Hello Noir,
I have been thinking about your proposal for multiple aliases and why
you think it is important. I agree with most of what you are saying,
though I don't think that phone numbers as identifiers (as opposed to
aliases) is precisely the problem. If I understand correctly, the change
in the Signal client that would provide the functionality you seek
(without changing the current phone number ID system) is to allow
multiple phone numbers to be registered through a single client. In this
case, "deleting" the IDs would be accomplished through the same options
that are currently available for unregistering a number from the
servers. Even though I think it is a good idea, and involves less
changes than there would be from switching away from phone number IDs, I
also think it still introduces the kind of complexity into the app that
OWS seems pretty committed to avoiding.
So is there another way to provide the functionality using the current
Signal client? You mention three options that do not work well:
reinstallation, multiple phones, or virtualization (I'm not sure how
this last one would work). Of these three, I think multiple phones is
most reasonable. I can see how carrying two phones is tricky (I have
also had to do it in the past!), but it wouldn't always be necessary. If
the "secondary" phone number were a voip number, the regular calls and
texts could be forwarded to the primary phone. Then the secondary
installation of Signal could be done on any phone (borrowed from a
friend who does not want to use Signal, for example) and then synced to
Signal Desktop on a computer you use regularly. From what I have read
about Signal Desktop, it seems as though it should then be possible to
uninstall Signal on the borrowed phone and keep using it on the desktop
but I haven't tested it yet so I'm not sure (can anyone confirm this?).
To provide further parallel Signal account usage, it should be easy on
most computers to have Chrome running alongside Chromium, and each could
have an installation of Signal Desktop running on a different number.
I didn't think of it before, but there is actually a better option for
parallel usage on a phone! Starting with lollipop, user accounts are a
default feature of Android, and each user account has completely
independent apps installed. Each user account could have its own Signal,
each one registered with a different number. The major downside to this
would be a lack of notifications on whichever account(s) are not
currently active. As far as I know there is no way to do cross user
account notifications in Android (and I can imagine good reasons why
this should not be possible). Though if the messages coming through on
the non-primary Signal account are not urgent, then it could be feasible
to periodically check the other accounts to see if any messages have
arrived. Combined with the voip forwarding and Signal Desktop options
above, this setup could be useful for a lot of situations. For example,
it becomes possible to have different Signal numbers affiliated with
pseudonyms for use in situations where you do not want to be connected
to a phone number that is already very integrated with other aspects of
your identity (as Nathan described).
Finally, another permutation that I'm not able to test, but I'm curious
to find out how it will work: does anyone know if Signal Desktop will
run on Chrome in Android? Or iOS for that matter? I'm pretty sure this
is not what OWS intends with Signal Desktop, so I wouldn't be surprised
it does not work well or at all, but for anyone who really needs two
Signal numbers running on the same phone, it could be worth testing.
adelante,
Boskote
Post by NoirHello everyone!
I want to add another point of view.
I'm fully aware that I could use any telephone number which I have
access to as an identifier for Signal. This protects me from scenarios
which Nathan from Guardian pointed out.
Post by NoirIn this world, most people are not aware that they have responsibility
not only about the data of their own but also the data of others that
have been entrusted to them. With other words: It's out of my control
what someone is doing on their smartphone. I'm also aware that it's not
possible to protect the content of conversations if one side is
compromised. I'm also screwed if a targeted attack happens. But this is
not my point.
Post by NoirThe problem is that a telephone number is still an identifier. It's an
unique number which I'm supposed to give to anyone I want to communicate
with.
Post by NoirIf we look at the current Signal market share it's very likely that
most of my contacts are using other services like Whatsapp to
communicate. We all know that Whatsapp uploads and processes all
contacts of the user. When we make the assumption that every contact in
my database also has my number in their database we come to the
conclusion that Whatsapp still knows a very big part of my contacts.
This scenario doesn't require some kind of targeted attack. It doesn't
require some sophisticated new experimental algorithm. Whatsapp belongs
to Facebook and Facebook is a social network. And creating a network of
persons to find patterns is one of the very core functionalities of
social networks. It's almost the same with all other widespread apps
like Google services and such.
Post by NoirSo what can I do about this at the moment? I can install Signal only
once and this installation is tied to a specific identifier. Alternating
between different identifiers would mean to swap the whole installation
including app data which is hacky, error prone and very inconvenient.
Another option is using more that one phone to separate the identifiers.
I'm actually using two phones for another reason but this is already
very inconvenient. Other options are like virtualization and such.
Post by NoirI hope you got my point.
So my suggestion is: Make it possible for every user to create (and
destroy) an unlimited number of aliases.
Post by NoirCheers
Noir
On 8 February 2016 at 20:18, Nathan of Guardian
Post by Nathan of GuardianPost by Zach QuealI simply don't understand how handing out my personal cell phone number
to
every Tom, Dick, and Samantha who needs to contact me is considered
"secure." I've searched preferences and there seems to be no way to add
an
alias to allow others to contact you via the alias instead of your
phone
Post by NoirPost by Nathan of GuardianPost by Zach Quealnumber -- or even your fingerprint. This seems entirely
counterproductive,
here. I'm really interested to know how anyone could possibly praise
Signal
for taking security seriously when I have to relinquish my right to
keep
Post by NoirPost by Nathan of GuardianPost by Zach Quealmy
phone number private to use your service?
Can anyone reasonably explain this to me? If my identity is already
verified via Twilio, why do I *need* to relinquish it to others to be
able
to communicate? This is what fingerprints are for. Again, it feels
entirely
counterproductive and laughably insecure. I'm opting to use
horrendously
Post by NoirPost by Nathan of GuardianPost by Zach Quealinsecure applications such as Telegram and their clusterfuck of MTProto
instead of Signal because of this serious privacy issue.
I generally agree, but do want to point out that you can use a virtual
phone number with Signal, such as a Google Voice number, SkypeIn, DDIWW
or any other kind that will work with the Twilio authentication. Heck
you might even be able to use a payphone booth number, if you can find
one, as I think you just need to be able to receive calls and not SMS.
Yes, the design choice to identify Signal accounts with phone numbers
has the disadvantage of making registration more inconvenient for the
anonymity-conscious users who do not want to be identified with the same
phone number that they are already using on their phone. However, this
design choice also makes registration and use more convenient for most
users, who have no problem having their Signal account identified with
the phone on which they are using Signal (it also allows contact
discovery through the semi-autonomous social graph of phone contact
lists!). As with many other design choices, OWS is prioritizing the ease
of use for the most common use cases at the expense of ease of use or
customization available to less common use cases such as those who want
a more anonymous ID. I think that it is completely fair that those of us
who are sometimes prioritizing our anonymity have to do a little extra
work to make things work the way we want them to.
Post by NoirAnd to continue with the same point being made by Nathan, getting a
more anonymous phone number is not that difficult - you can do a lot
with a vpn and a prepaid credit card. I highly recommend voip.ms, and
there is even a guide that someone has already written on exactly this
subject:https://yawnbox.com/index.php/2015/03/14/create-an-anonymous-textsecure-and-redphone-phone-number/
good luck. adelante,