Gonna be gonest 99% of people’s issues with signal using phone numbers is just FUD

Like compare that to matrix where you have massive timing vulns, or xmpp with crypto years behind in updates, its pretty fuckin clear which one does a better job being a privare messenger

Causr thats the thing, from the start signal’s primary concern was privacy that means nobody can read your messages but you and the intended recipient. And it does a damn good job of that.

The phone number thing is not a matter of privacy, its a matter of anominity, and a pretty minor one at that. All a MITM or whatever could prove is that you’re using signal, nothing about who you’re talking to

@dangerdyke In EU registering a phone number requires a real life identity due to antiterrorism laws, and Signal doesn't try to hide metadata from the server the way Cwtch does, so govt employees with access to their servers could get the information who talks to who.
Signal claims not to store that information, okay nice, but the whole point of E2EE was that you don't have to trust your server.

>Like compare that to matrix where you have massive timing vulns, or xmpp with crypto years behind in updates

That other protocols are worse isn't an argument that not being able to easily have more than one identity and tying the one you have to legal documents is good, actually. Private messaging in 2024 sucks, great, we have that thread every month at the very least.

@affine ok but realistically what can an EU government do with the fact you’re a signal user?

@dangerdyke @affine interestingly, no one can ever answer this

@destroy @dangerdyke It's ass-backwards; the question is "Why does Signal want information that can be used to recover the rest of my identity?" If they didn't have it, it wouldn't be necessary to take it on faith that they don't store your contacts and recipient history.

I don't buy the spam prevention algorithm, as someone who gets spam SMS at least every week and used to get multiple spam phone calls from different numbers every day after some asshole recruiter sold my number.
Clearly getting enough burners isn't a problem for the viagra merchants out there.

The only thing it achieves is that people who can't afford 2 sim cards can't separate their identities, even when using the username feature.

Realistically, I'd bet that 99% of e2ee users don't even need the encryption in the first place, as they're using it for small talk and cat pics only. Keep up the "hurr derp privacy nuts using encryption without a threat model" rhetoric, and if you'll have your way and nobody will use e2ee without a very good reason to, _then_ merely installing Signal will be an admission of breaking laws.

@affine @dangerdyke Installing Signal *isn’t* an admission of breaking laws, though. Have there ever been any convictions that relied on someone simply *using* Signal as the evidence that they are committing crimes?

@destroy @dangerdyke I don't think so, same as nobody has launched a _practical_ exploit of the timing side channel vuln in libolm, or any of the issues with properly executed OMEMO (using the latest version, everyone dilligently checks everyone else's keys). By the standards of "has anyone ever gotten in shit because of it" there's nothing wrong with Matrix or XMPP either, it's all theoretical.

@affine @destroy that is absolutely the opposite posture you want to be taking when it comes to encryption. NEVER assume your adversaries arent taking advantage of a vuln. Thats a great way to get your messages read back to you in a courtroom