On its 10th anniversary, Signal’s president wants to remind you that the world’s most secure communications platform is a nonprofit. It’s free. It doesn’t track you or serve you ads. It pays its engineers very well. And it’s a go-to app for hundreds of millions of people.
My reply from the other thread. People who claim this isn’t true aren’t being honest. The phone number is the key metadata. Meanwhile, nobody outside the people who are actually operating the server knows what it’s doing and what data it retains. Faith based approach to privacy is fundamentally wrong. Any data that the protocol leaks has to be assumed to be available to adversaries.
Furthermore, companies can’t disclose if they are sharing data under warrant. This is why the whole concept of warrant canary exists. Last I checked Signal does not have one.
When you install Signal, it asks for access to your contacts, and says very proudly, “we don’t upload your contacts, it all stays on your phone.”
And then it spams all of your contacts who have Signal installed, without asking your first.
And it shares your phone number with everyone in your contacts who has Signal installed.
And then when you scream ARE YOU FUCKING KIDDING ME and delete your account and purge the app, guess what? All those people running Signal still have your phone number displayed for them right there in plain text. Deleting your account does not delete the information that the app shared without your permission.
So yeah. Real nice “privacy” app you’ve got there.
Wow didn’t even know about that, what a shit show. It’s so weird how Signal has become a sacred cow in the west now, and you can’t have a rational discussion about its many problems without a whole bunch of trolls piling on saying you should just put faith in Signal unconditionally.
That’s my view as well, the only way to know that data isn’t being used for adversarial purposes is not to share it in the first place. I think it’s fine to use Signal as long as it’s an informed choice. The primary issue I have is that people don’t seem to want to accept that Signal collects phone numbers and that this could be used in a nefarious way. It seems to be an ideological stance as opposed to a rational one.
The app (locally, on your device) checks if someone from your contact list installed (became available) on Signal, and if they did, you get notified by the app.
And it shares your phone number with everyone in your contacts who has Signal installed.
Someone can get notified only if they already have you in their contact list (so they already have your phone number), and have Signal installed.
I still wish you could choose if you want others to be notified tho…
phone number isn’t just any metadata; it is the anchoring data around which the rest of metadata is collected, and it is also connected to govt/corporate verified real identity.
why would anyone even claim to offer privacy around such an anchor ?
Exactly, especially when we’re talking about the US government that has access to all the data from other large US based media companies like Google and Meta. We know this for a fact thanks to Snowden leaks. Once you have a phone number, you know the identity of the person, and you can trivially cross reference all the other data to see if that person is of interest. And thanks to their Signal connection graph, the government can easily tell what other people they communicate privately with.
And thanks to their Signal connection graph, the government can easily tell what other people they communicate privately with.
So what? I’m sure your neighbor couple talk privately to each other most of the time and you know that happens. The important part is that the conversation is private.
Signal is not an anonymous messenger app. It never claimed to be. It’s for you to have a private conversation where your device holds the encryption keys.
Not like WhatsApp, where Meta has access to the keys of all conversations. Also 95 % of the worlds population is on WhatsApp, so why don’t you go and complain to them for lack of privacy and security?
If you want an “anonymous” chat client they are out there to use. Good luck getting more people onboard other than your savy friend.
If you understand that this information is being leaked, and that’s not part of your threat profile that’s perfectly fine. The problem is that a lot of people don’t seem to understand the implications of Signal harvesting phone numbers, and therefore make bad assumptions regarding the safety of using Signal. It’s pretty clear that a lot of people aren’t conscious about this in this very thread in fact.
Wire uses Signal protocol and doesn’t harvest phone numbers, so I’m pretty sure we do actually know what the answer is. The fact that Signal made this design choice is very concerning to anybody who understand the implications of doing that.
Signal’s use case is “authentic communication”. like when a govt person interacts with other govt person and doesn’t want a second govt to snoop on the actual contents on the communication, but accepts that metadata is public.
It is whatsapp for such people, without being whatsapp.
This is really interesting. It brings two questions to mind.
Don’t all messaging apps use phone number as a primary metadata value?
Are you suggesting that Signal could either not use this metadata or not collect it and yet they choose to collect it and can therefore lose it to exfiltration or warrant?
Nope, for example Wire is based on Signal protocol and doesn’t harvest phone numbers https://wire.com/en
I’m suggesting that if metadata is being leaked then it has to be assumed that it will be used nefariously at some point
Exact same argument that applies for wanting e2e encrypted messages that aren’t seen by the server also applies to any metadata associated with these messages.
Removed by mod
My reply from the other thread. People who claim this isn’t true aren’t being honest. The phone number is the key metadata. Meanwhile, nobody outside the people who are actually operating the server knows what it’s doing and what data it retains. Faith based approach to privacy is fundamentally wrong. Any data that the protocol leaks has to be assumed to be available to adversaries.
Furthermore, companies can’t disclose if they are sharing data under warrant. This is why the whole concept of warrant canary exists. Last I checked Signal does not have one.
https://en.wikipedia.org/wiki/Warrant_canary
JWZ seven years ago: Signal
Wow didn’t even know about that, what a shit show. It’s so weird how Signal has become a sacred cow in the west now, and you can’t have a rational discussion about its many problems without a whole bunch of trolls piling on saying you should just put faith in Signal unconditionally.
Removed by mod
That’s my view as well, the only way to know that data isn’t being used for adversarial purposes is not to share it in the first place. I think it’s fine to use Signal as long as it’s an informed choice. The primary issue I have is that people don’t seem to want to accept that Signal collects phone numbers and that this could be used in a nefarious way. It seems to be an ideological stance as opposed to a rational one.
The app (locally, on your device) checks if someone from your contact list installed (became available) on Signal, and if they did, you get notified by the app.
Someone can get notified only if they already have you in their contact list (so they already have your phone number), and have Signal installed.
I still wish you could choose if you want others to be notified tho…
phone number isn’t just any metadata; it is the anchoring data around which the rest of metadata is collected, and it is also connected to govt/corporate verified real identity.
why would anyone even claim to offer privacy around such an anchor ?
Exactly, especially when we’re talking about the US government that has access to all the data from other large US based media companies like Google and Meta. We know this for a fact thanks to Snowden leaks. Once you have a phone number, you know the identity of the person, and you can trivially cross reference all the other data to see if that person is of interest. And thanks to their Signal connection graph, the government can easily tell what other people they communicate privately with.
So what? I’m sure your neighbor couple talk privately to each other most of the time and you know that happens. The important part is that the conversation is private.
Signal is not an anonymous messenger app. It never claimed to be. It’s for you to have a private conversation where your device holds the encryption keys.
Not like WhatsApp, where Meta has access to the keys of all conversations. Also 95 % of the worlds population is on WhatsApp, so why don’t you go and complain to them for lack of privacy and security?
If you want an “anonymous” chat client they are out there to use. Good luck getting more people onboard other than your savy friend.
If you understand that this information is being leaked, and that’s not part of your threat profile that’s perfectly fine. The problem is that a lot of people don’t seem to understand the implications of Signal harvesting phone numbers, and therefore make bad assumptions regarding the safety of using Signal. It’s pretty clear that a lot of people aren’t conscious about this in this very thread in fact.
Removed by mod
Wire uses Signal protocol and doesn’t harvest phone numbers, so I’m pretty sure we do actually know what the answer is. The fact that Signal made this design choice is very concerning to anybody who understand the implications of doing that.
Removed by mod
Signal’s use case is “authentic communication”. like when a govt person interacts with other govt person and doesn’t want a second govt to snoop on the actual contents on the communication, but accepts that metadata is public.
It is whatsapp for such people, without being whatsapp.
But then why would you use whatsapp either ?
This is really interesting. It brings two questions to mind.
Don’t all messaging apps use phone number as a primary metadata value?
Are you suggesting that Signal could either not use this metadata or not collect it and yet they choose to collect it and can therefore lose it to exfiltration or warrant?
Exact same argument that applies for wanting e2e encrypted messages that aren’t seen by the server also applies to any metadata associated with these messages.