Hacker News Reader

Comment by wut42 | Hacker News Reader

But not Signal, for example. Well, they do: but they have nothing to share. Telegram on the contrary have a ton to share.

View on HN

It’s a bit disingenuous to say that Signal has nothing to share. Signal has access logs as well as metadata about the phone number, the name given on the app, group memberships, etc.

With Signal, it’s also trivial to find out if someone is using it by adding their number to one’s address book. Then they can ask Signal for access and other information. That’s not easily possible with Telegram (there are settings to prevent this).

That said, Telegram does store all non-secret chats in an accessible form (for it) on its servers.

https://signal.org/bigbrother/

Last paragraph in https://arstechnica.com/information-technology/2018/10/new-s...

Also, my point about finding who uses Signal and the access logs (though it’s not a historic log, for which I stand corrected) stand — Signal does store the last access information.

Well Signal is sitting on a centralized Google Cloud instance and Google can just issue a ToS violation, with the metadata that it is collecting about certain users on Signal that the three-letter agencies are looking for, including logs and phone numbers and that can essentially force Google to get them shutdown.

Even without it, Google can shutdown any instance whenever it wants to on its own terms since that is another private platform and can choose to do business with whoever they want to.

They have a clear picture of users' social networks because of their dubious requirement that people provide them with working mobile numbers. Who speaks to whom, how frequently, during what times and what days of the week etc. Incredibly valuable and revealing data.

The opposite is the truth. The signal servers don't know who talks to whom, and they chose phone number as identifier specifically so the app could use your local address book for contacts and not store your contacts server side.

Are you real? There is no need to transmit a mobile phone number to a remote service in order for an iOS or Android application to get access to locally stored contacts. You do not need to receive a "verification SMS" to allow the application to access your contacts.

Your evidence is that the signal app client knows your phone number and can see your contacts list and your groups and your chat messages, and if it is malicious, it could just send all that to the server which could just store it in plaintext and turn it over to anyone who asks. But people have reverse engineered the app and it doesn't do that.

Pardon, but you're completely lost. The service knows your mobile phone number because the app requires you to provide it in order to activate your Signal account. After you've provided your mobile number the Signal service sends you an SMS with a verification code, and the app asks you to enter that code. Your account is unusable until you comply with this procedure. Since the service is passing messages between users, those who run the service also know which people communicate with eachother - because a valid mobile number is tied to each and every Signal user account.

I have no idea what you're rambling about regarding people having "reversee engineered the application". There's no reverse engineering required, as it's entirely open source.

Reply on news.ycombinator.com