215
Signal registration without a phone number now available in Android beta (but payment required!) (aboutsignal.com)
submitted 2 weeks ago by to c/privacy@lemmy.dbzer0.com
81 comments fedilink hide all child comments
 

Signal has started rolling out Signal Login, an optional registration method that allows users to create a Signal account without providing a phone number. The feature will be rolled out first on Android and will come to iOS later.

As we previously reported, Signal Login is not a free alternative registration method. Signal requires users who choose to register without a phone number to make a one-time payment. The price at launch is $2.99 / € 3.49, although this may vary by region and currency.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 week ago (3 children)

I’m saying those others that pretend to implement pfs, still leak all chats the user didn’t delete (and in some cases even then) when an attacker has access to the private key because that’s stored in the same database.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 1 week ago (2 children)

    Can we focus on the apps that do implement it instead? I'm getting more and more lost in the point you're trying to make here.

    E2EE messaging puts encrypted messages on a server without the private keys. The concern PFS addresses is to prevent a server from getting one private key and using it to decrypt all messages. This is a vulnerability of Delta Chat, and not one of Signal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    Okay and how would you get that private key?

    By having access to an unlocked device: which means you also have access to all messages. Therefor this attack vector is not as big a deal as you are making it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 1 week ago* (last edited 1 week ago)

    You are, by extension, saying that PFS is not as big a deal as you are making it. Do you have anything to back this up that Signal et al aren't aware of? Would you like to argue Delta Chat should stop arguing in favor of it too?

    Seems super dangerous to assume security due to ignorance of harm, but okay, I guess, we can play "look for why".

    With DeltaChat, you can get a private key just by accessing a file on a desktop client. Or a backup file . Then you can pass that onto a compromised server and restore chat history that wasn't present on the client or backup file.

  • permalink
  • fedilink
  • source
  • parent