Hacker News Reader

Comment by kbwt | Hacker News Reader

Signal is also problematic.

We detached this subthread from https://news.ycombinator.com/item?id=16445549 and marked it off-topic.

Signal also requires biometrics to be shared with the govt for 1/6th of the world's population (India) by insisting on a phone number for registration.

How does India's government collect that information?

Best guess is that it is similar to Germany. In Germany, there are no anonymous prepaid SIM cards anymore. They're now registered to your name.

Thus, in theory, the gov has access to it too.

I wonder if there would be interest in sim swap parties. This is an idea I had with Oyster cards in London where you get together and swap Oyster cards with other people to confound the profile building.

I suppose a problem with that might be if someone who takes your SIM does something illegal with it. Then you are on the hook for it.

> Then you are on the hook for it.

This is a myth. If you didn't commit a crime, you aren't on the hook for it. For example: https://arstechnica.com/information-technology/2016/08/publi...

You might, however, get investigated (search warrant etc) because unless such mixing becomes really common, it's reasonable for the authorities to suspect you for the crime in the first instance.

Edit: perhaps a better example is https://torrentfreak.com/eu-court-open-wifi-operator-not-lia...

This is a myth. If you didn't commit a crime, you aren't on the hook for it.

This is a nice theory. In Germany, if you are the owner of a SIM card associated with a crime, it is well possible that a prosecutor will consider this sufficient for a warrant, and the police will visit you early in the morning, taking away all your digital devices for something between three months and some years.

Regarding the Wi-Fi hotspot examples you provided (which are not quite the same), in Germany there is a nice legal construct called the "Störerhaftung" (liability for interference), in which you have a civil liability for e.g. copyright violation commited over your uplink.

(IANAL)

> This is a nice theory. In Germany, if you are the owner of a SIM card associated with a crime, it is well possible that a prosecutor will consider this sufficient for a warrant, and the police will visit you early in the morning, taking away all your digital devices for something between three months and some years.

Like I already said: just because you aren't already on the hook for it doesn't mean that you won't be legitimately suspected of the crime in the first instance.

That's not "biometric." I assumed the OP had something in mind more specific.

In India, all SIM cards have to be linked to Aadhar card , which is a unique identifier of a person with biometrics attached

Thanks. The wikipedia article on Aadhar card looks like a deep dive...

https://en.wikipedia.org/wiki/Aadhaar

And if you are a foreigner the SIM linked to your passport, which is linked to your fingerprints that they take upon immigration.

Assuming that you elect to register with Signal using your Indian number of course, which you are in no way obliged to do.

Well, Moxie’s Signal gives you two options:

1. Use your phone number

2. Don’t use Signal.

I don’t see a "don’t use the phone number, but still use Signal" option there.

3. use a phone number from a semi-anonymous online VoIP service like https://jmp.chat/ (can be reached via Tor)

Which cost money or can be reused by anyone else. At which point Signal is basically $2.99 per month to use it securely.

3. Use a burner phone.

In many countries, burner phones require registration with biometrics as well.

For example, Germany requires registration of burner phones with ID or passport before any network is allowed to activate the SIM. The ID and passport obviously are linked to your fingerprints and face.

Signal is advertised to people in oppressive regimes as a solution to avoid the government from snooping on their messages (this security from nation states is further implied due to their framing of Snowden comments).

Requiring an identifier that’s linked to a government ID is the opposite of that.

Between a burner or a VOIP number there seem to be options, and I’m not sure that Signal dropping their requirement would improve the platform.

As I said, a burner isn’t an option, as that still requires registration, and a VOIP number costs money.

At the stated goal, of being a free app to allow people to avoid government surveillance, Signal is failing horribly.

It sounds like it works well for about 5/6ths of the world’s population.

A secure messenger that only works when you have a government that respects their citizens privacy isn't very useful, is it?

It works in the US where the govt doesn’t even understand the meaning of the word “privacy” so, yes it seems to work. It works elsewhere too, but understandably it might require money or effort to get going.

Reply on news.ycombinator.com