- kvjxq ( @kvjxq@beehaw.org ) 19•2 years ago
It’s abominable that Signal still requires a phone number.
- AgreeableLandscape ( @AgreeableLandscape@lemmy.ml ) 14•2 years ago
How else are they going to track you?
No, seriously. Even if the messages are encrypted, the metadata including your account info and the account info of everyone you talk to are not. In a lot of these cases, they don’t have to have the actual contents of the messages to have a pretty clear picture of what you might be talking about!
With a phone number that’s almost certainly registered to your real identity, it makes it trivial to track what you as a person is doing even without breaking the encryption! An encrypted messenger that requires anything related to your real identity to get an account is security theatre.
For example: if you suddenly start messaging back and fourth with an account, and that account happens to have the same phone number as the one on the business card and website of an out of state abortion clinic worker, and your own phone number’s area code just so happens to fall in a state that banned abortions after Roe v Wade got trashed, it juuuust might imply a few things about you. They can’t definitively prove what the messages were, but if your state criminalizes any and all attempts to get an abortion anywhere, it’s probably enough to get a warrant against you.
- noodlejetski ( @noodlejetski@lemmy.ml ) 6•2 years ago
luckily, from the warrants they’ve received in the past we know that they don’t store metadata, and the only information about the requested numbers that they’ve been able to provide to the court were the date of registering an account and the last time they were online, both in Unix epoch format: https://signal.org/bigbrother/
- ☆ Yσɠƚԋσʂ ☆ ( @yogthos@lemmy.ml ) 6•2 years ago
You have to keep the bigger context in mind here. Even if Signal only tracks your phone number, it can be easily correlated with other data that’s associated with you that’s aggregated from your online footprint.
- ᗪᗩᗰᑎ ( @KLISHDFSDF@lemmy.ml ) 5•2 years ago
What viable user-friendly (i.e. no account creation required) options are there? I just want my messages between friends and family to not be mined by greedy corporations.
- thervingi ( @thervingi@lemmy.ml ) 4•2 years ago
Matrix is pretty good.
- AgreeableLandscape ( @AgreeableLandscape@lemmy.ml ) 2•2 years ago
Briar?
- ree ( @ree@lemmy.ml ) 2•2 years ago
What you wrote is simply wrong.
Signal encrypt metadata to the best of their capacity. On the contrary matrix, xmpp, telegram, WhatsApp don’t (unless sth changed since last year)
For example on my matrix server I could read the IP, username and time of each message.
This is what they tell you. Since signal isn’t self-hostable or federated, you can’t verify that.
- ree ( @ree@lemmy.ml ) 2•2 years ago
As far as i understand this is a client side implementation. So it’s verifiable.
- Akimoto ( @Akimoto@lemmy.ml ) 7•2 years ago
They probably do it to prevents spam/abuse. It is supposed to be a better WhatsApp after all, not a completely federated software. So it gotta be somewhat user friendly.
- Democracy ( @Democracy@lemmy.ml ) 5•2 years ago
What? It’s easier for spammers/scammers to enumerate phone numbers (because they follow a specific pattern) than usernames or random IDs.
- AgreeableLandscape ( @AgreeableLandscape@lemmy.ml ) 6•2 years ago
Probably referring to that it’s harder for scammers to create scam accounts because they need to verify the phone number is actually theirs before the account can send messages. IMO, still not worth requiring a phone number for the 90% of legitimate users.
- thervingi ( @thervingi@lemmy.ml ) 4•2 years ago
There are websites online that offer 10 minute phone numbers.
- AgreeableLandscape ( @AgreeableLandscape@lemmy.ml ) 3•2 years ago
Not sure if Signal does this, but most websites will automatically look up the phone number registration, see that it’s from one of those companies, and reject it.
- Democracy ( @Democracy@lemmy.ml ) 2•2 years ago
There are these services still around.
https://sms24.me/en/messages/Signal
You’ll notice most numbers aren’t from US. The ability to detect VoIP numbers only applies to NA.
- snek_boi ( @snek_boi@lemmy.ml ) 15•2 years ago
I tried finding the GitHub issue that asks for Signal to stop relying on phone numbers. I can’t find it. Do you [whoever is reading this] know where the issue is at?
- OsrsNeedsF2P ( @OsrsNeedsF2P@lemmy.ml ) 8•2 years ago
Github Issues are only for bug reports, the Username feature is tracked here https://community.signalusers.org/t/usernames-in-signal/9157
- WiνΛlem OrtΛνíz ( @w_ortiz@beehaw.org ) 2•2 years ago
Now you can request “enhancements” too in the issue section. See https://github.com/LemmyNet/lemmy-ui/issues
- OsrsNeedsF2P ( @OsrsNeedsF2P@lemmy.ml ) 3•2 years ago
That’s… nice but I’m talking about how Signal handles Github issues
- WiνΛlem OrtΛνíz ( @w_ortiz@beehaw.org ) 1•2 years ago
My bad, I thought enhancement requests were widespread all around Github, because I didn’t check how Signal handles issues there.
- thervingi ( @thervingi@lemmy.ml ) 11•2 years ago
You can care about privacy, or you can ask a phone number during sign up. Those things are mutually exclusive.
Don’t use Signal you care about privacy.
- OsrsNeedsF2P ( @OsrsNeedsF2P@lemmy.ml ) 24•2 years ago
Don’t let perfection be the enemy of good. All my friends and family use Signal, it was a multi-year effort to pull that off. Signal will roll out usernames faster than the tide will turn, so let’s take our wins and learn to be better.
- ree ( @ree@lemmy.ml ) 11•2 years ago
Yhea.
I can almost exclusively chat with my social circle with signal now, been using it since 8-9 years.
I’ve tried xmpp, matrix and some other. Signal is the only one that stuck, it’s not perfect but it’s fucking fine from my perspective.
- thervingi ( @thervingi@lemmy.ml ) 2•2 years ago
This is my argument for Telegram. It’s clients are open source and has good Linux support. And unlike Signal it’s actually nice to use. (non-tech people usually dislike using Signal, but the feedback from Telegram is very positive)
- XpeeN ( @XpeeN@sopuli.xyz ) 2•2 years ago
Except e2ee isn’t on by default at telegram.
- thervingi ( @thervingi@lemmy.ml ) 1•2 years ago
That’s why I prefer Matrix. But it’s hard to convince people to use Matrix so Telegram it is.
- WiνΛlem OrtΛνíz ( @w_ortiz@beehaw.org ) 9•2 years ago
Someone was talking about Session in another post, the open source app that uses signal code, but without the need to register a phone number.
Can someone recommend it ? Has it been audited ? Because when it comes to cryptography, even if it’s supposedly the same code as Signal, it still needs to be independently audited to be trusted.
- sexy_peach ( @sexy_peach@feddit.de ) 2•2 years ago
Session runs on the cryptocurrency backed loki network.
- WiνΛlem OrtΛνíz ( @w_ortiz@beehaw.org ) 2•2 years ago
Ok, didn’t know that. I will have so much catching up to do with documentations one of these days… The onion routing seemed cool but I barely read anything on it yet.
I Hope it’s not some bullshit whitepaper just to add value to a blockchain/token.
- Dhadelis ( @dhadelis@lemmy.ml ) 1•2 years ago
I prefer XMPP. Probably the best solution available.
- nicfab ( @nicfab@community.nicfab.it ) 6•2 years ago
From my perspective, Matrix (https://notes.nicfab.it/en/posts/matrix/matrix/) or XMPP (https://notes.nicfab.it/en/posts/xmpp/xmpp/ - https://notes.nicfab.it/en/posts/snikket/) are the best solutions. I also used Session (https://notes.nicfab.it/en/posts/session/).
- hellfire103 ( @hellfire103@lemmy.ml ) 6•2 years ago
Ight, imma delete Signal
- Amicese ( @Amicchan@lemmy.ml ) 3•2 years ago
People seriously still use Signal? lmao
- Dhadelis ( @dhadelis@lemmy.ml ) 2•2 years ago
Who thought that requiring phone number and relying on third party services would reduce users privacy /s
- Amicese ( @Amicchan@lemmy.ml ) 1•2 years ago
Uh oh. I somehow blocked Dessalines and I can’t unblock them cuz they’re an admin.