this post was submitted on 11 May 2025
189 points (85.9% liked)

Privacy

38050 readers
801 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
189
Why does Signal want a phone number to register if it's supposedly privacy first? (programming.dev)
submitted 2 weeks ago by [email protected] to c/[email protected]
273 comments fedilink hide all child comments
 

I remember a time when visiting a website that opens a javacript dialog box asking for your name so the message "hi " could be displayed was baulked at.

Why does signal want a phone number to register? Is there a better alternative?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 18 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

The amount of trolls in this thread that either try to spew false information intentionally or just have no idea what they are talking about is insane.

If you are worried about what data (including your phone number) law enforcement can recieve (if they have your specific user ID, which is not equal to your phone number) from the Signal company check this: https://propertyofthepeople.org/document-detail/?doc-id=21114562 Tldr: It's the date of registration and last time user was seen online. No other information, Signal just doesn't have any other and this is by design.

If you want to know more about how they accomplish that feat you can check out the sealed sender feature: https://nerdschalk.com/what-is-sealed-sender-in-signal-and-should-you-enable-it/

or the private contact discovery system: https://signal.org/blog/private-contact-discovery/

Also as Signal only requires a valid phone number for registration you might try some of these methods (not sure if they still work): https://theintercept.com/2024/07/16/signal-app-privacy-phone-number/

[–] [email protected] 3 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

This shows they do not need our phone numbers but they still demand it.

Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.

[–] [email protected] 1 points 2 weeks ago

No it doesn't. What is a need? It is for troll and spam and bot protection. How does the links show that there is no need for it?

[–] [email protected] 2 points 2 weeks ago* (last edited 2 weeks ago) (2 children)

False.

edit: it's funny how people downvoting comments about signal's sealed sender being a farce never even attempt to explain what its threat model is supposed to be. (meaning: what attacks, with which adversary capabilities specifically, is it designed to prevent?)

[–] [email protected] -1 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

it's being answered in the github thread you linked. Sorry that this is not enough for you but it's enough for most people: "For people who are concerned about this sort of thing, you can enable sealed sender indicators in the settings"

[–] [email protected] 7 points 2 weeks ago* (last edited 2 weeks ago)

it’s being answered in the github thread you linked

The answers there are only about the fact that it can be turned off and that by default clients will silently fall back to "unsealed sender".

That does not say anything about the question of what attacks it is actually meant to prevent (assuming a user does "enable sealed sender indicators").

This can be separated into two different questions:

  1. For an adversary who does not control the server, does sealed sender prevent any attacks? (which?)
  2. For an adversary who does control the server, how does sealed sender prevent that adversary from identifying the sender (via the fact that they must identify themselves to receive messages, and do so from the same IP address)?

The strongest possibly-true statement i can imagine about sealed sender's utility is something like this:

For users who enable sealed sender indicators AND who are connecting to the internet from the same IP address as some other Signal users, from the perspective of an an adversary who controls the server, sealed sender increases the size of the set of possible senders for a given message from one to the number of other Signal users who were online from behind the same NAT gateway at the time the message was sent.

This is a vastly weaker claim than saying that "by design" Signal has no possibility of collecting any information at all besides the famous "date of registration and last time user was seen online" which Signal proponents often tout.