You are speaking of metadata as if all metadata is equal. Signal does collect phone numbers (even though, since usernames have been introduced [1], this can be made opt in from now on), but not the contacts or social graph, neither many other relevant metadata [2]. What they can gather from this, is only when the specified phone number registered to signal services and its last connection to the server [3].

So, if you can call "metadata exchanging app" an app that simply has a list of numbers registered to the service, without any metadata assigned to them except their last access, the same label could be assigned to a much larger number of services.

It may not be anonymous, but it can hardly be disregarded as private.

[1] https://signal.org/blog/phone-number-privacy-usernames/

[2] https://signal.org/blog/sealed-sender/

[3] https://signal.org/bigbrother/central-california-grand-jury/

>but not the contacts or social graph, neither many other relevant metadata [2].

Assuming you trust them (notice all your links point to signal.org own publications). Most of the privacy people are cautious/paranoid and assume that everything that can be collected is collected. Even assuming a lack of malicious intent, what's stopping NSA from hacking into Signal's infrastructure and logging who's talking to who along with timestamps? That's not to say I don't trust signal (it's the best mainstream solution right now), but it could do better to hide metadata from the protocol.

> Even assuming a lack of malicious intent, what's stopping NSA from hacking into Signal's infrastructure and logging who's talking to who along with timestamps?

Sealed Sender, the second link in the comment you've replied to. The indicator is off by default, but you can enable it under Settings → Privacy → Advanced. If I remember correctly, it doesn't work for the very first message you exchange with someone, but then it turns on and remains on.

In layman terms, it turns "from A; to B; content: <encrypted>" into "to B; content: <encrypted>". Their infrastructure doesn't need to know the "from" part to serve its purpose, so they strip it away.

If it was the other way around, they'd have to give that info to the (US) court. Same as any other US-based business, it's not optional, they can't ignore such requests, they can't lie, otherwise they'd be placing themselves in legal troubles for a random nobody that happens to be using their product. So, when I see this page, I fully believe them: https://signal.org/bigbrother/. If I didn't, my first step would be to look up those court cases from alternate sources.

The point is that you don't have to trust them because the client (where the relevant cryptography is performed) is open source and the fact that my links point to signal.org is completely irrelevant, those blog posts are just ways to advertise facts that are freely verifiable. You can read the source code to check the implementation of sealed senders or how the social graph is handled.

NSA can hack into Signal's infrastructure, and what they will be able to gather are the same information provided by Signal in reply to subpoenas (the whole list here https://signal.org/bigbrother/), because everything else is end-to-end encrypted.

Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time.

I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook messenger and others to adopt the same.

> Signal has launched support to use nicknames instead of phone numbers

You will still need a phone number to sign up for Signal. Signal still knows your phone number, you just hide it from your contacts. To me this only makes it even more suspicious.

You need a phone number to sign up for Telegram as well.

And you can correlate username to phone number not that hard in most standard setting cases.

Yeah, basically both super duper encrypted privacy oriented services want your phone number.

Sorry, but that's not privacy. I don't care what they do to encrypt your messages, they are still tied to me, which makes the super duper encryption pointless.

SimpleX is the best E2E chat app that doesn't require phone numbers (or even any account signup) that I've tried.

You compare apples with oranges. Because if you'd compare the apples , you'd notice one of them has no usable E2E.

Yes oranges umm phone numbers is a problem. They have that both. Only one can additionally read the contents.

Thats for now the price for a normie interface.

First goalposts first.

I agree with you that Telegram does not even have E2EE and that's bad.

But in this thread, GP was just talking about metadata. The goalpost here is metadata. GP particularly mentioned that Signal "fixed" the phone number issue and I just want to note that currently Signal isn't any better than Telegram in this aspect.

And then you moved orange back.

> Telegram does not even have E2EE

This is incorrect. Telegram has E2EE.

https://core.telegram.org/api/end-to-end

I don't see how I can start an E2EE chat from my PC. If a feature only ever exists on phone it does not exist.

https://github.com/telegramdesktop/tdesktop/issues/871

...in secret chats, that are only available in 1-to-1 conversations via mobile apps.

So, not on by default (unlike Signal), no group chats (unlike Signal), no support at all in desktop apps (you've guessed it: unlike Signal).

Not sure if you've got your sequence of events straight. End-to-end encryption was added to Whatsapp after it was bought by Facebook, before the co-founder of Whatsapp left to found Signal.

It's not as simple as Signal inspiring Facebook and Whatsapp, the sequence of events happened in reverse order.

I think this not wrong but mildly misleading.

Whatsapp started encrypting messages after significant security issues in ~2012

It was purchased by Facebook under initially some administration separation terms in ~2014?

In 2016 it added e2e encryption. If I recall this was controversial because it limits fb ad potential on users.

I guess what I'm trying to say is that the timeline seems to me to still be pointing towards <<e2e came from Whatsapp not FB as an initiative, even if FB owned Whatsapp at the time.>>

Again you're not factually wrong, but I hope my restating of the timeline makes it more clear why i I think your reverse order point doesn't tell the same story.

Your explanation is definitely better than mine. I just wanted to rebuke the notion that it was Signal who inspired Whatsapp to use e2e.

People has been killed based on metadata https://www.nybooks.com/online/2014/05/10/we-kill-people-bas...

No is arguing the metadata is harmless but it's significantly less of an issue than not having E2EE.

When they-them-those know who you are, knowledge of the full attack surface is the better way to compromise because it leaves the first step to compromise uncompromising-appearing. (The attack surface is broader than people generally consider, as it should include over-the-shoulder attacks, XKCD's wrench attack, etc.)

The success of such tactics can more easily be understood by even looking through the many, many comments right in this thread telling us Signal protects metadata because usernames are now a feature - guys, Signal has the metadata as the *services* are what is the topic of discussion here, not other users.

>> Signal has launched support to use nicknames

Wow, really? ICQ had that in 1996 ...

Signal is still a significant improvement in security and privacy over SMS, Telegram, Discord, X, Whatsapp... It achieved the level of privacy that solutions like PGP tried and mostly failed to achieve for decades. Being tied to a phone number was part of the convenience of their solution. Allowing for nicknames now, might improve on the metadata leakage problem slightly.

I'm sure reactionists will immediately drop Signal because Elon the great said they should without considering that it still might be their best solution to communicate privately with their friends and family. But X makes *all* of it's money from collecting a lot more than metadata from their users, Tesla collects driving data and metadata from all of its customers, Grok trains it's AI on all of the data collected from X, Tesla and other sources without asking if users want to opt out of those training datasets. So I'm not sure Elon has a leg to stand on in this conversation.

> I'm sure reactionists will immediately drop Signal because Elon the great said they should

Signal got a massive boost in popularity because "Elon the great" literally told people to "Use Signal".

Did it really, or did he just jump on the Signal train after it had already left the station? Can you tell the difference? I'm sure he drove some users to the platform, but the technology and the platform have mostly spoken for themselves.

But Signal specifically used phone numbers to leverage the already existing social graph on your phone. The numbers were never transferred or stored by Signal. You can literally see what information they gave when they were subpoenad: https://signal.org/bigbrother/central-california-grand-jury/

> to leverage the already existing social graph on your phone

I have little trust in an entity that "leverages the social graph" though...

Your encryption may be great, but if you act like Farmville I'm going to trust you as much as I trust those facebook games that spam your friend list.

If you read the PDF, the phone numbers are in the subpoena as the key for what's being requested, so yes they clearly were stored in a way Signal can access.

Your account phone number, yes. But, most importantly, Signal doesn't store your social network in its servers in a way that it could give authorities the phone numbers of all the people you communicate with. Or, worse, the times and dates of those conversations.

So all it can tell authorities is that a person with x phone number uses Signal and still uses it.

Signal has got Usernames now.

You can block number discovery.

You can't resolve username to number.

Your main account ID internally is not your number anymore.

If 2 users add you using 2 different links or usernames. Its now harder to confirm its the same account.

Tell me, can you have a Signal account WITHOUT giving them your phone number?

Can you sign up for Telegram without a phone number?

Yes: https://telegram.org/blog/ultimate-privacy-topics-2-0

Without "SIM card" and "without a number" are different things. Apparently you still need a number, a "blockchain-powered" number:

"[...] You can have a Telegram account without a SIM card and log in using blockchain-powered anonymous numbers available on the Fragment platform."

Irs super complicated to use. And you need an existing Telegram account to actually handle that cryptocurrency to buy these pseudo-numbers outside of the telephone namespace. Guess what you need to register those. An actual working phone number.

That's just buying a fake phone number, I don't see what would prevent you from using it with Signal the same way.

Not everyone is commenting on signal vs telegram here, it may just be an opinion that the phone number requirement is dubious from both entitites.

You still need a phone number to sign up

I'm not sure what the behaviour is now but certainly the default a while back was that anytime someone in your contacts joined Signal you would get a message. Imo this was a crazy behaviour that immediately told you something about certain people in your contacts in a very visible way (that they were on Signal). I couldn't tell from the settings whether this was now off by default.

Telegram has done and may still (I don't know personally) do the exact same thing. Stated noncombatively and without assumption about what argument you may or may not be making, but seems relevant to mention in this context. Astonishingly bad behaviour no matter which app!

Both do that.

As of a few weeks ago, you can hide your phone number on Signal, and it's even the default, even for existing accounts. You can even opt in to disable discovery by someone who already knows your number.[0]

> To me Telegram is going after WhatsApp, not Signal.

They mention Signal by name in the referenced post.

[0] https://signal.org/blog/phone-number-privacy-usernames/

Telegram also exchanges metadata. Only Sessions and Tox achieve full and decentralized privacy.

> Telegram doesn't enable E2E out of the box because it wanted users to compare some image matches in person (akin to the idea of PGP sign parties I suppose?)

That makes sense only in the context of e2ee to avoid MITM attacks, unless I'm mistaken.

> To me Telegram is going after WhatsApp, not Signal.

yeah exactly so what is actually going on here?