Hacker News Reader

Comment by LoganDark | Hacker News Reader

Does this mean the protocol still exposes your phone number and it's hidden only by the client side?

The answer is almost certainly no. It means the old APIs that expose phone numbers will stop working in 90 days. And old clients along with them.

I have not investigated this at all, but I have enough faith in Signal/Whisper Systems to be optimistic.

The way they say "privacy settings will be honored by everyone using an official Signal app." kinda suggests they're gonna let third parties keep getting this info...

They won't. It'll be similar to message timers or delete for everyone. You can revoke sharing your number and it will be hidden in official apps but third party apps won't magically forget the number that was previously shared. However if you choose not to share your number from the start, no one will be able to see your number.

Found out the hard way that the old versions do stop working. You don't even get message notifications if your app is out of date.

Yup, I was on an international trip with hardly any data allowance when all of a sudden my messages stopped sending, and I couldn't receive any new ones... That'll never happen with SMS. I love Signal, but some of their product decisions have been questionable.

Their decisions seem right for the use case of a secure messaging app, but I don't care about that use case and would rather use a non-e2ee app that'll be reliable, not lock me out, and work seamlessly across devices. Also, for those who truly care about e2ee, it's pointless if you aren't checking all the safety numbers out-of-band.

Yes, this is a compromise on the CIA triad. It prefers integrity and confidentiality over availability.

That is a fine decision to make for a security-minded app, but signal has always presented themselves as a full alternative to SMS and other messaging systems where availability is prioritized over confidentiality and integrity. It should really be made more clear so that users are making an informed decision. They could also do wonders for the user experience by having the app inform the user of the problem and how to remedy it.

Yeah, but I wouldn't call SMS super available either since it relies a lot on the ends too. Had a lot of those drop when I traveled. Something like Facebook Messenger has a whole server storing messages, so it's solid, you'll receive them later even if your phone breaks.

Reply on news.ycombinator.com