215
Signal registration without a phone number now available in Android beta (but payment required!) (aboutsignal.com)
submitted 2 weeks ago by to c/privacy@lemmy.dbzer0.com
81 comments fedilink hide all child comments
 

Signal has started rolling out Signal Login, an optional registration method that allows users to create a Signal account without providing a phone number. The feature will be rolled out first on Android and will come to iOS later.

As we previously reported, Signal Login is not a free alternative registration method. Signal requires users who choose to register without a phone number to make a one-time payment. The price at launch is $2.99 / € 3.49, although this may vary by region and currency.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 week ago (9 children)

Forward secrecy protects against intercepting now and decrypting later when you get access to the users private key: this is only possible on delta chat if you get access to the client database at which point you can read all undeleted messages anyway. (On Signal even deleted messages!)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 1 week ago (8 children)

    Or the server(s), no? It's trivially easy to archive, filter by account, and then decrypt if the one key has been found

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 1 week ago (7 children)

    Delta chat assumes the relays are evil and of course doesn’t send private keys there

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 week ago (6 children)

    I think we're talking past each other. To refer to your previous comment:

    Forward secrecy protects against intercepting now and decrypting later when you get access to the users private key: this is only possible on delta chat if you get access to the client database at which point you can read all undeleted messages anyway

    Or if you run an evil relay that logs encrypted messages, and later you get the single necessary private key. Which is the problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 week ago (5 children)

    Yes and I’m saying that since the only way to get access to that private key on delta chat is to get access to an unlocked device at which point you have access to all the messages on that device anyway (on signal too)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 week ago (4 children)

    What do you think makes Delta Chat uniquely impervious to leaking your private key compared to the other E2EE messaging apps that do implement forward secrecy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago (3 children)

    I’m saying those others that pretend to implement pfs, still leak all chats the user didn’t delete (and in some cases even then) when an attacker has access to the private key because that’s stored in the same database.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 1 week ago (2 children)

    Can we focus on the apps that do implement it instead? I'm getting more and more lost in the point you're trying to make here.

    E2EE messaging puts encrypted messages on a server without the private keys. The concern PFS addresses is to prevent a server from getting one private key and using it to decrypt all messages. This is a vulnerability of Delta Chat, and not one of Signal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    Okay and how would you get that private key?

    By having access to an unlocked device: which means you also have access to all messages. Therefor this attack vector is not as big a deal as you are making it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 week ago* (last edited 1 week ago)

    You are, by extension, saying that PFS is not as big a deal as you are making it. Do you have anything to back this up that Signal et al aren't aware of? Would you like to argue Delta Chat should stop arguing in favor of it too?

    Seems super dangerous to assume security due to ignorance of harm, but okay, I guess, we can play "look for why".

    With DeltaChat, you can get a private key just by accessing a file on a desktop client. Or a backup file . Then you can pass that onto a compromised server and restore chat history that wasn't present on the client or backup file.

  • permalink
  • fedilink
  • source
  • parent