Hacker News new | ask | show | jobs
by beefee 1411 days ago
Please, stop using phone numbers. There is no reliable way to hold a phone number. The messaging protocols are insecure. If your service uses phone numbers or SMS, that means it's not secure or reliable.
2 comments

Not only that, I don't want any service that I use tied to a phone number. Partially for the reasons you listed, but also because there are better alternatives; email, authenticator apps, physical keys, cards, etc.

I hate looking at my phone. I hate using my phone. I don't want to have even more reasons to keep my phone charged and in my hand. Phones suck.

The Signal desktop app doesn't require your phone to be turned on (once it's been "paired") by the way, as opposed to for example Whatsapp.
Well sure, but does it require me to use my phone at some point in the process of account creation? That's the part I have an issue with.

I had assumed that there would be an alternative to access the service post-creation. My gripe is more with the fact that a phone is a requirement at any point.

To put it another way: imagine I had to send a letter to Signal's HQ in order to make an account. Now, obviously I'm not going to be sending and receiving letters constantly to/from Signal, but the mere fact that writing and sending a letter would be a requirement as part of the process would be at the users personal detriment. That's the point I was trying to get at - that it is forcing the user into a specific method which is undesired, arbitrary, and frustratingly unnecessary.

Yeah agreed, as I mentioned elsewhere I don't see why phone number should be required. It's a good default (esp. for non-technical users) to use phone number and contacts (= "social network"), but I really don't see what the problem is with using email or just username/password combo and then adding contacts manually from wherever. Why not have that option? Most people would likely still use their phone number for this.
Whatsapp has finally gotten away from requiring your phone to be on. It works the same way as the Signal app now.
Ah, didn't know that, but you're right (just tried it)! That's cool. I ran into this issue around a year ago when my phone broke.
By desktop app you mean a website cosplaying as a desktop app.
I didn't know Signal had a web app.

Yes, I'm aware the desktop app is made with Electron. So what? I keep it running almost all the time and I've never had any performance issues with it.

Well, it's slow, it has awful accessibility, you can't create accounts from a computer, you will have performance issues with it if you need the resources for something else.

Also it won't work on linux phones.

What identity token would you prefer?

Would it be bound to the mobile device in any way?

Would it require that a canonical list of registered identities be stored server-side?

How would you impose a cost on spam accounts without burdening users?

Just a few considerations.