Signal blog post on the topic, with instructions and links to join the beta: https://signal.org/blog/phone-number-privacy-usernames/
this post was submitted on 20 Feb 2024
368 points (97.9% liked)
Technology
59589 readers
2838 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Awesome! I love Signal and the lack of usernames has always been one of it's bigger downsides, especially when comparing against other messaging apps.
Can LEO tie a username to a phone number?
Depends. How smart is Leo?
From Signal's blog footnotes:
Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs. Signal can’t easily see or produce the username if given the phone number of a Signal account. Note that if provided with the plaintext of a username known to be in use, Signal can connect that username to the Signal account that the username is currently associated with. However, once a username has been changed or deleted, it can no longer be associated with a Signal account.
So do I still need to provide a phone number when I sign up?
you will still need a phone number to sign up for Signal
From signals official blog, yes you do
Well, then this changes nothing as it applies to political organizing.
Damn. So still not a replacement for iMessage. Does anyone know of a good iMessage replacement (doesn't require a phone number, available for under 13s)?
Finally!
Careful though. Maybe not as "private" as you may think... a thread from @sc00bz@infosec.exchange - https://infosec.exchange/@sc00bz/111966928032512918
I see this as both a win and a problem:
As soon as you take away a hard link to a real-life identifier, the sketchy people come out of the woodwork and spread images of child exploitation.
Signal has not had this problem like some platforms (e.g. Kik), and I suspect two reasons:
- Lack of searchable chat rooms
- Concrete link to a phone number that anyone who contacts you must know (and make it easy to identify you to authorities)
Up until now signal has been an excellent secure replacement for text messaging between parties that know each other. I hope they don’t go the “chat groups” route, though I doubt they will. But I suspect this change will make it a preferred way for abusers to exchange images and videos nearly anonymously.
The implication is that a phone number is still required, you just no longer have to share that with the people you communicate with.
Their blog post says explicitly that phone number is still required for sign-up and that usernames are purely meant as an avenue to message new people without sharing your phone number. Your username isn't even visible to anyone but you and you can change it whenever you want.
That does help. While It adds an extra step to the reporting process (having the authorities identify the human behind the tag), it does at least nearly guarantee someone can figure out who is behind it.
it's called “phone number privacy.”
Really rather important feature in places like here in Finland, where your phone number (and car license plate) is directly linked and publicly searchable to your full name and address :)
I think this all comes down to how you separate the medium of communication and the content. Nobody cares that you can send encrypted emails between people on any server in the world. Or place encrypted files on any number on free cloud storage solutions. End to end encrypted communication between anonymous parties is fairly easily achieved if you just think about it a little. We don't hold those systems liable for the content they transmit unknowingly, either legally or in public opinion.
Why is it different for chat services? Have we just become conditioned because Facebook, Twitter, etc decided they needed to police their networks?