlessly bootstrapping a contact list? Finding someone requires some kind of lookup/search. Using PII makes a lot of sense because that's how people identify each other. Anything out-of-band is quite complex.

If I told my mom to install some app and we'd connect to each other using some random IDs, we'd probably still be using SMS.

Re:Signal is secure, as proven by hackers by andai on Friday October 07, 2022 @01:18PM (#33124267)
>If I told my mom to install some app and we'd connect to each other using some random IDs, we'd probably still be using SMS

This is surprising to me, since it was my mother's generation that got me into Skype (where you have to manually add the other person by their username), almost twenty years ago.

Re:Signal is secure, as proven by hackers by andai on Friday October 07, 2022 @01:16PM (#33124235)
A Signal support claims "The Signal service does not have any knowledge of your contacts."

Can someone explain how this is possible? How does my phone know when to notify me that a friend has joined signal?

Edit: apparently it's "private contact discovery", I need to give this a proper read later.

https://signal.org/blog/private-contact-discovery/

Re:Signal is secure, as proven by hackers by palata on Friday October 07, 2022 @02:26PM (#33125113)
Yes, their blog posts are really good. Read about the sealed sender, too! And then realise that even with sealed sender, if you send from your home IP, then you are identifiable. So you should send from a reasonably anonymous IP (w.r.t. your threat model)
Re:Signal is secure, as proven by hackers by brandonr49 on Friday October 07, 2022 @02:01PM (#33124820)
I will never get over the fact that the Nintendo Switch operated on random character strings to find friends rather than usernames or something more straightforward for normal users. But the fact that they managed it does mean it's not so large a barrier.
Re:Signal is secure, as proven by hackers by lloeki on Friday October 07, 2022 @03:05PM (#33125580)
I guess it works because people think of it as if they were phone numbers, plus it removes the barrier of having to choose a username. See also the now defunct ICQ which was fairly popular even outside of tech circles.