Hacker News Reader

Comment by comex | Hacker News Reader

So it can't be used without a phone and phone number? Like most people I have those items - but only one of each. Good enough for standard chats with family and friends (which I currently use iMessage for), but on occasion I'd rather be pseudonymous, and it's precisely then that I need secure communications the most. Right now I have no idea what instant messaging software to trust, so I was hoping I could use Signal over Tor for this purpose, but I guess not.

View on HN

A few things:

* You can use Signal with any phone number that can receive voice calls: http://support.whispersystems.org/hc/en-us/articles/21319067...

* Signal's primary audience is non-technical users. The big goal of Signal is to thwart passive, dragnet surveillance of people's text and voice messaging.

* AFAIK, Signal's use of GCM makes it more difficult for an adversary to perform traffic analysis to determine with whom a Signal user is speaking, but not impossible.

* If you don't trust Open Whisper Systems to treat the phone number that you give them as sensitive and confidential, you really can't trust their messaging software, either. :)

I do trust OWS (although I'd like if they made the Signal iOS app build reproducible - there's an issue report about it). But I don't trust the people I'm conversing with, and they need my phone number to reach me on Signal. I guess I could use Google Voice or another service to register an anonymous phone number, but that's not a great UX, especially if I'm recommending the same procedure to the person I'm conversing with. (Oh, and the app doesn't seem to support multiple identities... I really should just look elsewhere, I suppose. It's just that I have a lot more faith in OWS's ability to deliver properly engineered systems than, well, anyone else's.)

Also GV requires an existing phone num to sign up.

Imho, the big thing is that I have to give people my phone number to communicate via Signal. For contrast, Threema only requires you to share an ID like K48FEHZD.

It seems like a well thought compromise, but it doesn't work for many users. Moxie must have plans to support certificate-based identification/authentication in order to remove the number requirement. There's no reason you need a SIM card to make voice calls, video calls and text chat.

> There's no reason you need a SIM card to make voice calls, video calls and text chat.

Agreed. It was even point number one in my list of commentary:

> * You can use Signal with any phone number that can receive voice calls: http://support.whispersystems.org/hc/en-us/articles/21319067... [0]

I heard a long time ago that the dependency on phone-number-as-username is something that they want to get rid of. However, I'm pretty sure they've been busy with the WhatsApp work and doing general work on the existing clients, so I don't know the timeframe for such a change.

[0] https://news.ycombinator.com/item?id=11452508

https://github.com/Bitmessage/PyBitmessage

Also: http://echelon.i2p.xyz/i2p.xyzbote/

Reply on news.ycombinator.com