Hacker News new | ask | show | jobs
by rt4mn 974 days ago
I really hope this eventually leads to a situation where an adversary cant forcibly de-link you from your signal account by taking control of your phone number or intercepting an sms.
1 comments

Doesn't the registration lock feature resolve this?
Nope. "If Alice registers number X and enables reglock, but Bob later proves ownership of number X (by registering and completing the SMS code), then Alice will be unregistered."

IE, if somone intercepts the SMS code, even with reglock, you can forcibly de-register somone. This means if you use loose access to your phone number, you can easily loose access to your signal account.

https://github.com/signalapp/Signal-Android/issues/12595#iss...

They justify this by saying "The intention of reglock is to prevent hijacking of numbers you actually own, not to guarantee the number for yourself for life", but its way to easy for activists and dissidents to lose ownership (temperately or permanently) of phone numbers for the phone number system to be the backbone identity system for a secure messaging platform