As Signal get your phone number. Can we considerate this application as private ? What’s your thoughts about it ? I’m also using SimpleX, ElementX, Threema, but not much people using it…
Cheers
As Signal get your phone number. Can we considerate this application as private ? What’s your thoughts about it ? I’m also using SimpleX, ElementX, Threema, but not much people using it…
Cheers
The biggest security issue in Signal is the requirement for phone numbers and SIM cards. This basically forces all Signal users to identify themselves, and makes Signal highly vulnerable to government spying.
Can I get the ETA for fixing this?
Requiring a Sim is not a backdoor and does not enable “spying”. I does allow knowing who is on the platform, who talks to who, when, and probably some more metadata issues. But its not a backdoor
It’s a huge security vulnerability that Signal devs refuse to fix.
Not more than using username and password. Phone number is a security risk be cause you can get Sim swapped. If you have the registration password it’s safe, but a government can request a bypass. However, if you had no phone number and used username and password, governments could still request a bypass
No, phone number is a risk because a phone number uniquely identifies a person. You need a government ID to get a phone number.
Then it’s a privacy issue. Not security
privacy and security are one and the same. you can’t separate them, it makes no sense.
VERY different things.
Bitcoin is secure but not private.
https://xkcd.com/538/
Does it really? Iirc, you can determine: when the account was made, and when the last message was sent. This doesn’t sound ‘highly vulnerable’ to me… Doesn’t permit inspection of metadata e.g. contacts, so as vulnerabilities go it’s pretty weak sauce
A phone number uniquely identifies a person because in most of the world you need a government ID to get a phone number or a SIM card.
Which means that if one account is compromised, then everyone that person talked to is also compromised. You know what they talked with whom. It’s an incredible security risk that Signal devs refuse to acknowledge or fix.
If your threat model is deanonymisation of chat users via phone numbers after one chat is fully compromised, then yeah I guess you need to register the accounts with relatively ‘untracable’ phone numbers (ie unregistered or incorrectly registered burner sims), but that’s not my threat model. I’m more concerned about server-side broad-spectrum government surveillance than I am about targeted device seizures. And of course there are mitigations even with data access on device seizure, provided you’re unwilling to provide device passwords. But, like, if you’re cooperating to the point of providing passwords you’re probably sharing what you know about other users identities anyway, so it’s a very niche case this applies to.
It’s the threat model. E2E encryption is a niche ‘nice to have’. Protecting the anonymity of people who have said nasty things about politicians is the most important thing a chat app needs to do. Signal is security theater until they fix this.
No the most important thing a chat app needs to do is send messages between the intended recipients making them unavailable to anyone else. Signal does this. You’re worried about ppl receiving messages and knowing who they’re from. Generally knowing where a message is from is considered a feature – if you want anonymous broadcast, pick a different technology that’s geared towards that
this xkcd is always relevant: https://xkcd.com/538/
The most dangerous thread vector is the government forcing you to unlock your phone, and reading your messages. At which point using phone numbers becomes a huge problem.
Fancy encryption doesn’t matter when it’s obstruction of justice to refuse to unlock.
Ok but a messaging app that doesn’t let you know who a message is from is completely pointless? I feel like you’re not really addressing this issue here
You don’t need phone numbers for that.
Afaik you don’t need a phone number for Signal (a “username” can substitute it, a few years back they added it).edit: you still do(Also the phone number & IP was the security risk, not the messages, afaik.)
This however was a debate about a supposed backdoor (I otherwise agree about Signal & its USA basedness, I just remain glad it exists despite it
manyfew blemishes).You need a number to register, but not to comunicate
I tried to make a new account for my child recently. You need a number. It wouldn’t even work as a first signup on a wifi only tablet.
I tried to uninstall on my phone, set him up a new acct with a VoIP number then move the account to his tablet. It constantly failed when I uninstalled and put my account back on my phone.
You can only use one cellphone. Of you switch between two, it has to deactivate on the other.
Then you can have 4 or 5 other devices but that acct is tied to an activated cell phone and it gets screwy if you change that phone.
Molly (fork of Signal) allows you to use multiple phones https://github.com/mollyim/mollyim-android
So those posts they implemented this were lies (meaning I obv didn’t read attentively enough)?
Sad :(.
They implemented usernames to identify people so we could stop using numbers to find each other.
They still use numbers (cell and possibly device/network ids) they say to identify and secure (or so they say).
The idea is without access to your cell phone, nobody’s going to get access to decrypt your data.
Yeah, no, I get & like that, I just somehow specifically (obviously mis-)remember that they did away with phone number as a prerequisite for creating an account (everything still the same, just that the account can’t be reset).
:(
try to get a Signal account without a phone number. let me know if it works (hint: it won’t work).