Now if they would drop the ridiculous requirement of having a phone number and go with usernames and not require access to my contact list like most other services, you could actually be safer and not rely on _their word_ alone.
As moxie said, it's about raising the defaults of the world, not about making it secure for the crypto nerd.
The thing is, the attacks in the "crypto-nerd paranoia" category tend to become everyday attacks over time. Pre-Snowden, most people would put a lot of the things the NSA is doing into the "crypto-nerd paranoia" bucket. Now we know they were wrong to do so.
Signal routes all conversation metadata through one infrastructure, which becomes a very tempting target. By also requiring phone numbers as identity, they make it very easy to tie that metadata to real people and perform graph analysis on it.
Regarding the simplicity of using a phone number and how it would be very easy for all users - Wickr provides basically the same service, is more popular, but uses usernames instead of phone numbers.
The fact that something is open source isn't always a clear win. OpenSSL, for example, is open source and yet they seem to have many bugs.
For the record, I use Signal almost exclusively for communication. I just wish it was more protective of users' privacy without having to put in a ton of effort.
This is country-specific. In Germany, any data usage exceeding your plan is free but terribly slow, usually 64kbit. That's good enough for messaging and checking email (and HN comments).
The phone requirement is beyond ridiculous. How did Signal get the reputation it enjoys in the tech community anyway?
You can thank Edward Snowden for that. In fact, they have his picture and testimonial on their front page:
[1]: https://wire.com
After the last flare up on Twitter, I thought they wrote their own implementation, using the Signal code as a reference.
------------------------------------------------
I've been using Wire for a few weeks now and I'm absolutely happy. They recently released a linux client https://medium.com/wire-news/get-your-linux-on-999403a1a4fe#... (not a chrome app!) (though I think it's electron).
I'm quite happy with them, give them a try.
Possible reason: https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7...
> does not need a copy of your contacts
is not quite correct if you read the fine print.
> 5.1 Account ... You agree that if you give the App permission to access your address book, anonymized phone numbers and emails from the address book will be uploaded to the Service for the purpose of connecting users.
I just posted a sibling comment to the GP: At least in August it wasn't optional and happened automatically on Android, unless you were running M: The permissions requested during installation (contact access, to even have a way to offer this feature) of the app were exercised without asking for further consent and your contacts were shared with their server unconditionally.
Don't know though if the app asked for permission to access contacts like it should, since I don't have any device with M.
This is from the Privacy whitepaper how they manage the data shared [1] :
> Address books are uploaded to backend servers if users grant client applications access to their contacts. Each address book entry is first normalized, i.e. phone numbers are ensured to be in E.164 form. Entries are then hashed (using SHA- 256) and base-64 encoded before being transmitted to the server. No other information, such as names, addresses, birthdates, notes, etc. are extracted from the address books. Address books are checked for changes every 24h by clients and changes are uploaded again. Uploaded address books are used to match users on Wire, i.e. to suggest new contacts and to automatically create connections between users (see section 2.2). The matching algorithm creates connections between users who have each others e-mail address or phone number in their address book.
Tried it on Pre-M and M, it worked correctly on M ("Wants to access your contacts" -> Denying didn't harm the app). For Pre-M it was as I described above: Opt-out (and worse, they have/had no way to remove contacts, at all) instead of opt-in.
I appreciate the update though - will look into Wire again these days.
Oh, thanks that's good to know. And impossible to find out without just installing the app.
> Entries are then hashed (using SHA- 256) and base-64 encoded before being transmitted to the server.
This signals that they care about privacy, but it doesn't really provide much protection against someone who wants to break it. Maybe it's just about keeping honest people honest. It would be very straightforward to dictionary attack the un-salted hash. Using a password cracking program like HashCat, you could probably recover most of the numbers in a few hours.
I still use Telegram for the most part, Wire for some, and Signal the least - this is mainly due to the user experience, feature set and speed of message delivery.
Wire has not even a way to remove contacts. I'm not kidding. After the faux pas above I had random 'Wire contacts' that it discovered for me, based on a combination of 'in my address book' and 'in their address book'. You cannot unfriend/remove those, at all. Talked to their support and they actually confirmed that (4th of August, doubt that it changed) you can only _block_ users.
Blocking != removing. If "random ex-coworker" comes up in my list, I might want to remove the contact without blocking the person. One's "Don't care about this contact" vs "This contact has no place in my life".
Bringing Wire up as a decent example for contact handling therefor seems .. strange.
I am sorry to hear about your Android experience, but I abandoned that platform long ago because of confusing management of per-app permissions, along with Google's penchant for data collection. Wire users on Android should try to get Wire developers to improve the control options on that platform, they usually respond within a few days to support requests.
I almost bought a separate iOS phone just to run Signal without access to contacts. Since Wire came along, that is no longer necessary and I can use Wire without a phone number.
Of course you can pay cash and make up an address
No muss, no fuss. Just activate it at the on-prem McDonalds and you're golden*.
If a privacy-focused app makes you nervous about privacy they've already lost the war, haven't they?
They have a privacy policy https://whispersystems.org/signal/privacy/
They have explained their reasoning https://whispersystems.org/blog/contact-discovery/
You have access to the source https://github.com/WhisperSystems
You have proof that they don't store your contacts and can't provide them even after a subpoena https://whispersystems.org/bigbrother/
Again, what exactly are you nervous about? What is gained by removing contact discovery?
I don't particularly want to send Signal a list of contacts - I'd rather not leak that information about my social graph. I understand how they want to use that information for discovery, so they can know who already uses the app.. But for my needs, this isn't necessary. I'd prefer to manually ask my friends for their username on the service.
If there were additional options, I might choose to use their service. As it is, it doesn't fit my needs, and that's OK.
I'm sure there's plenty of other people who appreciate it.
Of course it would be nice if we didn't have to trust them that this won't change in the future (whether through a court order or their decision doesn't really matter).