But it’s irrelevant, as the chats are end to end encrypted regardless. So sure, they’d know you had a Signal account, but not the contents thereof.
And then what's the point of the super duper encryption?
What Russian police would be able to see, that in a given time period of certificate rotation at most X people communicated to Navalny.
You may have confused this information with WhatsApp which indeed keeps a lot of metadata on each user.
They promise to throw this information away, which is nice but not possible to verify.
They also employ a roundabout way of encrypting this data, but as they rightly point out in their article that describes the scheme, encrypting or hashing phone numbers is not safe from a malicious attacker. The space of all possible phone numbers is so small that it could be brute forced in the blink of an eye.
You place all your trust in Signal (and Google/Apple) when you use them. That may be better than the alternatives, but it's still something we should be honest about.
That said, keep in mind that Signal and Google/Apple can also trivially backdoor your software, so unless you take specific precautions against that, the details of their middleman protection isn't terribly important.
To me, it's much worse. A non-profit doesn't have my data but Amazon (and NSA) does. With Amazon's scale, it must be trivial to identify everyone.
See also: https://news.ycombinator.com/threads?id=autoexec&next=394457...
Signal has no access to metadata, including participants in a conversation. All they know is the date of account creation and the date of the last connection.
However, if they got access to Navalni's phone, then they of course can see everything Navalni can.
Aha :)
Do you people also want the relevant xkcd? The one about the wrench...
Unsure why the downvotes, but I assume it’s from this misunderstanding of the Signal protocol.
Why worry about nation-state level attacks when you can simply be hit over the head with a mallet until you give up your password?
We don’t insult each other here. Take the cheap potshots to Reddit.
>Why worry about nation-state level attacks when you can simply be hit over the head with a mallet until you give up your password?
Yes, that would be the point of obfuscation, as opposed to just encryption. End to end encryption does not prevent the $5 wrench attack, obfuscation does.
If a person is a member of a terrorist network - or friends with someone who is - the fact that a warrant could force Signal to expose that link could mean that a court is then more likely to approve increased surveillance of your (non-Signal) communications because of that link.
On the other hand if you are a woman on Tinder and using Signal to communicate with matches, this doesn't expose you to the person you have just matched with adding your number to their phone book, uploading it to LinkedIn and then finding where you work (which is what you can do with a phone number).
My feeling is this is a reasonable compromise, but it is important people understand what it does and doesn't protect you from.