196
Why does Signal want a phone number to register if it's supposedly privacy first? (programming.dev)
submitted 1 year ago by to c/privacy@lemmy.ml
277 comments fedilink hide all child comments
 

I remember a time when visiting a website that opens a javacript dialog box asking for your name so the message "hi " could be displayed was baulked at.

Why does signal want a phone number to register? Is there a better alternative?

you are viewing a single comment's thread
view the rest of the comments
[+] [S] -15 points 1 year ago (5 children)

But the police request the meta data of all messages from your phone number that the company has and they're required by law to give them it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 23 points 1 year ago* (last edited 1 year ago)

    You should go properly read the requests from law enforcement they have received and exactly what information it contains. It's public. Then evaluate if it matters for yur threat model. Security doesn't exist in a vaccum.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 11 points 1 year ago (2 children)

    They can "request" it all day long. Signal doesn't store them beyond the time needed to deliver to the end user device, and while (temporarily) stored, it's encrypted in a way Signal's service cannot read.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] -4 points 1 year ago (1 child)

    The phone carrier at least here in the US is required to store the call data for 18 months, according to the one that I use.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 1 year ago (1 child)

    What does that have to do with Signal?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -3 points 1 year ago* (2 children)

    The claim is that Signal's phone verification step doesn't cause privacy problems because Signal (purportedly) doesn't retain the phone numbers after verification. That claim is falsified because the phone carrier stores the call record even if Signal doesn't. They store it because of the same law that makes them turn it over to Big Brother on demand. The phone verification step is, therefore, a privacy problem. Obviously there are similar issues with IP routing, but at least I can use a VPN with an endpoint in another country.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 5 points 1 year ago (1 child)

    No, that wasn't the claim. Phone numbers are used for sign up, but the post's OP was talking about messaging meta data. Messaging meta data doesn't go through your carrier and is encrypted.

    If you check the publication of signal's cases where they had to hand out data, and in reverse the FBI leak that listed analysis of all messenger apps by what data they were able to acquire in most cases, Signal came out as one of the top options.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 1 year ago (1 child)

    The "record" is a SMS verification code. All that will tell the government is that you registered for Signal, nothing else.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 1 year ago

    Telling the govt that you registered for Signal sounds like a bad failure as far as I'm concerned, e.g. if you are a user in a repressive regime. Do you think Trump would like to get his hands on a list of all the Signal users in the US? Probably yes. What would he do with the list? IDK but it has to be bad. So it should be an objective of Signal to make it impossible for anyone to create such a list.

    Anyway, it sounds like Signal has wised up and is getting rid of the phone number requirement. I don't understand why people here keep defending the misfeature. I've heard such things explained as "system justification" but I still don't understand it. All of us make poor decisions all the time, but we should at least make some effort to recognize them, and fix them when possible.

    https://en.wikipedia.org/wiki/System_justification

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] -5 points 1 year ago* (last edited 1 year ago) (3 children)

    huh? so the phone number is encrypted in a way that can't be read, but an sms is sent to the phone? ... a separate company sends the text on behalf of signal? so that separate company logs the phone number, the timestamp and who knows what else.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 6 points 1 year ago

    Signal doesn't use SMS anymore, and all messages are sent over encrypted Internet protocol. Any servers in between won't see the phone number, it's not needed to deliver the message, it's using an IP address at that point and the entire message metadata is encrypted. Signal is the only one that can see the phone numbers, which they use to identify multiple clients as a single user and route messages accordingly.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 year ago

    Signal doesn't use SMS at all, once you have enrolled. The phone number is used to validate people and exclude bots, during registration. As others have noted, you can hide your number from other users, as well.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 1 year ago

    What are you on about right now? I don't mean that sarcastically, I really am wondering what your concern is. Are you concerned that because your phone number is associated with Signal that police will know you use Signal?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 1 year ago (1 child)

    Its encrypted

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -4 points 1 year ago* (last edited 1 year ago) (3 children)

    Messages are e2e encrypted. Metadata is not encrypted.

    Edit: I feel the need to qualify this statement. Metadata about your connection may be encrypted at rest but is decryptable given that signal is released metadata to authorities with a warrant/subpoena.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 6 points 1 year ago (1 child)

    People told you a few times to go look for yourself what Signal can give away. Its protocol descriptions are pretty understandable.

    The whole bloody reason it's always recommended is because it's absolutely the best thing in terms of yes, encrypting metadata. It's state of the art, level above that bullshit you're thinking.

    Unfortunately, that also means that hosting it takes lots of resources, which means they have to screen bots and mults somehow. Phone numbers are one way. Paid accounts are another.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] -2 points 1 year ago (2 children)

    Phone numbers are one way. Paid accounts are another.

    Rubbish. How would this stop bots? Bots are created to make money. What makes you think creators don't have a phone number, or be prepared to pay to spam.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •