Re:Signal is secure, as proven by hackers
by throwaway0x7E6 on Saturday October 08, 2022 @01:28AM
(#33130009)
>requiring out of band key exchange will add significant friction
how do you exchange phone numbers and email addresses with people?
>and make signal much less popular compared to the competition
is popularity among the (COMPLETELY) tech-illiterate worth giving up privacy for?
>I can't think of anything that would work as well and result in so many (40M monthly) people communicating securely.
and virtually everyone who had ever used the internet has an email, despite its apparently cumbersome sign-up and contact discovery procedures.
>surviving the death of your phone, ... , account recovery
are less likely if your account is tied to the phone number or email. they can be lost, they can be stolen, they can be seized.
I get the appeal, but seems like requiring out of band key exchange will add significant friction and make signal much less popular compared to the competition. I've got a few dozen signal contacts, only a few of them close enough to do a key exchange. If I only had a few, not sure I'd use signal.
Signal has been resisting making special cases for the few, and I get it. Why spend developer time on some feature that's not going to benefit the majority of users?
> the problem is that your phone number is your Signal identity, which is utterly moronic for a "privacy-first" service
I can't think of anything that would work as well and result in so many (40M monthly) people communicating securely. They do seem to be considering their options to help with this, in particular: https://signal.org/blog/secure-value-recovery/
Allowing social networks, surviving the death of your phone, frictionless on boarding, account recovery, etc all interact in complex ways.
Personally I like that there's not a contact database/social graph inside signal.