Hacker News Reader

Comment by HappyTypist | Hacker News Reader

Perhaps Signal just isn't for you. No one who I've introduced signal to has ever had a problem with it. Now if you add a randomly generated 128 bit account identifier, then people WILL have problems with it. Not with you, but with your mum/grandma.

I really think Signal might not be for you. Signal is not about building the most secure or private system, it's about building the first mass-market encrypted that that's Good Enough. Signal is a infinite percent improvement over plaintext/https. It's not supposed to be as good as OTR.

View on HN

Non-technical people I've introduced to Signal on iOS stop at the "upload your contacts" stage and go "I don't want this random little company to have access to my contacts". These are non-technical people who understand the importance of keeping their contact list private, and there are a lot of them.

Making it a de facto requirement that users on your network be personally identified via a phone number ("get a burner number"? really?) and that you have a copy of their contact list and phone calls, all within US jurisdiction, means mass metadata surveillance a single judicial order away (as it is now with the telecoms).

Unlike POTS, Signal prevents phone taps, yes, but it does not hide your social network, and so does little to provide you with the ability to associate with someone anonymously.

> These are non-technical people who understand the importance of keeping their contact list private

Do you take this opportunity to point out to them that they do away with this privacy every time they install whatsapp / fb messenger / hangouts / skype / practically anything that asks for contacts permissions?

The last person I'm recalling this conversation with actually blocks Whatsapp / Facebook from getting her contact list, but trusts Microsoft and Google. I'm not sure how representative that is, but I wouldn't be surprised if people trust big companies with big brands over relatively no-name startups in this regard.

See, that identifier might be an option. Or .. it might not be necessary. If that identifier would be the core 'me' on Signal, why wouldn't you be able to add me by phone number - if I gave Signal one to share/associate with? Mum and Grandma would see no change. People like me could run around without a phone number.

It's not as if that hasn't been done. twitter.com/darklajid is me (not worth checking it out). See? A name, tied to an identity. Same here. I used to have a FB account and even _there_ you can have a profile name that is unique and shareable. I really think you conflate things here: I DO NOT want to make life harder for mum/granny/the average WhatsApp fan. If you love that random people show up in your roster because you store their number (or vice versa: You show up on your Ex's roster because she didn't delete you yet) that's fine. And could continue to work like that.

I really have a hard time understanding why it isn't impossible to opt out. If I have a key, registered with Signal - why would I need a number on top? _Especially_ given that there's no federation to speak of, so I assume they don't need to 'shard' base on the identifier. foo@example.com -> talk to example.com? That's not happening here. And I don't see why/how they'd shard on numbers? +49 -> route to a German server?

Why is a phone number (and all the things that come with it: Discoverability for example) a requirement? You didn't answer that.

Yes, Signal might not be for me. I'm reasonably sure that I mentioned that before in this thread ;-)

If that identifier was linked to my Keybase.io account, that would be really cool. Or linked to Namecoin. Using methods like that to find my contacts would be great.

> Not with you, but with your mum/grandma.

Hey, please consider finding a better way to say "the average person" than calling out women and old people as being groups you think of as non-technical. Thanks!

It's a bit of a slippery slope argument. Things are hard. Let's compromise to make them usable.

That said there's a lot of potential as the crypto libraries are known to be top notch and reviewed. I hope they progressively address these issues.

If Signal's not good enough for us, what is?! I want to know...

Reply on news.ycombinator.com