Add disclaimer to signal #432

New Issue

2018-04-09T01:15:26Z

ghost commented

2018-04-09 01:15:26 +00:00

(Migrated from github.com)

As you know, signal requires you to use your phone number in order to use it, but in some countries(like mine), phone numbers are tied to specific people. For example, here, you have to give your id number and use your fingerprint in order to get a phone number, even for prepaid ones! (dunno how it is for other countries).
That is why, at least in my case, using signal pretty much defeats the whole privacy thing.
Please excude my paranoia :P

As you know, signal requires you to use your phone number in order to use it, but in some countries(like mine), phone numbers are tied to specific people. For example, here, you have to give your id number and use your fingerprint in order to get a phone number, even for prepaid ones! (dunno how it is for other countries). That is why, at least in my case, using signal pretty much defeats the whole privacy thing. Please excude my paranoia :P

ghost commented

2018-04-09 11:13:31 +00:00

(Migrated from github.com)

Thanks, and you can use a foreign service https://infosec-handbook.eu/blog/signal-myths/#m2

zero77 commented

2018-04-09 16:50:29 +00:00

(Migrated from github.com)

@zeroweb91
Although, you have to use a phone number to register and for verification, you can use a disposable number.

There are many free disposable number services or it is possible to create your own.

@zeroweb91 Although, you have to use a phone number to register and for verification, you can use a disposable number. There are many free disposable number services or it is possible to create your own.

ghost commented

2018-04-11 03:20:52 +00:00

(Migrated from github.com)

@zeroweb91 The good Lord Where you live. Korea, Chinese. I recommended use https://github.com/siacs/Conversations this had OMEMO encrypted y you can use any xmpp service that suits your needs for example https://conversations.im/compliance/ https://en.wikipedia.org/wiki/XMPP

ghost commented

2018-04-11 07:22:29 +00:00

(Migrated from github.com)

@hachiman29
There are dozens of discussions where people compare XMPP with Signal, mostly Conversations vs. Signal.

While Signal requires an arbitrary phone number and officially allows you to choose any phone number you like (you must only be able to verify that you can access it), Conversations (or XMPP clients in general) requires an XMPP account on an arbitrary XMPP server.

At first glance, XMPP might look more privacy-friendly due to no phone numbers involved. However, XMPP servers store tons of metadata and personal data like your contact list, group memberships etc. unencrypted. You have to fully trust at least your XMPP administrator (and other as well if you chat with people on other servers) that he/she don't access your data or logs your server usage.

The next problem is that OMEMO still isn't widespread and barely supported by XMPP clients. For instance, some clients only allow you to use OMEMO in 1-to-1 chats, making it impossible to securely chat in groups.

There are even more downsides of XMPP like unencrypted fallback, no consistent security level of servers, the recent removal of widespread OTR encryption in Conversations (yes, there is Conversations Legacy now!) and Gajim etc.

In a nutshell, if you aren't in full control of all XMPP servers involved and secured your server configuration, you shouldn't use XMPP.

Back to topic:
As mentioned by @Shifterovich and officially by Signal, you don't have to use your private phone number for Signal. Buy another SIM card or online VoIP number, use it only for Signal registration and set a Registration Lock PIN.

@hachiman29 There are dozens of discussions where people compare XMPP with Signal, mostly Conversations vs. Signal. While Signal requires an arbitrary phone number and [officially allows you to choose any phone number you like](https://support.signal.org/hc/en-us/articles/215073067-What-phone-number-can-I-use-) (you must only be able to verify that you can access it), Conversations (or XMPP clients in general) requires an XMPP account on an arbitrary XMPP server. At first glance, XMPP might look more privacy-friendly due to no phone numbers involved. However, XMPP servers store tons of metadata and personal data like your contact list, group memberships etc. unencrypted. You have to fully trust at least your XMPP administrator (and other as well if you chat with people on other servers) that he/she don't access your data or logs your server usage. The next problem is that [OMEMO still isn't widespread and barely supported by XMPP clients](https://omemo.top/). For instance, some clients only allow you to use OMEMO in 1-to-1 chats, making it impossible to securely chat in groups. There are even more downsides of XMPP like unencrypted fallback, no consistent security level of servers, the recent removal of widespread OTR encryption in Conversations (yes, there is Conversations Legacy now!) and Gajim etc. In a nutshell, if you aren't in full control of all XMPP servers involved and secured your server configuration, you shouldn't use XMPP. **Back to topic**: As mentioned by @Shifterovich and officially by Signal, you don't have to use your private phone number for Signal. Buy another SIM card or online VoIP number, use it only for Signal registration and set a Registration Lock PIN.

Vincevrp commented

2019-02-28 19:53:09 +00:00

(Migrated from github.com)

@Shifterovich this was implemented in #436, but it seems to be gone?

ghost commented

2019-02-28 20:07:51 +00:00

(Migrated from github.com)

No idea why. Anyway, the warning should be implemented by a label, similar to Riot.

ghost commented

2019-04-22 08:49:01 +00:00

(Migrated from github.com)

@zeroweb91

Please excude my paranoia :P

You're not paranoid in this case. It's quite sensible to oppose obligatory phone registration:

(PDF)

@zeroweb91 > Please excude my paranoia :P You're not paranoid in this case. It's quite sensible to oppose obligatory phone registration: ([PDF](https://github.com/privacytoolsIO/privacytools.io/files/3102795/phone_registration.pdf)) ![phone_registration](https://user-images.githubusercontent.com/18015852/56492243-7e442c80-64eb-11e9-90d0-39a919487e44.png)

blacklight447 commented

2019-08-09 20:31:39 +00:00

(Migrated from github.com)

adding a phone number is bad for anonymity, not privacy, signal never claimed to be anonymous.
anonymity is not part of its threat model. closing issue.

adding a phone number is bad for anonymity, not privacy, signal never claimed to be anonymous. anonymity is not part of its threat model. closing issue.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#432