Email or username:

Password:

Forgot your password?
8 comments
j

@ilyess Highly disappointing that continuing SMS support, a highly desired feature, isn't happening and yet Stories, something *no one has asked for* is what is getting development time.

tallship

@jay @ilyess

Yes, a privacy first communications system, trying to cater to a "tictock" mentality didn't exactly inspire much confidence.

I never liked it anyway, having to expose your DID, then arguably misleading new users into letting it farm your contact database, resulting with anyone having your phone number in their contacts being notified that moment you create an account.

There's s growing trend though, where folks are listing their matrix addresses instead of their email address.

ilyess

@tallship I disagree on the "farming contact" part. #signal goes to extreme lengths[^1] to carry out contact discovery in a private fashion. Plus, they're working on a new feature that would allow users to prevent their accounts to be searchable/discoverable, allegedly coming out the same time as usernames.

All Signal knows about their users are: the time of account creation and that of the last connection to the server[^2].

@jay

[^1]: signal.org/blog/building-faste
[^2]: signal.org/bigbrother/

@tallship I disagree on the "farming contact" part. #signal goes to extreme lengths[^1] to carry out contact discovery in a private fashion. Plus, they're working on a new feature that would allow users to prevent their accounts to be searchable/discoverable, allegedly coming out the same time as usernames.

tallship

@ilyess

Thank you for that. It was a really good read. 🙂

But still, that's really just an elegant way to farm particular aspects of ones identity and then hand it off to third parties; in particular, any other signal user that has your DID in their contact database, while absolving themselves (Signal) of any blame because they haven't revealed those identifiers to themselves.

It may sound innocent enough, but I actually see this as a much more egregious trespass.

#tallship

⛵

.

@jay

tallship

@ilyess @jay

500 character count limits really suck, lolz.

I have to add more to my previous sentiment:

Imagine (true story), an ex [dangerous stalker] girlfriend that you've finally rid yourself of and haven't heard from her in a couple of years.

You install Signal, and soon thereafter she begins sending you scary messages again after being reminded with a Signal notification that you were once an object of her insane obsessions.

I do look forward to usernames though. That will be awesome

ilyess

@tallship In your example, all you'd have to do is block the ex-girlfriend on Signal. Furthermore, unless you accept her initial conversation request, she wouldn't be able to access any profile information of yours (profile name, picture, bio, etc.).

I'm looking forward to usernames and phone number #privacy as well. Hopefully, the team would be able to focus more on this after stories are out.

BTW, some #mastodon instances have a higher character count limit if you're into long posts.

@jay

ilyess

@tallship You're welcome :)

TBH I still don't get how any entity could farm particular aspects of any #signal user. Could you please elaborate on this?

My understanding is that the only publicly available information is whether or not a given phone number is registered with Signal. And the only information Signal has on its users, and that can be subpoena'd, is the time of account creation and time of last connection to the server.

@jay

tallship

@ilyess @jay

Sure :) if be happy to.

Since she had my DID (phone number) in her contact database, she (apparently) received an alert when she installed Signal informing her that I was also a Signal. user.

I had previously blocked her phone number so she couldn't call me over the PSTN from her number, and I did just let the signal message sit there for eternity (still there, but I use Matrix or OMEMO enabled XMPP almost exclusively nowadays.

Unless she bothered to call from another phone...

Go Up