215
Signal registration without a phone number now available in Android beta (but payment required!) (aboutsignal.com)
submitted 3 weeks ago by to c/privacy@lemmy.dbzer0.com
81 comments fedilink hide all child comments
 

Signal has started rolling out Signal Login, an optional registration method that allows users to create a Signal account without providing a phone number. The feature will be rolled out first on Android and will come to iOS later.

As we previously reported, Signal Login is not a free alternative registration method. Signal requires users who choose to register without a phone number to make a one-time payment. The price at launch is $2.99 / € 3.49, although this may vary by region and currency.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 weeks ago (6 children)

I think we're talking past each other. To refer to your previous comment:

Forward secrecy protects against intercepting now and decrypting later when you get access to the users private key: this is only possible on delta chat if you get access to the client database at which point you can read all undeleted messages anyway

Or if you run an evil relay that logs encrypted messages, and later you get the single necessary private key. Which is the problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 3 weeks ago (5 children)

    Yes and I’m saying that since the only way to get access to that private key on delta chat is to get access to an unlocked device at which point you have access to all the messages on that device anyway (on signal too)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 2 weeks ago (4 children)

    What do you think makes Delta Chat uniquely impervious to leaking your private key compared to the other E2EE messaging apps that do implement forward secrecy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 weeks ago (3 children)

    I’m saying those others that pretend to implement pfs, still leak all chats the user didn’t delete (and in some cases even then) when an attacker has access to the private key because that’s stored in the same database.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 2 weeks ago (2 children)

    Can we focus on the apps that do implement it instead? I'm getting more and more lost in the point you're trying to make here.

    E2EE messaging puts encrypted messages on a server without the private keys. The concern PFS addresses is to prevent a server from getting one private key and using it to decrypt all messages. This is a vulnerability of Delta Chat, and not one of Signal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 weeks ago (1 child)

    Okay and how would you get that private key?

    By having access to an unlocked device: which means you also have access to all messages. Therefor this attack vector is not as big a deal as you are making it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago* (last edited 2 weeks ago)

    You are, by extension, saying that PFS is not as big a deal as you are making it. Do you have anything to back this up that Signal et al aren't aware of? Would you like to argue Delta Chat should stop arguing in favor of it too?

    Seems super dangerous to assume security due to ignorance of harm, but okay, I guess, we can play "look for why".

    With DeltaChat, you can get a private key just by accessing a file on a desktop client. Or a backup file . Then you can pass that onto a compromised server and restore chat history that wasn't present on the client or backup file.

  • permalink
  • fedilink
  • source
  • parent