Whittaker says that, for better or worse, a phone number remains a necessary requisite
Worse. It is for the worse. We sure did wait a long time for this half measure, Signal.
this post was submitted on 20 Feb 2024
212 points (98.2% liked)
Privacy
32173 readers
1839 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Is there a reasonable alternative, though? Email addresses? Adding a cryptographic challenge to prevent somebody from generating tons of accounts?
As far as phone numbers go, I'm not a big fan of Signal having them, but I definitely prefer not having to give them out! That change is a huge deal to me, as I can now communicate with people without handing them a phone number. And Signal has provided their client and server source code, along with evidence that their servers store absolutely nothing.
Nowadays, the most likely way your Signal data will get leaked is if somebody screenshots it.
Jami doesn't require a phone number, which is p2p. Xmpp (+ Omemo) doesn't require a phone number and it's federated... I mean, if a service is willing to rid of phone numbers, it'll do totally without them.
The challenge of having your device solve a nasty PoW that takes minutes would not deter most people: a timer once is better than evil captchas, phone numbers, etc. I don't understand why they use hCaptcha and not that.
If one computer can create a single spam account every few minutes, imagine how many total spam accounts could be created by a small farm of computers, in a single day.
A lot, but farming phone numbers from poor countries is also cheap and Signal sends them insanely expensive SMS. There is no perfect solution, spammers aren't stupid. Since Signal is centralised they can enforce PoW incrementally if they get reports for spam, I still think it is way better than hCaptcha which is garbage.
phone numbers for spam prevention are a bandaid for a mediocre solution. the mediocre aspect being that it's totally centralized when it should at least be federated like SimpleX. SimpleX is the ultimate solution to be honest with you, it's federated, fast, extremely private and extremely secure.
I don't mind SimpleX. I use it myself, sometimes. But it is also currently a very obscure service, and it's not exactly easy to find people to communicate with. Phone numbers, and now usernames, provide a jumping-off point for that.
How do you find people on SimpleX and then make sure you're talking to them in a group later on? Right now, that's really hard.
And right now, SimpleX is pretty small, so if it starts expanding in that first area, how would it prevent spam?
It’s the signal metadata that they want to keep associated with an identity
They still can fulfill government requests for who is talking to who and how often
Only the recipient number has been in the messages, so unless Signal servers have been compromised, and they've figured out how to associate sender IP addresses with phone numbers, and they've never been caught by the multiple government demands from them... I think it's fair to say
- they probably don't keep these logs, and
- they made it about as hard as possible to do
Got proof for that last claim?
I thought their sealed sender feature was meant to prevent exactly this scenario.
Maybe use a VOiP for verification?
Fucking beta release . I'm not making google account to download the apk
Slim shady
Signal is one of those apps that is good because it is popular and old.
However, they need to step up there game if they want to compete with other messagers.
Its also the only really free messenger. Free as in freedom and no money.
- Session
- Briar
- Simplex Chat
- Jami (unproven)
I use Jami daily. The pro is that it is completely decentralised: it doesn't need a server to run, all communications are over DHT. The cons is that not all messages are delivered instantly, and both sender and recipient need to be online at the same time.
Be careful as its not been audited
I am not expecting security from it, just complete decentralisation.
Yeah mainstream messenger that other people have. I personally like briar but it sucks my battery dry in houra.