all 75 comments

sorted by: hot top controversial new old
[–] 47 points 3 months ago

GitHub commit d7447b1 states that “accounts without phone numbers can never get phone numbers, and accounts with them can never lose them”.

So you’ll have to register a new account if you want to decouple your number.

  • source
  • [–] 35 points 3 months ago (21 children)

    didn’t they announce this like five years ago

  • source
  • hideshow 21 child comments
  • [–] 8 points 3 months ago

    I mean, they also were developing usernames five years ago AFAIK. Adding usernames for everyone was the hard, but necessary step they finally managed to do. Only now is it possible to make accounts that are discoverable AND aren't tethered to phone numbers. I'm assuming with passkeys/TOTP(?)

  • source
  • parent
  • [–] 8 points 3 months ago (19 children)

    At this point, if it’s on a phone app, it probably doesn’t matter. They have your number.

  • source
  • parent
  • hideshow 19 child comments
  • [–] 15 points 3 months ago (17 children)

    It's not entirely dystopian (just barely), we have newer messengers like SimpleX and DeltaChat (I/we use Delta) on the up and coming which deliver on all the same e2ee promises as Signal. It's just network effects as usual, getting people to try is the real hurdle.

    What they share in common (mostly) is the architecture - they're built natively decentralized, utilizing caching relays with no single source of truth, or device of truth, to be used to create a profile of you like a phone number does. Encryption keys owned by the user and no single servers. Generally this is the Nostr design as well, so we have 3 different teams all focusing on the same natively decentralized architecture patterns.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 8 points 3 months ago (12 children)

    Is any of these apps good for phone calls or video calls, or just text messages?

  • source
  • parent
  • hideshow 12 child comments
  • [–] 6 points 3 months ago* (last edited 3 months ago) (3 children)

    At this rate Canada would probably ban anything they can't get records from eventually if it got popular enough. I hate this timeline.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 3 months ago (2 children)

    And Canada is supposed to be “the good guys”.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 3 months ago (3 children)

    I started self-hosting xmpp recently, and the calls work perfectly! You don't need to self-host either, there are plenty of public servers.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 3 months ago (2 children)

    I tried XMPP but could not find a client that let me have a "video call" where I could share my screen without also needing a webcam. Or even have a video call where not everyone is forced to have a video flux. As far as I can tell an audio call cannot be turned into a video call for 1 streamer.

    Like in Discord where one want to share its screen while playing. XNPP was my biggest hope to replace Discord with my friend but I either did not find the correct client or the ecosystem is not mature enough (or oriented in the direction I expected).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 months ago (1 child)

    Yeah, screensharing is not a thing in most clients, but I think it's a matter of time (years?) before it's properly implemented. In the meantime, you can use jitsi meet? Not sure if it covers your use case. I'll just copy this reddit comment, which has some good info:

    Yes, it’s possible, but with some limitations. For video calls between a Linux and a Windows client using ejabberd, you need an XMPP client that supports WebRTC. Some options: • Dino (Linux) – Supports video calls but no screen sharing. • Gajim (Linux/Windows) – Can do video calls with plugins, but no screen sharing. • Jitsi (XMPP mode) – Supports WebRTC and screen sharing but requires a separate Jitsi server. Since most XMPP clients don’t natively support screen sharing, you have two main options: 1. Use Jitsi Meet, which integrates with XMPP and allows both video calls and screen sharing. 2. Use OBS VirtualCam (on Windows) to share the screen as a “camera” in a video call. If you want a fully functional setup with both video calls and screen sharing, setting up Jitsi Meet with ejabberd is the best approach.

  • source
  • parent
  • hideshow 1 child comment
  • [+] 4 points 3 months ago (4 children)
  • [–] 3 points 3 months ago (3 children)
  • [+] 3 points 3 months ago (2 children)
  • [–] 2 points 3 months ago (1 child)

    I think it is. I don't remember seeing it before.

  • source
  • parent
  • hideshow 1 child comment
  • [+] 1 point 3 months ago (1 child)
  • [–] 3 points 3 months ago

    It's been in DC for a few versions now, we've used a combination of: macOS desktop, Android mobile, Linux desktop, iOS Mobile - and haven't had problems more than usual getting apps access to the cam/mic on macOS.

    They just dropped DC 2.57.0, it hit F-Droid and Arch repos in my morning updates. An update to the relay code was also dropped, 1.12.0, for relay operators.

  • source
  • parent
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • [–] 2 points 3 months ago (1 child)
  • [–] 2 points 3 months ago

    Briar fits into it's own niche (operational design), making it a choice for certain activities but not what I would call your general normie chat app. It makes tradeoffs (using the local network, no caching relays, etc.) to increase security posture at the expense of general use. IIRC, Jack Dorsey's BitChat was modeled after the same designs? (which is interesting, because Nostr his other pet doesn't)

  • source
  • parent
  • [–] 1 point 3 months ago (1 child)

    Simplex is a dog though compared to Signal.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 3 months ago

    I haven't tried SimpleX yet, as they can't share the same profile to multiple devices (it's explained in detail in the FAQ) which makes it a normie usability deal killer. I've heard it has really bad battery life on mobile too, but that's just reading random comments. Right now we're using Delta (and running a relay) and it's just fine.

  • source
  • parent
  • [–] 8 points 3 months ago (6 children)

    I don't understand why an email registration is not an option? it was the default from when online services and apps appeared in the first place, and until about 5 years ago (depending on types of services/apps), and it's security and anonymity was purely based on you using your "main" address or a throwaway.

  • source
  • hideshow 6 child comments
  • [–] 15 points 3 months ago (1 child)

    The article says their main reason is spam/abuse, as requiring a phone number adds some sort of gate to lessen that. Emails are easier to create en-masse. I don’t agree with using phone numbers either, I’m just relaying their reasons.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 3 months ago

    I would guess the sudden influx of massive amounts of traffic would force them to charge for the service, and they don't want to do that. Requiring a phone number, while invasive to some, does cut down on a tremendous amount of automated/bot/spam traffic.

  • source
  • parent
  • [–] -4 points 3 months ago (2 children)

    Because Signal wants a link to your identity.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 7 points 3 months ago (1 child)

    The post is literally about Signal developing a way to log in without that link

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 3 months ago

    And I'm telling you, it won't happen. They will probably require some other UUID.

    Signal had made it clear that they need to identify their user's identities.

    Mark my words: if you try to create an account on TAILS, and your fingerprint isn't unique, you'll get an error when you try to create the account.

  • source
  • parent
  • [–] 14 points 3 months ago (8 children)

    Bullllllllshit.

    They've said that for years. It's easy to do. But they won't do it

  • source
  • hideshow 8 child comments
  • [–] 12 points 3 months ago (5 children)

    How's it easy?

    Not the technical part (which definitely looks as easy as just dropping a requirement), but the spam/abuse prevention part.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -4 points 3 months ago* (4 children)

    It's pretty easy to detect spam. I guess user reports and noticing when someone suddenly messages many new users and those users do not respond.

    Anyway, it's not an issue on Wire or SimpleX or the dozens of other platforms that don't require phone numbers. It's obviously a solved problem. Signal is just making up fake excuses.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 3 months ago (1 child)

    It’s pretty easy to detect spam. I guess user reports and noticing when someone suddenly messages many new users and those users do not respond.

    It's not so easy, because you could even register a new account for each new spam message, or register 100k accounts & only send out 3 messages a day / account..

  • source
  • parent
  • hideshow 1 child comment
  • [–] 9 points 3 months ago* (4 children)

    just go the matrix route; username, password, 2fa, then any other connection requires you to verify with a current logged in session (or recovery code).

  • source
  • hideshow 4 child comments
  • [–] 15 points 3 months ago* (2 children)

    As someone who uses matrix and runs a matrix server, matrix fucking suuuucks jfc why are so many privacy tools soooooo bad at what they do on so many levels like wtf the proto the servers the clients the ux the metadata issues like so much wrong

    Edit: and if anyone tells me to use XMPP I'll slap them

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 months ago (1 child)

    What are your main issues with Matrix?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 3 months ago*

    Unencrypted by default (among other bad defaults), leaks metadata like it was built to do so, makes it surprisingly difficult to tell what's encrypted and what's not, filled to the brim with bugs and exploits, bad feature interop between most clients (most of which have known vulnerabilities or abandoned dependencies), defacto-standard "just use synapse/element if you want things to work properly" (and still doesn't), bad user communication about well everything but mainly teaching new users what all the things mean (session, verification, 1:1 vs jitsi, when you're using what,...), ton of federation issues and bugs, ...

    And despite all that it somehow has a massive csam seeding problem, which really just makes me think the whole thing is a telegram-like fed psyop but one level higher on the tech competency ladder.

    ... Multi-device session chaining is a neat feature and surprisingly user-friendly (tho no one maintains their session list or verification; half pebkac admittedly), so that's something nice I can say about it... But almost nothing else.

    Seriously, Signal is basically a joint three-letter-agency sigint project and I still think it's safer and easier to use than matrix for the vast vast vast majority of people

  • source
  • parent
  • [–] 3 points 3 months ago (6 children)
  • [–] 2 points 3 months ago (4 children)

    I think only SimpleX has asynchronous messaging

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 3 months ago (3 children)

    When you send a message, and it gets delivered when the recipient is online?
    Delta has that, but you have to be online for the message to be sent later, since there's no central server to cache it.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 3 months ago (2 children)

    Yes, that means it's synchronous.

    My point is that we need servers for asynchronous messaging (or some clever network where everyone is a server relaying messages for others). Lacking asynchronous messaging is not going to be a practical solution for 99% of people.

    Encryption works. We don't need to trust servers. They're not inherently an issue for security nor anonymity.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 3 months ago (1 child)

    Thank you for the clarification. I just wasn't sure on the terminology, but this makes perfect sense.

    We don’t need to trust servers. They’re not inherently an issue for security nor anonymity.

    For me, my issue with a central server infrastructure is less that it can be snooped on (because, to your point, properly implemented encryption does work) and more that it's easy to be taken down or censored, since it is a central server infrastructure.
    The benefit with the every-client-is-a-server infrastructure, such as the one that Delta uses, is that if one of the many servers gets taken down, the network, as a whole, keeps working.
    Something similar can be said about the Lemmy infrastructure, really any of the Fediverse. If one of the servers gets taken down, there are still hundreds, thousands, or millions more that are serving content, even if not the exact same content, allowing the social network, as a whole, to not be subject to mass censorship.

    For the everyday, central infrastructure, such as the one that Signal uses, works perfectly fine. For those "special locations", a decentralized every-client-is-a-server infrastructure might be a requirement. So it really is situational.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 3 months ago*

    That's a good point.

    I guess the best is a hybrid where the server is just optional for asynchronous messaging, and if the server is temporarily down, the service just becomes temporarily degraded into synchronous mode.

  • source
  • parent
  • [–] 4 points 3 months ago* (15 children)

    Boy... We are going to get spammed.

    I never understood the "phone numbers are evil" people, whining about signal requiring them. As soon as this arrives, they will find another thing to whine about.

    Hopefully Signal will make it possible to block any and all communications from people wohtout a phone number, unless I reach out to them. And that that feature also be introduced to groups. Because otherwise maintaining public groups is going to be turboshit.

  • source
  • hideshow 15 child comments
  • [–] 17 points 3 months ago (9 children)

    mobile numbers require government identification in many countries. But yeah, not seeing an easy solution to the spam problem

  • source
  • parent
  • hideshow 9 child comments
  • [–] 2 points 3 months ago* (last edited 3 months ago) (8 children)

    mobile numbers require government identification in many countries

    Yes and all they will know is "person A has installed signal". Nothing more. If you haven't degoogled tour phone or use one with a fruity logo, the government knows that you have the app already. It won't need phone number.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 10 points 3 months ago (5 children)

    huh? you can't see the difference between a grapheneos burner linked to a gov ID backed phone number and one that isn't?

    like what happens when you go to a protest and they pull out a Stingray and get your IMEI+ICCID down that's directly linked to you? you're telling me you don't see any issues with cops/ICE being able to know exactly who goes where?

    this has strong "I don't need freedom of speech because I have nothing to say" vibes - it's fine if you don't see the value but I can assure there very much is

  • source
  • parent
  • hideshow 5 child comments
  • [–] -4 points 3 months ago (4 children)

    You're fighting a scarecrow in your head that you built. "This has a vibe so I'll vibe comment"

    Once you come back down to earth and want to talk seriously, ping me. I don't debate paranoid snow bunnies.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 7 points 3 months ago (3 children)

    ah yes the paranoia of documented evidence...

    i wish I could live in your fantasy land where fascists weren't in power and being an antifascist wasn't a terrorism offence

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 3 months ago (2 children)

    Buddy, how are you going to communicate with people via Signal even without a username? Are protests full of free WiFi?

    If you think getting rid of phone numbers on an internet connected application will help you at a local protest where you should be using a local network for communication (Bluetooth for example), you are just lost.

    Having your phone number will only reveal that you're using signal, not who you're talking with nor the groups you belong to.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 months ago (1 child)

    look you obviously don't do grassroots political organising if you're asking such silly questions - this whole thread was about you thinking numberless signal accounts aren't useful - and being more worried about your made up spam boogieman - than the actual threat of fascistic state violence

    prepaid sims exist, yes briar exists but it's not viable when people need to communicate over whole city distances (eg for spotting), if the cops can connect your burner to your actual ID at an anti-ICE protest - they can very easily raid your house after the fact - and no they don't even need a warrant due to the extraordinarily powers given to "anti-terror" police forces.

    please touch grass and stop being an armchair security expert and let the adults think about applied security in the real world

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 3 months ago (4 children)

    simplex doesn't require phone numbers or emails to sign up.

    instead you need to scan codes for a trust. it's actually everything I wanted in a messenger. well...I wish they had gifs like telegram.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 3 months ago (3 children)

    And how's the spam on simplex?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 3 months ago (2 children)

    nonexistent.

    unless someone literally invites you to the chat you're not getting in.

    unless you literally allow someone to scan your code, you will not be able to send them messages.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 3 months ago

    Trump hates this plan

  • source
  • [–] -2 points 3 months ago (2 children)

    this is bullshit designed to respond to increasing use of simplexchat and other platforms

    and they still want to tie it to payment (so a credit card) so they can track people

    and they are implementing it only after many years

    a complex captcha that takes 10 minutes to solve would work just as well as payment, but they aren't doing it, and it certainly leaves me wondering if they are a honeypot. i can't prove it, but it's really suspicious it's taken so long to possibly roll out something that may require a credit card

  • source
  • hideshow 2 child comments
  • [–] 2 points 3 months ago* (last edited 3 months ago) (1 child)

    I have watched the futo video and i think don't think its very likely it will become a paid feature. The CTO said they would want to have the registration require some kind of cost but it was almost certainly meant as a computing cost not money. Link to the same video in case you can't play it https://i.imgur.com/QMDjn7T.mp4

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 3 months ago

    and still no app for Android tablets ffs

  • source
  • 63 comments in c/technology@lemmy.world view that post