Hacker News Reader

Comment by dleslie | Hacker News Reader

Last time I had it installed it scanned my contacts a half dozen times while I slept. I removed it in the AM.

The Contacts permission is completely optional, and contact information is never stored: https://signal.org/blog/private-contact-discovery/

This seems like smoke and mirrors to me:

  Traditionally, in Signal that process has looked like:
  
    The client calculates the truncated SHA256 hash of each phone number in the device’s address book.
    The client transmits those truncated hashes to the service.
    The service does a lookup from a set of hashed registered users.
    The service returns the intersection of registered users.

The phone number space is really not this big.

They acknowledge that in literally the next paragraph, and the entire post is about how they improved on that old state of things. How is that "smoke and mirrors"?

Right, my bad. This does look like a sensible solution

Is this solution deployed in production? The source code says "beta".

To be fair it does that to map you with the contacts who also are on Signal just like WhatsApp or Telegram does. Though you could also use Telegram just with user_names w/o phonebook permission but for signing up you need to use your actual phone number.

Reply on news.ycombinator.com