Hacker News Reader

Comment by colordrops | Hacker News Reader

It's not just about the protocol though, it's the whole stack, and the OSes that it runs on are frequently not secure. Also, the Signal app on Google Play requires your phone number and a Twilio API call to function. No thanks.

View on HN

That's something we can't do anything about though.

We can't do anything about the phone number requirement?

The phone number is not required as per the Signal protocol -- it's an implementation detail -- another token could be used. At this time, phone number verification is used in the initial authentication flow to protect against someone else spoofing your phone number and pretending to be you.

See https://github.com/WhisperSystems/Signal-Android/issues/1181

Actually magic link sent to your email would be MUCH better. Also central authority but Gmail >>> any telecom

It also doesn't have to be a central authority, since "anyone" (meaning: anyone who can afford to operate a mailserver, which is actually a surprisingly-high number) can be such an authority for one's own mail.

Practically nobody is running own mail server these days. Email is extremely centralized

I still run my own for personal email (postfix + dovecot). Runs off a Linode VM atm and has no problem getting through to Gmail, Hotmail etc. users.

"Most people don't know rocket science" "Actually I know some rocket science!"

That's true, but not a given.

Just because practically nobody is doesn't mean practically nobody can't, which was my point.

one single actor < a few large actors you can choose from < lots of actors to choose from < medium size organizations can and do often run their own < individuals can ran their own (Email Is Here) < individuals commonly run their own

Let's not make the perfect the enemy of the good.

I used to run my own but I can't find anyone to relay the mail anymore.

> Also central authority but Gmail >>> any telecom

There's few of the big corps I trust as little as Google.

Reply on news.ycombinator.com