Hacker News Reader

Comment by etatoby | Hacker News Reader

Because:

1. WhatsApp was the first widely-used such app and it was phone number-based, so all the clones use the same system.

2. Non-technical people have a hard time (read: bordering on impossible) remembering their usernames, let alone passwords, and by using the phone number as both identification and authorization, the problem is sidestepped.

3. People have an existing address book of contacts (in the form of phone numbers) in their mobile phones, that can be used to pre-populate the app's buddy list.

View on HN

Re 2 - Blackberry Messenger used an eight character alphanumeric ID, and was enormously popular in the UK (not sure about other countries however) - until Blackberries died a death at the hands of Apple and Android...

BBM was different since the PIN was baked into the device so it as more seamless than even using your phone number.

The problem was when you change your device you can't migrate your PIN so I think it contributed to decline to usage as people moved to other BB devices or iOS/Android

This only strengths the argument why majority of chat apps use phone number as your username.

Was BB ever really mainstream? I know it had loyal following, particularly for business users. But, at its peak it had 80M users globally. Most people still had basic phones then, and many of those with BlackBerries probably had an IT department supporting them.

BB was thoroughly mainstream in the UK.

https://www.theguardian.com/media/2011/aug/08/london-riots-f...

from 2010 / 2011

> Using BlackBerry handsets – the smartphone of choice for the majority (37%) of British teens, according to last week's Ofcom study – BBM allows users to send one-to-many messages to their network of contacts, who are connected by "BBM PINs". For many teens armed with a BlackBerry, BBM has replaced text messaging because it is free, instant and more part of a much larger community than regular SMS.

2. no. People can and do remember. Just ask their mail address. Of course someone will post anecdotal evidence that they can't.

4. One of the more effective ways of enforcing 1 person 1 account

In whose interest is that?

> 2. Non-technical people have a hard time (read: bordering on impossible) remembering their usernames, let alone passwords, and by using the phone number as both identification and authorization, the problem is sidestepped.

In Signal it's a requirement and not a convenience: I would like to avoid using the number, and I'm able to configure it, but I can't, because the apps don't allow that. Just the same like I have to use it for a new Google account etc.

The real reason is: both the spy agencies and the ad companies really like to be able to easily identify everybody.

Are you implying that signal works for a spy agency or an ad company?

Everybody should draw his own conclusions.

Some topics to consider, that those interestdd in such topics have to clear with themselves (source: all Wikipedia):

“The Open Technology Fund (OTF) is a U.S. Government funded program created in 2012 at Radio Free Asia.”

“Radio Free X” (for different X” have a very long history of effecively being made and maintained by CIA.

“Clinton's policy was "heavily influenced by the Internet activism that helped organize the green revolution in Iran in 2009 and other revolutions in the Arab world in 2010 and 2011".[3]”

“Notable projects that the OTF has supported include The Tor Project, Open Whisper Systems,..”

Such associations can at least (directly or indirectly) influence some design decisions.

The best proof against the points like mine would simply be to allow those who want and know how to do that to really use the service completely anonymously, that is, especially without providing some phone number.

If you have this level of distrust, why use their service and expose your IP address to it? At that point, better to set up your own server.

There are, of course, different points of tradeoffs for everything related to security. So yours is not an argument that supports Signal’s feature set.

Yes for “complete” security by all means use your own optical fiber network and your own crypto, with a touch of quantum cryptography custom made by Bruce Schneier et al just in case.

We’re talking about someehing else here though.

There are a lot more projects you can't support than Tor and Signal if you think accepting help from OTF taints them.

I don't consider anything automatically "tainted." I'm considering the reason behind the Signal's decision to insist on acquiring the phone numbers and I don't have any better explanation than that.

It is just their insisting on the phone numbers is their action that for me makes use of their product problematic.

And the "Open Technology Fund" is surely an interesting beast, worthy knowing about, as well as the stories about the "Radio Free X" for some X.

Some fascinating insights on that topic:

https://www.theglobeandmail.com/arts/books-and-media/review-...

What does Radio Free Asia have to do with Signal? The only connection is that OTF, which is an RFA project, decided to spend money on open privacy and cryptography tools.

Signal has repeated the reason they use phone number identifiers ad nauseam. The goal of Signal is to make text messaging secure. Those are the roots of the project. You're confusing the application with the underlying technology, which Signal has published and many other projects have exploited.

> The goal of Signal is to make text messaging secure

For whom is that messaging more “secure“ if the phone numbers are the (technically completely unneeded) requirement on which is insisted by the producers of Signal?

I don't think you understand. By "has its roots in text messaging", I mean literally SMS text messaging, the most popular messaging network on the planet. That is the goal of the project: to take the largest mainstream messaging network in the world and make it cryptographically secure. That network already has identifiers and a network of relationships: phone numbers and contact books. That's how Signal bootstraps itself.

If you don't and never would send an SMS text message, you are not Signal's model target user and never were.

Use something else; you have lots of choices. If not Signal, I recommend Wire, though I think you'll come out behind on the privacy tradeoffs.

“It has roots in SMS” is of course absolutely miskeading as Signal is technologically completely different and there’s still on that level nothing that would prevent the producers of Signal to allow anybody to use any other way of identification.

So I still claim that the fact they don’t has some very strong reasons that are completely opposite to the security of their users.

And I still haven’t read here any argument that disproves that.

There's nothing to "disprove". The project has a different goal than you have. That apparently makes you angry. That's fine; snipe at it all you want, and pick a different messenger.

What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government. That's comically false. Snipe at them for things you can make actual arguments about (there are lots of those).

> That apparently makes you angry

"Apparently" because it's without any proof.

> What you cannot get away with doing is making the argument that your disagreement with them is an indicator that they're compromised by the US Government.

I'm not claiming that and I've never claimed that. I'm claiming only this:

1) there are no technical reasons for them insisting in their users giving them user's phone numbers and user's contact data: the underlying technology would not be any more complex without that.

2) There was(is?) actual monetary support of Signal development by the actual US spy organization (with the decades of historical support for these direct "spy" connections, some of which really amazing, see before). Which gives some additional context for the whole operation.

Specifically "tainted" and "compromised by" were always only your formulations. I'd just say "given the circumstances, there can be observed some non-technical reasons behind some design decisions."

Which would, I hope, be completely non-controversial if we would, for example, talk about Skype. Because for Skype we have the direct proofs from Snowden. And not having such for Signal we surely can say "we don't have proofs" but we also can't claim that "this time it's completely different." Even if Snowden himself talks nice (or something) about Signal.

And downvoting my comments stating both is not changing these facts.

I didn't see this comment until just now (it's buried 2 pages down in my comment history), let alone downvote it.

i think you might be incorrectly equating 'secure' with 'anonymous AND secure'

I’m with you. The reasons given in this thread for requiring phone numbers are not convincing. Despite this huge and unmotivated barrier to usage, Signal enjoys strong support from HN and related communities, and I have no idea why.

Reply on news.ycombinator.com