Hacker News Reader

Comment by 2pEXgD0fZ5cF | Hacker News Reader

Did Signal give solid reasoning for disallowing accounts and usage without an attached cell phone number? (I assume the question comes up frequently, but I don't know the answer)

View on HN

Moxie has publicly tweeted that they're working on supporting Signal without phone numbers, e.g. here [1] and here [2]:

[1]: https://twitter.com/moxie/status/1280904362999476226

[2]: https://twitter.com/moxie/status/1348031542606454785

Using phone numbers as identifiers for encrypted messages is the core feature of Signal. It was marketed from day one as a drop in SMS replacement. Initially it even used SMS as the transport for encrypted messages. It was literally called "TextSecure". This is why I have always found the attacks on it using phone numbers to be amusing.

The problem is that in the years since Signal was launched like that, more and more countries around the world are requiring you to show ID to buy a SIM card, and then a copy of that ID is made and sent on to the authorities. So, the state has a one-to-one correlation between phone numbers and individuals, and so it can see who is using Signal.

So? Signal is just a messaging client. The goal of Signal is to get it widely used by as many people as possible, so that it's a totally normal thing to have on your phone.

If a country has gotten to the point that you would be targeted just for having an app installed, just changing to usernames wouldn't be enough, as users could be easily detected through network logging (thanks AWS and Google for killing domain fronting [0]). Your usecase sounds like it needs an app like Briar.

[0] https://news.ycombinator.com/item?id=16970199

> Signal is just a messaging client.

It's pushed as a secure messaging client, and so when it doesn't meet the standards for that people will mention it so potential users have the information needed for a risk assessment.

Security =/= Anonymity.

Only phone numbers: your own contact list IS the social graph. You lose your SIM card, you lose your friends.

Usernames: Signal needs to store your social graph (in a privacy preserving fashion) on a central server.

So, paradoxically, phone numbers were the easiest and most secure option to start with.

This is the core routing issue. If you don't have centralized system to locate a "user", then the only alternative is to broadcast all messages to everyone, which is not a scalable solution.

Actually, there must be methods for distributed routing. How does TOR finally map a hidden service to an IP address?

Maybe there can be a dynamic DNS service for user accounts on an anonymous messaging network?

Distributed Hash Tables

I think it was (1) fighting spam and (2) the social graph already exists due to contact books.

I think officially it’s just (2) and (1) is just a side effect, but I think it’s secretly more about (1)

From what I gather, the phone number is only used for identification of a user account. Can't exactly remember where I came across this information (probably an ama from their team on reddit) but Signal have recently said they are looking for ways to make the above not a requirement for its users.

I don't see this sim lockdown being a problem unless you want to create a new account or for some reason your account has been logged out requiring 2FA. In my understanding, telegram also asks for SMS for 2FA on re-login. Though the 2FA code will be simultaneously sent to any other device you've logged the account in.

I got $10 verizon prepaid and set up my whatsapp and signal that way.

Unfortunately in many countries even prepaid SIM cards are directly tied to government ID verification. I know this has been discussed many times, but I agree that it would be nice to be able to use Signal for secure communications without a phone number.

I find it interesting that Germany is one country which does this. A country which has strict privacy regulations and people prefer to use cash rather than cards, but they are happy to carry a device which can track their every movement and is tied to their government identification. This isn't an EU thing, there are quite a few EU countries where you can buy and activate a SIM without any ID.

Have there been any cases where the people have spoken out against such regulations, and they have been reversed?

The history of terrorists using pre-paid SIMs/phones for both coordination and remote bomb detonation has necessitated this.

Horse hockey. They'll still do the same thing, there'll just be larger networks of individuals who activate a SIM and then swap it with someone else. The terrorist excuse is no excuse at all. It's just a pragmatist's paving stone on the path to hell and tyranny.

That seems kind of silly given you can easily buy a SIM card from eBay for another country that doesn't have such requirements.

Reply on news.ycombinator.com