If I run a server, I have access to the raw requests coming in. I can do whatever I want with them even outside Signal protocol. You can't verify that my server is set up to work the way I say it is. You get that right?

i do, of course… and the information you have in that raw request is limited to the information that’s in the request (including metadata like IP address and other header information in the packets that make it up)

You're confusing what Signal team says their server does, and the open source server implementation they released with what's actually running. The latter, you have no idea about.

i’m really not… i’m saying it doesn’t matter what their server is doing, which is the only way to actually verify this: the client is the only thing you can trust in the chain, so you should always assume that the server is compromised: maliciously or not

trusting signal doesn’t even have anything to do with it; they could be compromised and not know it

these are things we both agree on

the server still receives the raw network request and all the metadata attached to it. Your client has to talk to the server and identify itself before any messages are even sent.

i agree with that too. what information contained within that request do you take issue with?

as i said earlier, your IP address is problematic, but that can be said about any service: you have no way to validate any server software, open source or not… so you have to take measures to protect that information no matter the service you’re connecting too

this is pretty trivially achieved with a trustworthy VPN these days (again, this is unverifiable, but you have to draw the line somewhere: can we agree that IP address privacy is within the realm of personal responsibility since that applies to any service?)

When your device connects to send that sealed message, it inevitably reveals your IP address and connection timing to the server.

agree

The server also knows your IP address from when you initially registered your phone number or when you requested those temporary rate limiting tokens.

also agree

By logging the raw incoming requests at the network level, a malicious server can easily correlate the IP address sending the sealed message with the IP address tied to the phone number.

okay, i can see where your problem is

i can agree that’s definitely a vector they can use to build a social graph, and then tie that social graph back to real identities, and also that’s far from what you want in a private platform

id say that it comes down to trade-offs… signal (says) they require the phone number in order to combat spam, which i can see as a real issue (i’d be happier if they didn’t store the phone number, or at least didn’t link it to your account, but that comes with a whole load of other issues)

services need to have some way of combatting spam, which either boils down to “expensive accounts” so that blocking is a viable option, or spam filters which can be abused by corporate entities like they have with email

if you really care about privacy with signal, you can get a VPN that allows you to frequently rotate your IP… most users won’t do that, so i can agree it’s a sub-optimal solution

but i do think it’s a reasonable trade-off