Hacker News new | ask | show | jobs
by Mediterraneo10 1987 days ago
It has taken years: one of the major GitHub issues requesting alternate identifiers than a phone number for privacy’s sake dates from 2014. [0] The devs last year started to speak publicly about making the change, but they were aware of the privacy concerns among users for much, much longer.

[0] https://github.com/signalapp/Signal-Android/issues/1085
1 comments
Krasnol 1987 days ago
> The devs last year started to speak publicly about making the change, but they were aware of the privacy concerns among users for much, much longer.

You realise that this is something completely different than what you wanted to imply are you? Up until they introduced the PIN, they've been defending the phone number. Just because someone had a issue on github, doesn't mean they've been working on it...

link
Mediterraneo10 1987 days ago
Whether they were working on the Github issue or not, is irrelevant. Those Github issues (if not their own intuition already) would have already made them aware that by requiring a phone number, they were compromising user privacy. Of course they had their arguments for requiring a phone number.

You think I’m knocking the app. I’m not, I think it is the best option available. I just feel that as long as the phone number was required, they could have been clearer to ordinary users about the threats that Signal aimed to protect users from: advertisers and ordinary criminals, sure, but not necessarily the state authorities, and so it might not be suitable for dissidents for the time being.

link
Krasnol 1987 days ago
Of course it's relevant.

One is some guy posting someone in the issue tracker where 1000s of other ideas are. The other is "them working on it".

https://signal.org/blog/contact-discovery/ (2014)

link
Mediterraneo10 1987 days ago
Exactly, they have made arguments for the usefulness of the phone number as an identifier. But to the best of my knowledge, they have never specifically acknowledged in a blog post the state’s linkage of phone numbers to individual identities in many countries today, and the risks that this poses to dissidents.

Moxie is one of the best security researchers in the business, he was definitely aware of this before anyone ever brought it up on GitHub. Was it really so hard for the Signal devs to acknowledge this downside on the blog?

link