It’s important to maintain control of this phone number. For example, you could use a disposable SMS service to register with Signal — there are many such services if you search for them — but those phone numbers can be used by anyone. Similarly, you should avoid using a public payphone’s number, or a SIM card on which you do not intend to renew service. If someone else can receive SMS messages or phone calls to this phone number, they can take your Signal account away from you.
That risk is not just theoretical. I made a test account (on another service; not Signal) using a free anonymous SMS number. A few months later, the account had been hijacked.
Of course, if it's a disposable account, then having it hijacked after you're done with it might be a good thing.
and then you can anonymously chat with yourself because no one else will bother installing that favorite app of yours!
I've been trying to get people off WhatsApp for who knows how many years now. With Signal, i have a chance of convincing people. When you start talking about matrix or session or SimpleX or ???, people stay on WhatsApp
Different strokes for different folks! I've been fortunate enough that many of my family and friends have been happy enough to follow me.
But I don't disagree with you, Signal has a much more recognisable brand and better user experience. These are things that we need to improve if we're going to get anywhere near the level of adoption Signal has.
It's there for a reason. You can't easily create a spam waves if you need a phone number to create an account. And they added usernames now, so you don't need to share your phone number with people you want to talk to. It's just there to create an account and can be hidden after that.
There is Session, that uses UUIDs for names with no phone number requirement, which is basically a fork of Signal with decentralized Loki on top of it.
I think anonymity is heavily coupled with privacy, if someone knows my account is linked to my phone number, that's a very strong form of fingerprinting. Even if E2E encryption is perfect, it takes one bad actor on the the reciever end of my message to both identify who I am through my phone number and leak my message. If just my message is leaked and there's no fingerprint leading to me, I am still safe. Real example: It took Proton leaking the IP address of a climate activist to the state to get them arrested, not a hole in their E2E mail encryption. A phone number is potentially an even stronger identifier.
If I asked 10 people to give me their home address, they're not going to care whether someone defines that as privacy or anonymity. But signal's reliance on phone number's (which are easily linked to your identity and home address in most countries) as the primary identifier means giving away just that.
Why do people feel the need to split hairs with these terms?
Why do people feel the need to split hairs with these terms?
He's not splitting hairs. It's just a different value proposition. I don't like the phone number requirement either but it makes sense to your average normie who realizes SMS is exposed plaintext. Something like an anonymous seed phrase as the key to your account would confuse most people. Email would be an improvement but it's at best pseudonymous.
The twist they've introduced in this article is they're using the registration lock feature, which means you have a signal pin enabled, so as long as the account doesn't go idle for 7 days even somebody who gets the phone number can't use signal.
It's fine for a temporary signal account, but if you let the number expire, then someone else gets assigned that number, and that new person wants to use Signal, they'll get your account.
They can't see your old messages, but they'll get any new ones instead of you.
Wouldn't just using a temporary phone number service work? From what I remember, you just need to recieve a text message and put it into Signal during registration. From skimming through the post, there's no mention of this option.