Comment by unicornporn | Hacker News Reader

Comment by unicornporn | Hacker News Reader

Parent Full thread

Next problem: Signal will not work without a phone number...

I'd vote for https://riot.im/ instead.

Does matrix even support end-to-end encryption? Last I checked it didn't have /any/, except maybe server-to-server and even that wasn't enabled.

I also seem to remember going over their homebrewed cryptographic rachet and it didn't properly HMAC.

EDIT: Apparently riot.im supports E2E, but it's not a part of the Matrix protocol and it's not encrypted by default. The Olm rachet was also audited by NCC, so that's nice.

They have e2e on all devices now.

But still no way to enforce or enable as default.

E2E /is/ part of the Matrix protocol - it's just still in beta. The spec PRs haven't landed yet (http://matrix.org/speculator/spec/drafts%252Fe2e/client_serv...). Once out of beta it'll be turned on everywhere by default.

I said this several times but will repeat it here again.

I would love a Ricochet/Rio+Signal+Burner combo.

But none of those are fun to use, let's throw telegram/slack into the mix!

Wire is doing a pretty good job of making a fun to use chat interface, but it has its own problems in privacy and speed.

Couldn't the phone somehow "pretend" to have a phone number?

I think it needs the phone number for verification. The phone number is the identity in Signal (and a lot of other apps these days).

Verification of what, to whom/what?

If you're using WiFi, there's no "phone" anything involved.

Or at least, I don't get why there would need to be.

Your messages still go through OWS servers. I believe signal routes messages via phone #.

Signal client is open source though, so maybe this is easy to work around.

OWS has specifically said they won't accept federation...

I was more suggesting a separate centralized service that doesn't use phone #s, but true that you still wouldn't be able to use it with standard Signal users.

It's not a technical limitation, just a design decision. Everyone on Signal's network is known by their phone numbers. You cannot pick a username, as such. The phone number is the username.

I really don't get the point of that.

I mean, sure one can get more-or-less anonymous phone numbers. But why create the need for that?

There are things like keys for verification :)

> I really don't get the point of that

To prevent spam and promote discovery. Finding someone on WhatsApp or Signal is easier than on WeChat as with the latter someone might be using a screen name, or an email address or a phone number.

Why is it is easier to find someone when you can only use one identifier to find them, instead of several? Note that WeChat also uses phone numbers to limit spam, so you can find anyone if you know their number. (But exchanging QR codes is the preferred method of sharing contact information, to the point where I couldn't call most of my contacts except through WeChat.)

Discovery and preventing spam should not take precedence over privacy for an app that supposedly has privacy as its number one priority.

Indeed. So one must conclude that privacy isn't the top priority.

Privacy isn't signal's one priority.

Good enough privacy for the masses is.

They are always making these tradeoffs, and always make the same decisions. Perfect privacy in every situation isn't the goal. The goal is better privacy than the average person currently has, while still maintaining a level of convenience that the average user well accept.

That's what google and Facebook say.

> To prevent spam

I suspected that, but have they openly said it? I suspect it's also to deter criminal activity.

Wow that's an amazingly stupid and short sighted decision. Why would they tie their app to a legacy numbering system which doesn't even serve to accurately identify people?

So that they do not have to worry about that. It's a pretty smart decision to offload the issue of unique IDs to an existing infrastructure.

I really do not like it either too though.

... Same reason WhatsApp got so many users and became worth billions? It's simple, straightforward, and just works for most people.

You can use Signal with a VOIP number. Do the one-time registration and that's it. Or you can get yourself an anonymous disposable SIM (unless illegal in your country), register the number and keep hold of the SIM if you need to re-register the number in the future.

I use Twilio when I need to verify phone numbers for stupid apps. Mainly because a great deal of the time don't actually carry a phone around (especially if I am carrying something more computationally powerful than a phone). And I can verify my Twilio phone numbers from anywhere in any country.

Can't we kill phones already, please? Identify people by e-mail addresses, which are easier to remember and not tied to countries.

> ... The phone number is the identity in Signal (and a lot of other apps these days).

Which to me is an incredibly dumb idea since it leaves out WiFi only terminals such as el cheapo tablets but also small embedded boards etc. I know some of these messaging apps can be used on WiFi only devices, but never in an immediate way and I believe you can't use them at the same time, which is very dumb. This also kills any IoT use for instance, where you could make N copies of a Linux image that boots a node, connects through the same user and sends the data available to its IO pins, or accepts commands to drive them in order to turn on or off other appliances.

Signal only works on phones and chrome desktop right now. So other devices are anyway out of question. Their goal has always been secure messaging for the masses, and not necessarily secure messaging for everyone and everything under the sun. I think it's a fair trade-off if it helps them get the user base by keeping it simple and similar to WhatsApp. Even in its current form, it's incredible difficult to get people to use it. It would be much worse if it were any more complex UI-wise.

Yes, chat needs to not be just basic texting or no one will use it.

iOS users get iMessage which is great, but there's no cross platform version.

Telegram + Encrypted by default and in groups would be best, but they have some (invalid) reason for keeping it unencrypted.

There's a lot of features Telegram offers that can't be used with e2e encryption. Stuff like link previews and many bot functionalities are things that come to mind that my group uses very frequently.

I'm sure they would not mind a whatsapp like buyout offer, at least as an option. That, and secure messaging for the masses.

Reply on news.ycombinator.com