Privacy
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
Not-a-paywall paywall.
still waiting for this to roll out on ios...
edit: nevermind, it updated
I have this for some time now on iOS
you have the beta?
the beta is closed now...
I dont. I got it via normal update. The 7.1 has been installed recently on my iPhone
hmm... well shit, i swear i tried to update it before...
but i did just update it to 7 just now... thanks
just two pieces of data: the date the target Signal account was created, and the date that it last connected to the service.
And how does Usernames help here? Should be the same 2 data Points and not more?
The idea is that you change or remove your username after someone else starts a conversation with you, so the username can no longer be used to subpoena your account details.
Put another way, signal is able to provide those 2 pieces of information to law enforcement based on a phone number. This helps you to prevent law enforcement having a phone number to ask signal to look up in the first place, assuming you change your username every time you hand it out.
They also hash the usernames that they store on your account which means law enforcement can't ask what usernames are being used, only being able to ask for specific usernames which are currently in use.
I understand that right now LEA can serve up a subpoena and give Signal a username and get a phone number, but they can't give them a phone number and get a username.
Is it also possible for Signal to keep track of past usernames/associated hashes for a particular phone number?
(For comparison, Signal could record IP addresses, but we trust they don't due to unsealed cases. Could they keep a username history?)
Yes it entirely depends on whether they store previously used usernames along with the date range it was in use (to tell apart multiple people who used the same username at different times)
We'll have to see if any unsealed cases in the future support that they don't keep those records like how they don't keep IP logs, but personally their track record is enough for me to have confidence in the feature, especially since my "threat model" is primarily opportunistic hackers or spearphishers at most, not police or state / nation state level actors.
They don't track username history and don't have a server side list of plaintext usernames, and others can't find your phone number from the username alone. That makes it harder to confirm which account is yours.
My phone number is registered to my phone carrier under my real name. My username is not. Unless I've misunderstood the question.
It would be better if it was randomly generated, I'm looking at you CoralApples216
I can be your Guest1234
anytime you want ;)
It generated a suffix of two digits when I tried (you can set it explicitely but it is mandatory).
I kept having to randomly scramble it until it gave me a number I liked.
Doesn't really matter with them being non unique. Multiple people can have the same username, there's a randomly generated number that goes with it
Let's make a compact to all use "guillotinetherich"
A pact maybe?
maybe Wogi wants to check his makeup in the mirror while he's out at guillotine-the-rich rallies.
Why would it be better?
guessing it would mean that people wont be using the same username as they do on every other account. So if doodlebop69 can't be traced from signal they could go to google and find the same doodlebop69 to grab their information from
But doodlebug69 needs to accept a message from you before you can see their profile info.
They have the username already, they don't need to see their profile info to search for a username
This is the best summary I could come up with:
Based on a phone number, the federal prosecutors were asking for the user’s name, address, correspondence, contacts, groups, and call records to assist with an FBI investigation.
Whenever Signal receives a properly served subpoena, they work closely with the American Civil Liberties Union to challenge and respond to it, handing over as little user data as possible.
Whittaker stressed that this is “a pretty narrow pipeline that is guarded viciously by ACLU lawyers,” just to obtain a phone number based on a username.
Signal’s leadership is aware that its critics’ most persistent complaint is the phone number requirement, and they’ll readily admit that optional usernames are only a partial fix.
She gave an example of a person who faces severe threats and normally maintains vigilance but whose mother is only on WhatsApp because she can’t figure out the numberless Signal.
Signal engineers have discussed possible alternatives to phone numbers that would maintain that friction, including paid options, but nothing is currently on their road map.
The original article contains 1,894 words, the summary contains 165 words. Saved 91%. I'm a bot and I'm open source!