Hacker News Reader

Comment by asethos | Hacker News Reader

Signal's message requests is a major selling point for me.

I recently created a Signal account after having a bad experience in which someone used my phone number to harass me with SMS/calls (every time, from a different VOIP number). It's frustrating that, even in this era, there is no good way to filter out malicious actors from SMS/call.

P.S. You can sign up with Signal via a VOIP number to avoid sharing your real phone number. See: https://theintercept.com/2017/09/28/signal-tutorial-second-p...

View on HN

Yes, I do this. I really wish they and everyone else would stop using phone number as an ID and use an alphanumeric ID.

Really, I don't want to give out a phone number to everyone.

Exactly. How hard can it be? It would make it way more secure for almost no effort. I would use Signal if it did not require a phone number or an e-mail address (whichever it requires).

I'm okay with it requiring an e-mail address, that's easier to be universally accessible, as long as your e-mail provider is sane and doesn't require SMS confirmation to login.

Phone numbers, for most people, only work within a certain part of the world and aren't easily accessible worldwide.

The reason I am not okay with it is that it is usually tied to your person in one way or another. Have you tried getting an e-mail while using Tor? Next to impossible. Plus, it is unnecessary really. You can use nicknames or say, a generated UUID of some sort, with perhaps a QR code for easy copying.

crating a new yandex email account works nicely via tor for me

I will check. I would say that it works... for now. :P It is not something we should rely on, I think.

It's complicated and can be expensive. Also people that has you real phone number cannot contact you on Signal, so you have to have two accounts, one with your real number to chat with your contacts and another one with the fake one to share with strangers that you don't trust, and as far as I know the Signal app doesn't support two account (yes on Android there are ways to have two instances of the app, on iOS you can't).

To me Telegram is superior to Signal because it gives you both options, use your phone numbers with people that already have you in the contacts, and don't share your number with strangers in a group.

Completely agree. Telegram is far superior to any other platform out there. Balance of privacy and security, by default.

How can you say that when Telegram's end-to-end encryption is disabled by default, and you need to go out of your way to create a secret chat? Their default is the opposite of secure.

And again, there is no E2EE on desktop. Telegram looks nice, and it ends there.

Briar is far superior. Yes, there is support for desktop as well, but it is under heavy development.

For phones: Briar

For desktop: Ricochet

Yes, I get it, Ricochet lacks a lot of goodies Telegram has, but having stickers != secure. For secure chatting only, Ricochet does the job. No one will even know that you are using it. :)

> No one will even know that you are using it. :)

Apart from all the red flags you're raising by using tor though..

The problem with tor is that it's associated with a lot of malicious stuff. The same way that IRC was for a while. Using it on a VPS for example was forbidden at many providers. Though since the rise of Freenode (and its fall and re-emergence as Libera) it has re-established itself as a platform for serious communication.

Though this kind of legitimate use is exactly what Tor needs to get out of the "dark" corner in many people's eyes, I do think it's there at the moment.

IRC has always been for serious communication to me at least and the people I knew... ever since I was 9. I am surprised it was associated with malicious stuff.

I have no idea why Tor is associated with malicious stuff. I mean sure, I do know, but people are people. Cash is associated with malicious stuff, too, or can be, because people buy all sorts of illegal stuff off the streets with cash. People are just being people, they always find a way. I hate it when things are ruined because of people who may do malicious stuff. Tor represents freedom to me. There has been anonymous chatting websites anyway, and it has nothing to do with malicious stuff. Or well, it may have, similarly to say, Omegle. If we banned everything that is associated with malicious stuff, we would have literally nothing, we would have no Internet, we would have no cash, we would not have anything for real. In any case, I hate this kind of thinking, that is for sure. :/

> Apart from all the red flags you're raising by using tor though..

Yep, I wish this was not the case. I am on IRC to which I connect using Tor. Now, both IRC and Tor is (or was) associated with malicious stuff! Imagine being on a shit list for this. :D I do it for my own privacy and security, but the reason is not that I am doing anything malicious. Sometimes I even use OTR on IRC just because I do not want the server to possibly know what I am talking about (no clue about the protocol right now, so I am not sure if they can actually read it, but I do not think it's P2P).

So yeah, people should stop with the false assumptions and silly heuristics. I mean, come on, I bought coffee and groceries with Bitcoin before, and many people bought illegal stuff with cash. Thus, I will never understand the argument against Bitcoin related to "Bitcoin is used for illegal stuff" bullshit. Both Bitcoin and cash has been used to buy illegal stuff, so what?! People are being people, stop blaming the technology that has benefits to many people who are not doing illegal stuff.

I guess no security and no privacy does technically constitute balance.

More seriously, it does compromise security for usability, which can be ok in some cases – as long as you don‘t make bold claims stating the exact opposite. Telegram has done just that.

On Telegram if anyone else has your phone number in their contacts then they’d know it’s you even if you initiated the communication via username. Or that’s how it was. I am not sure if this has changed/been fixed.

This doesn't necessarily have to be the case. A couple of years ago when the large scale protests were going on in Hong Kong, authorities found people who were using Telegram, Signal, etc., by adding all phone numbers to their devices' address book/contacts list. Telegram quickly adapted and brought a new setting wherein others would only get to know you were on Telegram only if you had them in your contacts list. Telegram has been, and is, far superior in hiding your presence to others than Signal is.

Only by default, you can opt out this behaviour. But I don't see a problem with it, if someone already has my number he doesn't get much more information (beside the fact that I may want to have a "secret" Telegram account. But in that case you can register it with another phone number).

I've not had this problem with iMessage really. Are you SURE its not possible to block out bad actors on messaging?

Apple keeps detailed metadata records of who sends messages to whom on iMessage, when, and how often.

Signal does not.

Apple backs up iMessage plaintext contents to Apple, via non-e2e iCloud Backup, bypassing iMessage's end to end encryption.

Signal does not.

My point is whatever approach apple is taking, I'm not getting a lot of spam on iMessage, and the one time I did it was pretty easy to mark as spam if I remember.

iMesssage allows you to filter out bad actors -- but raw SMS (green text message) does not. I was getting a few SMS messages a day, each from a different phone number, likely with a service like TextNow.com

Reply on news.ycombinator.com