News for hackers. Stuff that matters.
Re:Signal v7.0.0 with phone number privacy by shp0ngle on Saturday February 17, 2024 @05:25PM (#39414106)
Signal will not publicly admit that, but they are using phone numbers as a cheap anti-spam measure. If anyone can sign up with an email, you will have same spam problems as with email, and will need to implement some spam filtering, and so on.

It's harder to spam with phones. Although, as they now do in Burma, they can just kidnap a lot of people from China and India and keep them as slaves and make them send spam from phones. But anyway that's a different story

Re:Signal v7.0.0 with phone number privacy by tptacek on Saturday February 17, 2024 @05:46PM (#39414267)
I feel like Signal has been up front for many years about why they use phone numbers, and I get incessant spam on other phone number platforms (most especially: phones) so I'm not sure that holds water.
Re:Signal v7.0.0 with phone number privacy by shp0ngle on Sunday February 18, 2024 @02:01PM (#39421971)
They seem to actually confirm it themselves, which I didn't know.

> We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account. This is a critical step in helping to prevent spam accounts from signing up for the service and rendering it completely unusable—a non-trivial problem for any popular messaging app.

From their blogpost

Re:Signal v7.0.0 with phone number privacy by tptacek on Sunday February 18, 2024 @02:11PM (#39422065)
I'm sure they absolutely do use it as a spam signal. You use what you've got. But that's not why they use phone number identifiers, which is a design decision they and others have written ad nauseam about.
Re:Signal v7.0.0 with phone number privacy by zx8080 on Saturday February 17, 2024 @06:23PM (#39414520)
They probably require phone numbers to be able to comply with the three-letter government agencies requirements and their requests on specific people. Metadata is specifically available "for free" (who calls/messages whom when).
Re:Signal v7.0.0 with phone number privacy by tonetegeatinst on Saturday February 17, 2024 @08:30PM (#39415262)
Source?
Re:Signal v7.0.0 with phone number privacy by vdqtp3 on Saturday February 17, 2024 @09:10PM (#39415472)
> Metadata is specifically available "for free" (who calls/messages whom when).

That's completely incorrect. Signal has only the following data (backed up by what they have provided when served warrants[1], and what internal FBI documents state about Signal[2]:

    Date and time a user registered.
    Last date of a user’s connectivity to the service.
[1] https://signal.org/bigbrother/central-california-grand-jury/

[2] https://propertyofthepeople.org/document-detail/?doc-id=2111...

Re:Signal v7.0.0 with phone number privacy by collinmcnulty on Saturday February 17, 2024 @09:16PM (#39415507)
This is simply not true. Signal implements sealed sender so they don’t know who is talking to who.
Re:Signal v7.0.0 with phone number privacy by halJordan on Saturday February 17, 2024 @10:19PM (#39415860)
Signal has released demands for information and what they provided in response to those demands. It's not a hard question, it's on their website. Don't let yourself be yet another conspiracy theorist.
Re:Signal v7.0.0 with phone number privacy by RandomBacon on Saturday February 17, 2024 @09:04PM (#39415435)
What if they allow non-phone-number-verified accounts to only place calls/texts to users only where the non-verified is already in that user's contacts?

That would prevent spam. The only people who would hear from the non-verified account is people who already took the effort to place the non-verified account username in their contacts.

(I've never used Signal and I have no idea what how it works.)

Re:Signal v7.0.0 with phone number privacy by 3np on Saturday February 17, 2024 @10:43PM (#39415971)
They've been pretty public about it. And it's not cheap.

> Registration Fees: $6 million dollars per year.

https://signal.org/blog/signal-is-expensive/

https://news.ycombinator.com/item?id=38291427

Re:Signal v7.0.0 with phone number privacy by simfree on Saturday February 17, 2024 @10:58PM (#39416052)
They pay Twilio through the nose for this service, compared to using other vendors that are less than a tenth the cost.
Re:Signal v7.0.0 with phone number privacy by fmajid on Sunday February 18, 2024 @08:26AM (#39418873)
Even Twilio has a hard time with deliverability of SMS due to spam blaclisting by carriers. There’s a reason why SMS delivery is so expensive, and why alternatives like WhatsApp want in on the action.
Re:Signal v7.0.0 with phone number privacy by simfree on Sunday February 18, 2024 @03:33PM (#39422919)
Twilio runs into the exact same text deliverability issues in the USA that everyone is experiencing, there is no reason to pay them a premium when they have no ability to influence. Whether or not your text is caught by AT&T, Verizon, T-Mobile, or US Cellular's spam filtering.

Avoid sending SHAFT content and shortened URLs if you don't want to get your text messages. Black hold or banned. S.H.A.F.T. is an acronym that stands for Sex, Hate, Alcohol, Firearms, and Tobacco

Re:Signal v7.0.0 with phone number privacy by fmajid on Sunday February 18, 2024 @05:43PM (#39424259)
Exactly, carriers have no way to know if a SMS comes from Twilio's legitimate or less legitimate clients, so they have to block everything. SMS is no longer the cash cow it used to be so tehy can't afford to spend lots of money on individual message moderation and have to adopt more crude blocking measures.

They should also add crypto to the list.

Re:Signal v7.0.0 with phone number privacy by pogue on Sunday February 18, 2024 @02:11AM (#39416896)
Whoa wait what? What's this about slavery?
Re:Signal v7.0.0 with phone number privacy by shp0ngle on Sunday February 18, 2024 @02:54AM (#39417093)
see https://edition.cnn.com/interactive/2023/12/asia/chinese-sca...

google kk park, fraud factory.

Burma/Myanmar is in a state of civil war, close to China and close to cheap Thai mobile internet access. Chinese started building fraud parks where they capture people and force them to serially scam people on fake bitcoin exchanges (it starts as online romance, turns to bitcoin scam). Mostly Chinese but also increasingly Europeans and Americans

nobody does anything because those fraud parks are tolerated by Burmese junta. They are on the border between Thailand and Burma

Re:Signal v7.0.0 with phone number privacy by fmajid on Sunday February 18, 2024 @08:29AM (#39418899)
David Rosenthal has more on the horrific backstory behind “pig-butchering” scams:

https://blog.dshr.org/2024/02/tracing-pig-butchers.html