Hacker News Reader

Comment by mikece | Hacker News Reader

> They have this information already in the plaintext SMS Signal broadcasts in order to collect verified phone numbers of their users.

This assumes one is using the phone number attached to the handset running Signal as their Signal number. Personally, I don't do this: I have used Google Voice and even a basic Twilio number that sends SMS messages to me via Email to register a number with Signal. There are many reasons to do it this way, not least of which is that I can publish my Signal number without needing to worry about people direct-calling my phone. Until Signal drops the requirement for a phone number (verified by SMS) to spin up service, this is the most secure way to use Signal.

View on HN

I'm fairly confident that about 99+% of people that actually do anti-government shit have ever had the opportunity to use Google Voice or set up a Twilio number. (And one of the reasons for that is that these are mostly US & friends only services.)

Governments can easily correlate GV numbers to mobile devices. I personally no longer trust Signal. Moxie's departure stinks like a canary.

"Governments can easily correlate GV numbers to mobile devices."

Google Voice doesn't need to be installed on a mobile device. I have my Google Voice accounts (yes, multiple) set to forward SMS to me via email.

"I personally no longer trust Signal. Moxie's departure stinks like a canary."

I never really trusted Moxie to begin with but events like this make me wonder all the more if Signal is really being run from Fort Meade. Fortunately for me I used Signal as my "non-secure" messaging platform and use other messenger options for secure comms.

"Moxie" just seemed so hilariously stereotypical in the first place I could not help but think it was all BS. The name, his style, his online blogs.....maybe he just wants to craft a certain type of image but it seemed a little too perfectly matched to the type of person who would create a free, easy to use and super secure messenger.

Personally I really liked Wickr Messenger (no phone number required) but they were recently acquired by AWS :-(

edit: Also looking up Wickr now it seems like they ended up specializing in providing secure messaging FOR the government (and even are the only ones to pass some NSA specific test) so maybe that was not the best choice.....

> ...events like this make me wonder all the more if Signal is really being run from Fort Meade.

Which events are you referring to here?

Use a truly disposable service like https://yoursecretnumber.com instead of Google Voice. This gives you a number with an OCN type of Wireless as well, instead of one that shows up as IPES (IP enabled Service Provider) or CLEC like Bandwidth.com and nearly all VoIP numbers.

Reply on news.ycombinator.com