Session: An open-source private messenger that doesn’t need your phone number
itsfoss.com
itsfoss.com
With generic usernames you have nothing. This practically means you have to do some sort identity verification in meatspace beforehand.
There's potentially value in having the option to link two identifiers together, so that people can find you on Signal via phone number or email address. But only as an option.
That's not true. TextNow, and i'm sure others, will just give you a phone number through their app from whatever location you want that you can change nearly at any time. You can use it from a web browser, it doesn't need to be tied to a phone or anything else.
I've personally used it responding to ads and things I'd rather not give my actual number for and a friend of mine used it on a phone for a year or so as their personal phone number when they couldn't afford to pay for regular phone service. That friend actually used one of those numbers to authenticate some other messaging service.
I'm not saying identity is a must or that it's either good or bad, I'm saying that that is what the market is like right now and removing it causes people to see it as a downgrade.
Also, depending on your jurisdiction it might be illegal to provide a number that isn't yours (varying from spam laws to identity theft), just as it might violate the EULA and suspend service from whoever wanted that number in the first place.
Generally, if you want to circumvent doxing yourself there are plenty of methods, but we're talking about mass-market here. The rest uses Jabber with OTR or some form of the signal protocol or maybe plain PGP/GPG crypto. But if we go down the rabbit hole of niches we would have a completely different context to work from.
The market's only like that because there's a lack of alternatives. 'The market' isn't an abstract entity that came into existence out of nowhere. Companies make the choice to provide only that option, people never chose this.
Removing the ability to chat with people using a username and password is the downgrade, that existed long before SMS and phone verification and tying those services to what is essentially an epehemeral number not ever actually owned by you, but the company that provides it.
There's plenty of places in the world where having a consistent phone number isn't really the norm. I've got friends i've saved multiple phone numbers for because they signed up to this or that messenger with different phone numbers.
Phone numbers are useless as an identification method.
I pointed this out in another comment, but because whatsapp and signal use this system, there are random people in my contacts list, whose profile pictures and status updates I can see, but I have no idea who they are because the people that used to have those phone numbers no longer have them and they were reassigned to someone else.
In fact they still recommend doing a physical verification by comparing the safety number.
Their solution is to use the end user's address book as a contact list with users' phone numbers acting as identifiers. The identifiers are mapped to endpoints with some method that is supposed to protect the end user's privacy.
The app could encrypt a list of usernames and store it on a server, but that would affect usability for non-technical users.
That's okay, but does not make the change hard to make.
It is not giving my phone number to an entity I don't trust.
I don't trust anyone/thing that asks for my phone number without a valid reason. Signal does not have a valid reason. And in the context of privacy that makes signal borderline fraudulent.
Even further, signal uniquely gives facebook and linkedin et al. my contact graph. Why? Because it relies on the contact list. Chances that anyone I'm talking to over signal also has facebook/linkedin/... is rather great.
Even facebook is better in this regard since you don't have to have a phone number to create a facebook account.
Doesn't matter if it's the best thing ever, I could not possible care less about it. Which is a shame because I want to.
It makes it easier to discover from your contacts who already uses Signal by having the phone number tied to a Signal account.
I'd prefer if using a phone number with Signal was optional.
Wire is lame, too, it stopped supporting older Android versions, so I cannot use it on my ~3 years old phone. I will no longer be vouching for them, they have done nothing but make it worse through many different ways.
Signal's requirement for phone numbers is an absolute red flag for me. And using contact lists seems insane.
I've been playing with it a little, using the Linux app, and it was extremely intuitive.
But then, I only chat with people who I know online via other channels. With zero meatspace involvement. So if I care, I can cross authenticate. Using GnuPG even.
I'm 0525c5ba8a4bc6fc6f107b637b5107b6b7abfd1153ea042b5e9fe474acb5d9cf35 if y'all would like to chat.
But what I find most interesting is its built-in anonymity. Like Tor, it uses an onion routing network where only entry nodes see users' IP addresses. Users are anonymous from the swarms that cache messages, and also from other users. Except of course for the ID, both that's not tied to anything in meatspace.
Edit: The onion routing network is Loki, which I gather is a fork of ZeroNet.
So it's a fork of Monero that gives rewards out to "service nodes" periodically for not being ejected from the network. stores data. A service node also have a "stake" that's lost if the node ejected. The service nodes together form a "swarm" that routes messages and stores data and occasionally does various tests to eject bad nodes.
IDK, doesn't seem that bad. I'm sure because of the complexity there's some emergent bad behavior that will crop up, but the cryptocurrency is separate from the message platform - there's no cost to send messages, it's a separate proof-of-work Blake2b hash. So at worst the chain will fork and you'll have to update the app again.
It syncs across all my devices (iPhone, iPad and laptops, Mac and Linux), and I can quickly do full-text search over large amounts of data and docs we've exchanged over time.
It's full OSS, including the clients. I don't know why it's not more widely used.
And compared to Signal, WhatsApp, and Telegram their call quality was horrendous so not many of my contacts stayed.
Worth a read
- "Session Updates" - I assume this is news about the app itself, like new features. However the messages here all refer to "Loki Messenger" rather than "Session".
- "Loki News" - Has weekly updates about "Loki". When I first installed the app I had no idea what "Loki" was or why I should care.
Messages to these trigger notifications and everything else a message would normally do. They're confusing and annoying and the first thing you see when you finish the onboarding process.
They are messages. I'm guessing that's because Session has no other connectivity except through the Loki network. I do recall reading that the app only talks to the Loki entry node. And if that's true, it would be a very good feature.
As for the software
>it will simply generate a random (unique) Session ID.
>It’ll look something like this: 05652245af9a8bfee4f5a8138fd5c……..
>So, you just have to share your Session ID with the contact you want to add
Sorry but I truly believe this is DOA for this reason. Y’all blockchain nerds ever heard of usernames?
And re IDs, there's Zooko's triangle.
Regarding the privacy concerns: the end to end encryption can be validated by yourself if you wish. Meta data is reduced to a minimum, see their FAQ.
Sure, that'd make contact discovery worse but I could live with that shortfall if it increased my privacy.