For the longest time, you couldn't. It wasn't until this release I realised that had changed. If it changed before, it wasn't well communicated to me as an Android signal user. I was on beeper and then molly precisely because there was so little traction on changing this. You could install signal fine, but you couldn't QR code or secret phrase mesh it with your android handset. Oddly, iPad meshed fine with iPhone or Android, and OSX desktop likewise. Just Android tablet which didn't.
Do you think this changed in over 18 months? I think it changed in under 18 months.
If I’m not fully mistaken, I checked for the combination of iPhone as main device/Android tablet as iPad-like second device sometime in the past six months, at most since the beginning of the year, and it wasn’t possible (unlike phone + iPad as tablet, which seemed quite strange to me).
This is the right solution. A one-time payment in crypto, say $5, ought to be enough to prevent spam. That being said, Signal has demonstrated (when presented a warrant) that they do not store phone numbers. If I remember correctly all they stored was an account ID and a UNIX timestamp such as the last login.
> If I remember correctly all they stored was an account ID and a UNIX timestamp such as the last login.
How do they perform address book matching without an phone number? It just being accessible by SGX does not really count as not storing it.
Problem with phone numbers is they are to short to store as a hash, since you can brute force the sha256 of an phone number in a trivial amount of time on a single consumer device
Wouldn't a payment of about $0.05 do the trick? My understanding of most kinds of spam is that it relies on being able to deploy hundreds of thousands of bot accounts just to get a few hits.
The most ubiquitous, absolutely. Their data collection is unparalleled. They're on almost every website, app, they have fingers into payment and browsers and mobile OSes.
In terms of what they do with big data there's more evil parties like Palantir but data abuse starts with collecting it, and I would object to it even if Google promised to only use it for good. For me my privacy is already violated when my data is collected, not just when it's abused. And I do consider Google's use of that data abusive, just not in the worst ways.
The idea that Google isn't the worst in respects to privacy is not an idea I've seen. Is there a company you propose as being worse? I think Meta is the next contender but they don't have nearly the same influence, so its still Google. Not for a lack of trying though. Mark would love to have the data and infrastructure dependence that Google holds over the internet.
Why? Just raise the prices if they get more spam on non-google payments.
I've literally registered a Signal account on one of the free SMS sites floating around. Why would spammers choose the payment route over phone numbers? They would just choose the one that's cheaper.
googles obligation to hand out all account linked info notwithstanding, one may still create google accounts without associating a phone number, by doing so on old android versions. signal does however explicitly force credit card info here, thus providing direct individual traceability ..
Nobody uses that and I think it was pre-mined. They should have implemented Monero but the UX isn't there. Maybe a Monero light wallet server run by Signal.
They probably avoided Monero to not attract the additional scrutiny. They don't even accept donations in Monero.
Claims without evidence can be dismissed without evidence.
Signal is not robust for metadata protection. Neither do they advertise anonymity. They take steps to protect metadata but it's nothing compared to SimpleX.
If it's "the feds", then how? There's reproducible builds on all platforms except iOS so we know the source code is what's running on our devices. Can you point to the code where the E2EE is compromised?
They are the largest messenger that has E2EE backups by default.
If I was the NSA, I would be using the fact that signal uses AWS for their backend combined with the cudgel that .us.gov has with the AWS govcloud contract to mandate that all traffic to and from signal's backend also gets routed to NSA traffic analysis servers, which could then be correlated with other sources like ISP data to get a pretty complete record of all Signal message metadata.
To be clear, I use signal pretty heavily, but that's because my threat model doesn't really include competent .us.gov actors. I don't think that they'd either prove they're doing this or go through the trouble of parallel construction over anything in my messages or who I'm talking to.
Nobody is arguing the e2ee isn't valid, its useful as a metadata collection platform, which is all they care about. Former NSA and CIA Director Michael Hayden famously stated: “We kill people based on metadata." and then he tried to hold back a smile and said "but not with this metadata". It's usefulness as a metadata collection platform becomes much less useful if people don't trust it, so of course it's secure.
If you can convince as many of your enemies (the american people who politically organize against them) to use the same platform, your job becomes easier than having to ETL from 20 different privacy platforms..
To be honest, I use signal, I have nothing to hide but it is useful in that nobody can spoof me (easily). I even talk to my 60 year old mother on signal. It has it's uses. But the EFF is definitely a federal psyop to get people using tools and techniques they control.
Just look at the people who created TOR, they're all feds. All these projects are funded by feds. These tools are advertised in CIA recruitment campaigns, they are literal weapons to circumvent nation state firewalls and deliver psychological weapons, overthrow governments or allow covert recruitment of foreign traitors.
I'll see your conspiracy theory and raise you one: What if the feds fund tech privacy projects specifically so that people like you won't trust them, and instead embrace privacy nihilism?
This is a known strategy of the Kremlin, by the way. They fund opposition groups which protest them, and then leak the fact of that funding so that people who are genuinely upset at the Kremlin get confused about who is captured opposition and who is legitimate.
It can be a signal in some cases, but funding sources are not a reliable way to make a conclusion about a group's motivations.
>Signal is for protecting opposition groups that help in regime change operations
SMS registration flow is trivially blocked in places where regimes are controlling telecom infra. And Twilio is unreliable in dozens of places for non-political reasons. Signal is very first-world centric from this point of view.
True, if they're not even going to allow that for payment then they might as well remove it from the app altogether. Because what's the point if they don't even believe in it themselves.
Too many of these low end resellers are unreliable, root your VM and unprofesionally fight with customers in the forums. They are children. Go with one that owns the hardware.
Yeah. Back in ~2011, when I was in high school, I used to sell these kinds of VMs as a host and advertised on LowEndBox. Literally as a minor. I don't really trust any small time host with my data.
Meanwhile I recently migrated a $5 DigitalOcean VM that's been running flawlessly for over 6 years. It was in dire need of an Ubuntu upgrade. I expect this one to keep going for just as long!
Not necessarily. I've been using a couple of RackNerd VPSs for non-critical stuff for a few years now and they have been rock solid. Hetzner and Contabo are also reputable providers with competitive pricing.
I recently migrated from Digital Ocean to Scaleway. Digital Ocean was great but I had to make sure my stack was entirely in the EU in case the US decides to hit a kill switch for some mental negotiation tactic. Pricing and interface and performance are all similar.
No idea why you're being downvoted. I've bought el cheapo LowEndTalk-style VPS specials on two or three occasions and have gotten what I paid for each time. They either sold a microscopic slice of some over-provisioned 15-year-old POS or outright lied to me about specs then argued until I did a chargeback to recover my money.
For app hosting I'd either 1) use cloudflared and a cheap Lenovo Tiny box to host from my house, 2) write something serverless that runs on Cloudflare Workers, or 3) use a real host that isn't 18 months old and run by hucksters in a race to the bottom.
reply