Tariq

Friend asked me about Signal, triggered by the ever growing concerns about US big tech.

They're not technical and I said I'd look into it for them.

I've never used it and upon install it asked for

1. Permissions to see my "contacts"

2. A phone number.

What? Why?

Can Signal be used without these?

#signal #signalapp #security #privacy #surveillance

Feb 21 at 4:58pmWeb
Show threadTariqFeb 21

One follow up.

Non-technical users expect a new phone to just catch up with previous messages etc because the service hold that information centrally.

I assume if you lose your phone and start again on a new phone, you have lost all message history and need to rebuild contacts.

For people like me, this is acceptable if it avoids a central service knowing this information.

But it may be too much for normal users.

Have I got that right?

Show threadTariqFeb 21

Actually one last question.

Will signal ever require user ID to be verified as many services are now or will soon?

One of the reasons my friend is considering alternative apps is they don't want to give biometric information to a dodgy US outfit.

Show threadDerek MorrFeb 22
@rzeta0 signal uses a pin or passphrase to protect any encrypted data that you sync. They don’t use biometrics.
Show threadSilmathoron ⁂Feb 21
@rzeta0
They are rolling out a free encrypted backup option for text messages, for attachements you need to pay (or backup locally but I guess we were talking about normal users, so...)
Show threadChristian Lawson-PerfectFeb 21
@rzeta0 1. yes. 2. no
Show threadTariqFeb 21

@christianp

That's a real shame.

In the era of ICE and rising state authoritarianism I wonder if that is becoming a more urgent issue?

Even if the signal organisation can forever be trusted not to abuse the phone number, it doesn't mean that information can't be taken from them, by the state for example.

Show threadSyntaxFeb 21

@rzeta0 @christianp Now it’s possible to not share your phone number to add people on Signal, e.g. share a username.

Requiring a phone number is an outstanding issue since years, with no solution on the horizon.

It’s still better than Meta.

Show threadTariqFeb 21

@sntx @christianp

Thanks. The ability to use a username is a good thing.

Show threadizumiteljFeb 21
@rzeta0 @christianp I dont believe it is stored in readable or easily retrievable way (@signalapp). Signal regulary achieves top reviews by security and privacy experts. I think more delicate issue with Signal is that their servers and protocols can be completely blocked by autocratic goverments.
Show threadDerek MorrFeb 21
@rzeta0 @christianp your phone number is effectively public, at least to the government. Signal cannot access your contact list, group membership group metadata, or profile info.
Show threadTariqFeb 21

@derekmorr @christianp

Thanks this is useful

Show threadᎶㄖ卩卂ㄥFeb 22
@rzeta0 @christianp
1) signal need access to your contacts to do contact discovery.. to figure out who in your contact lists are a signal user. .However signal doesn't harvest your contact list and use it infringing your privacy.. you can read more on signal's contact discovery here. signal.org/blog/private-contact-discovery/
2) Signal is designed to use a phone number as a primary identifier. Signal do provide phone number privacy, which is on by default, which make sure that your phone number is not exposed to other signal users (unless they already know your number, but you can change that too).
You should decide if you want to use signal based on your threat profile. If sharing your phone number to signal for registration is a no-no from a threat perspective, signal is not the right solution for you. But if you are already a whatsapp user and are trying to move on to a more secure platform, signal certainly provides you much better privacy.
What signal can reveal about you is documented here signal.org/bigbrother/ You can take a look and decide if this is good privacy for your threat profile.
HTH..
Technology preview: Private contact discovery for Signal

At Signal, we’ve been thinking about the difficulty of private contact discovery for a long time. We’ve been working on strategies to improve our current design, and today we’ve published a new private contact discovery service. Using this service, Signal clients will be able to efficiently and s...

Signal Messenger
Show threadTariqFeb 22

@gopal @christianp

thanks - very helpful.

Show threadRene Raggl 🇪🇺 🇺🇦 🇬🇱Feb 21

@rzeta0 Signal will not work without a phone number. The contacts (if you give permission) is used to show you who of the people you know already uses it.

If you want messengers that are fully anonymous check out @delta @threemaapp or @briar

Show threadTariqFeb 21

@rraggl @delta @threemaapp @briar

thanks for the suggestions

a key priority here is also usability for non-technical people because my friend and their friends are just "normal facebook users"

I'll take a look at delta as someone else mentioned it too

Show threadRene Raggl 🇪🇺 🇺🇦 🇬🇱Feb 22

@rzeta0

Delta is plenty easy.... once you created your account (you can use one of their chatmail relays or use a mailserver of your own if it is compatible: https://providers.delta.chat) you just send your friends your invite link and they will be guided through the process. If you are helping them set up in person you can just scan a QR code.

Did it with non-technical acquaintances of mine and had it up and running in minutes no input from me needed.

The in-chat apps are a nice to have too.

Email Provider Overview

Show threadLeander Lindahl 🇪🇺Feb 25

@rraggl @rzeta0
Yup. I agree with @rraggl

Delta is not located next door to Meta and Alphabet in Mountain View, Silicon Valley. Its open source based in Freiburg Germany. It doesn't have a big marketing budget and doesn't make million dollar losses https://projects.propublica.org/nonprofits/organizations/824506840

Delta is a great app in my opinion. Super easy to get your non-techie friends started with.

Also the decentralised nature means its not dependent on AWS, US-EAST-1 and Cloudflare.

#DeltaChat

Show threadRene Raggl 🇪🇺 🇺🇦 🇬🇱Feb 22

@rzeta0

For the rest, Delta Chat works pretty much like every other messenger...

But do keep in mind it is e-mail based, so the conversation will be not quite 100 % real time. There can be a couple of seconds delay between you sending the message and it arriving at the receiving end. But there is no normal "chatting amongst friends" situation that I can think of that requires a message to arrive in milliseconds.

Show threadRene Raggl 🇪🇺 🇺🇦 🇬🇱Feb 22
@rzeta0 The biggest boon of Delta Chat I found so far is it's ease of use, complete anonymity and the fact that it is multi-device by design.
Show threadKlaus-Gerd GiesenFeb 21
@rzeta0 Try Session.
https://getsession.org/
Session | Send Messages, Not Metadata. | Private Messenger

Session is a private messenger that aims to remove any chance of metadata collection by routing all messages through an onion routing network.

Session
Show threadAlex05Feb 21
@rzeta0 💡 Why does Signal need your phone number? 📱
Your number acts as a secure identifier linked to your public key, ensuring end-to-end encryption remains seamless. 🔐
By optionally syncing contacts, Signal easily connects you with friends already on the platform without storing your address book on their servers. Private & convenient! ✨
#Signal #Privacy #Security #Messaging
Show threadAlex05Feb 21
@rzeta0
Is "trust" enough for privacy? 🤔
Signal uses secure enclaves (Intel SGX) to hash numbers so they "can’t see" your data. But should we rely on server-side tech at all?
Alternative apps like Olvid or Session require NO phone number, removing the link to your physical identity entirely.
Is crypto-math enough, or is "zero data" the only true security? 🔐✨
#Privacy #Signal #Olvid #CyberSecurity #TechTalk