We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists.
-
You should add the ability to sign up with email. I'm not sure that Russian users can log in with a code from SMS.
@izby @signalapp Email registration would turn Signal into a spam and bot cesspool like Twitter, Facebook, Instagram etc.
-
@kkarhan@infosec.space since i've started hosting services for people, i came to the conclusion that the only thing you will need is an email, and only when there is no other option to reach out to the user.
let's make it clear to everyone: phone numbers should only be shared to people you trust and nobody else
@gettie @kkarhan Or hide your phone number, and create and share a username. Signal's had usernames for a couple years: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames
-
@leoschuldiner23 @gettie @kkarhan It depends. I have 5 phone numbers all used for different purposes.
-
@signalapp Why not change the message to "To setup Signal on your new phone, please enter code ..." to make it absolutely clear what the code is for and create additional friction for scammers as they'll have to come up with an excuse as to why it says new phone.
@rbairwell @signalapp It's not always a new phone. Just a few months ago I purged Signal from my phone before going through CBP on my way back from an international trip, then put it back on the same phone.
-
-
@signalapp nobody should use Signal
@Lizette603_23 @signalapp Will you offer any proof for a reason why or just leave it ambiguous to sew distrust in the most secure and private app available?
-
@scathach @signalapp You can just turn off discovery by phone number and never get a spam message again: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames#pnp
-
@signalapp You know how you could solve that? Stop taking users' phone numbers, and especially stop using it for verification. EZPZ.
@DekOfTheYautja @signalapp Or just turn off phone number discoverability and never get a spam message again: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames#pnp
-
@signalapp
Thank you for explanations.1. When will mere users be able to detach Signal session from the mobile device?
This single functionality (doable for versed hackers but not for the general public) would stop such scams for high value targets like journalists, who would simply use a single-purpose wifi only desktop/tablet.
@ohir @signalapp No need to detach from a phone number. Just turn off discoverability by phone number: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames#pnp
-
@signalapp phone number required! fine.
but can't you add an option at the bottom of the screen to skip that and use a randomized ID like @session does
Also, to migrate to a new phone one needs to enable every sensor on their phone (including GPS), can't we just generate and scan a QR code and use our secret PIN as a 2FA?!!
@levi @signalapp @session You can disable discoverability by phone number and create a username since 2 years ago: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames#pnp
-
@starraven @signalapp They can't get contacts without also phishing your Signal PIN. And they can't get message history without also phishing your cloud backup key.
-
@rbairwell @signalapp It's not always a new phone. Just a few months ago I purged Signal from my phone before going through CBP on my way back from an international trip, then put it back on the same phone.
@Avitus @signalapp True, but at least you would be expecting it and the prompt would make some sense: if it was someone malicious saying "We r Signal, plz confirm the security codez" and the message said "To install on a new phone" I hope most people would question the message.
-
@kkarhan
This has always struck me as the strangest complaint about Signal.You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
@lackthereof @kkarhan My kids have mobile devices with data only eSim cards. No phone number. I can't use Signal on their device to talk to them. Not everyone with a phone has a phone number.
-
@izby @signalapp Email registration would turn Signal into a spam and bot cesspool like Twitter, Facebook, Instagram etc.
OK. What about WhatsApp or Telegram?
-
@ohir @signalapp No need to detach from a phone number. Just turn off discoverability by phone number: https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Privacy-and-Usernames#pnp
@Avitus @signalapp
> No need to detach from a phone numberI am talking about detaching mobile device used to setup from the desktop you want to use to talk with your informants. This very setup Signal devs fight claws and teeth – you can use desktop as long as you periodically make your chat content reach your ah-so-trusted Android or iOS phone, decrypted and written in plaintext on it, and only then you can continue to use your desktop till the next dump of plaintext to the phone.
I.e. while all is perfectly encrypted on the way, all Signal communication is as much confidential as Android and iOS are themselves. Ie. close to none.
At least for Jane Journalist is none.
You John Hacker can hack around and have long-living desktop instance. But for the communication channel to be confidential it must be that on the BOTH sides.
Hope this helps.
-
OK. What about WhatsApp or Telegram?
@izby @signalapp I don't really care what happens to them since I rarely use them. It would be better for everyone if the 3B people on WhatsApp and billion on Telegram also used Signal, but that's not currently the case.
WhatsApp has been Zucked since 2016. Constantly screaming about how private and secure it is while not being open-source means it's probably not secure or private, and even more so when it's a Facebook product.
Everything you do on Telegram is stored in plaintext by default on Telegram's servers, it has a long history of sketchy security, was created by a Russian billionaire, and has been banned, unbanned, and could be banned again in Russia. There was a report in October last year that Telegram is very likely an FSB Honeypot: https://rys.io/en/179.html#:~:text=The%20assumption%20seems%20to%20have%20always%20been,this%20is%20much%20less%20of%20a%20consideration.
I have WhatsApp and Telegram, but I don't do much on either but lurk in sports channels.
This is why I stick to Signal for all my communication. They don't have data to hand over because they don't collect it: https://signal.org/bigbrother/
