Hacker News Reader

Comment by popol12 | Hacker News Reader

Meanwhile I've switched my family and friend to Signal with great success.

I installed Signal recently, but was flabbergasted when it advised me to connect with someone they found in my phone contacts who has recently joined Signal. WTF? If I knew that my contacts were being shared with a 3rd party (Signal), I would never have signed up.

Still, better Signal than Facebook, I guess. :-/

P.S.: if I'm missing something and the check was done in privacy-conscious way, I would love to be corrected.

> If I knew that my contacts were being shared with a 3rd party (Signal), I would never have signed up.

I think, you should read up a bit on how Signal manages contacts/address books.

https://signal.org/blog/private-contact-discovery/

I don't think they are shared in the same sense that it is shared with WhatsApp/Facebook etc.

"Signal periodically sends truncated cryptographically hashed phone numbers for contact discovery. Names are never transmitted, and the information is not stored on the servers. The server responds with the contacts that are Signal users and then immediately discards this information. Your phone now knows which of your contacts is a Signal user and notifies you if your contact just started using Signal. "

https://support.signal.org/hc/en-us/articles/360007061452-Do...

The problem is that phone numbers are a small space for brute force, and depending on how much they truncate, this could be very close to uploading one's address book.

Yup. Hashing phone numbers is basically useless. If they truncate enough there might be plausible deniability due to possible collisions but I suspect the chance of collision is still quite low as they don't want to annoy people with false positives.

False positives would be sent to the device for local comparison against full hashes; it wouldn't "annoy people" because it would not trigger a match unless the full hash matched on device.

There is indeed a way to truncate enough to balance the amount of data sent to the device vs privacy.

Good point, that would definitely preserve some privacy.

I missed that option (basically now the Google Safe Browsing API works) and the Signal page isn't clear that this is how it works.

https://support.signal.org/hc/en-us/articles/360007061452-Do...

It's done via hashes which is why it might need some time that contacts on your phone are recognized that they are on Signal.

Afaik, Signal servers have no information who your contacts are.

Do you still have Whatsapp installed?

I have seen family and friends _add_ Signal but few actually _removing_ Whatsapp from their phone. Which is not a success.

> Which is not a success.

That depends on your aims. I announced to family/friends that I was deleting WhatsApp and asked them to install Signal, and they have done, and message me via that.

My aim was to ensure that I could still converse, but not have to use a service with which I had become disenchanted. It isn't my business whether they continue to use WhatsApp or whether they delete it.

I don't think it's possible for most people to make this a one-pass activity without it causing a lot of friction for them, but over time you can build a critical mass of your social circle on non-FB platforms that allow you to _then_ delete WhatsApp with less friction.

Step 1 for family & friends is being available on multiple platforms, because that in turn gives _their_ circle less tie-in to WhatsApp. It's only when their circle also make themselves available that they would have a painless option to remove WhatsApp, but IMO, that's OK.

It is a success, but playing the long game.

I've done that too. But for some reason, my business communication still happens on WhatsApp. Until that happens Facebook is safe.

that is the one I found easiest to move.

Business is already conducted well on email, and if it needs sync chat for larger orgs then Slack steps in, and if it needs personal private sync chat then Signal steps in.

The issue a lot times is clients, for example if you work with small business.

You're saying that email, text messages and phone calls don't work as well as WhatsApp for small businesses? I wouldn't have expected that, so I'm curious if you have examples to share.

It's a country specific thing. I find that my clients in the US generally prefer email, Slack, and Zoom/Google Meet. Clients in India, South East Asia and Africa, and some parts of Europe (Italy comes to mind) very strongly prefer WhatsApp even for business communications.

Same here, even less technically inclined ones. Whenever someone messages me on WhatsApp, I usually reply with, "Hey, would you mind if we switch to Signal <install link>? I'm in the process of getting off WhatsApp for obvious reasons". At that point, either they install and continue to conversation in Signal, or they reply back asking "Wha? What's wrong with WhatsApp?" at which point, I explain just how much FB's clients can know about you with the metadata they collect.

I've been trying to find a solution to bridge rooms across chats to make the change simpler for anyone, and matterbridge[^1] does a lovely job - except for Signal.

Moxie made it stupidly hard to connect to Signal with anything that's not the official app, which is definitely a hostile act towards anyone who doesn't want to have the Signal app on their phone - the Signal desktop software needs the mobile app to work:

"To use the Signal desktop app, Signal must first be installed on your phone."

https://signal.org/download/

I definitely have my issues with Signal. That said, it's simple, and works reasonably well, it's just not a nice system at all from the dev/libre perspective.

[^1]: https://github.com/42wim/matterbridge/

Are they actively using Signal though? I am struggling with mine, where conversations still happen on WhatsApp.

I found the most easy way to motivate people to switch, is to just remove your WhatsApp profile-picture and set your status to something like "Find me on Signal".

The amount of people reaching out via WhatsApp lowered drastically, all (but one) of my main contacts are now also on Signal.

The WhatsApp fiasco has been great because Signal is now widely-known and I haven't needed WhatsApp anymore for international calls.

the audio/video calling on Signal seems pretty unreliable. Other than that it's been a smooth move.

From what I remember reading a while back, Signal uses a couple constant bitrates (Basically just high or low I think) to remove even more metadata about your calls and prevent metadata fingerprinting. It's a performance/privacy tradeoff, but it goes to show just how seriously they incorporate cryptographic security into the apps design.

Reply on news.ycombinator.com