←back to thread

544 points josh2600 | 9 comments | | HN request time: 1.786s | source | bottom
Show context
lrvick ◴[] No.26715358[source]
Signal is still centrally controlled and compiled by a single entity and distributed only in an unsigned insecure form or in a signed/verified manner only if you give up your privacy to install with Google Play or the Apple store.

Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Moxie has stated he will not support anyone but his team compiling or distributing Signal binaries so third party signed builds via privacy focused app stores like F-Droid are out. All builds must also use Signal centralized servers even though that centralizes TCP/IP metadata, etc.

Not to mention you need to show government ID to get a SIM to use the Signal wallet for said private currency/messenger in 200 countries.

Secondly having a decentralized currency whose servers can only run on Intel machines with Intel SGX is a very centralized supply chain as well.

A single supply chain attack on Intel microcode or related SGX updates could run malicious code and game over for the currency globally? A government that sees MobileCoin as a threat could make Intel do this.

With a SPOF on the supply chain of the only client people are expected to use and another SPOF on the only hardware enclave people are supposed to use for servers... decentralized is technically true but not used in the same way as most other projects that use that word.

I will keep an eye on this experiment though, because there are some unique ideas here which could have value should your trust anchors expand beyond Intel and Signal.

replies(5): >>26717225 #>>26717227 #>>26717623 #>>26718384 #>>26719148 #
1. ac29 ◴[] No.26717623[source]
> Not to mention you need to show government ID to get a SIM to use the Signal wallet for said private currency/messenger in 200 countries.

There are less than 200 countries in total, unless you get very creative with states that are arent recognized more more than a handful of other countries, like Abkhazia or Transnistria.

You also dont need ID to buy SIM cards in the US, so I'm curious on how valid this assertion is.

replies(5): >>26718251 #>>26718576 #>>26720071 #>>26723424 #>>26735340 #
2. Mediterraneo10 ◴[] No.26718251[source]
The OP is broadly right. You now need to show ID to buy a SIM in many EU countries and beyond (e.g. Chile, Russia or Senegal). A copy of the ID is given to the state in order to link your identity to the SIM card. Even if you bought a prepaid SIM before this policy or law came in, when you top up the mobile provider may pressure you into paying online or by card instead of cash, so that your identity can be linked to the SIM through your payment.

I do wonder how long the US (or, for example, Finland) will remain a holdout in this regard.

3. Klonoar ◴[] No.26718576[source]
None of this particularly matters given that Signal is actively working on not requiring phone numbers.
replies(1): >>26718647 #
4. Mediterraneo10 ◴[] No.26718647[source]
Signal is actively working on other identifiers than a phone number, but can you cite proof that no phone will be required at all? I got the impression that Signal will still require a phone number at signup to do SMS verification, and only then give you a way to provide non-phone-number identifiers to contacts.
replies(1): >>26718750 #
5. Klonoar ◴[] No.26718750{3}[source]
Eh, fair. I cannot cite proof, only note that every instance I've seen Signal promise this feature has been worded in a way that indicates no phone number would be required.

It is unfortunate that I don't see many from Signal on this forum, as it'd be nice if someone would just clarify this already considering the popularity of it as a feature request.

replies(1): >>26721710 #
6. 3np ◴[] No.26720071[source]
In the past two countries I lived, it’s currently impossible for an individual to get a SIM card that can do voice or SMS without government ID and being a resident. Data-only SIMs can be bought for cash easily, but that doesn’t help you with Signal.

The same goes for virtual/VoIP numbers. No skypein etc.

7. pixxel ◴[] No.26721710{4}[source]
Not from Signal but the MobileCoin CEO posted this answer yesterday.

.....

>>The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How do you stop impersonation?

A: Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification.

.....

Reads to me like phone numbers are not going away.

8. xorcist ◴[] No.26723424[source]
Even in the US, the identity of most subscribers are known to the mobile operator.

It's a regulated market, so should the need arise to keep the identity of all subscribers in the future, it is likely not much more than a counter-terrorism-related law away.

9. lnl ◴[] No.26735340[source]
See the map on page 7 (PDF page 9) of the GSMA report "Access to Mobile Services and Proof of Identity 2020": https://www.gsma.com/mobilefordevelopment/wp-content/uploads...

To get counts, I also analyzed the table in the annex; it lists exactly 200 countries (checking each of them, that's because in addition to 193 UN members, it includes two non-member countries: Kosovo and Taiwan, and five other non-countries: French Guiana, Greenland, Hong Kong, Macao, Svalbard).

Of these, 34 are listed as "SIM registration not mandated" and further 7 are listed as "SIM registration under consideration", the rest are "SIM registration mandated", i.e. 159 countries.

Basically the whole world requires it except for North America/UK and a few smaller countries mostly in Europe. Also notable that countries without ID requirement mostly happen to be the ones with very low prepaid SIM penetration (see the map on page 6 [page 8 of the PDF]) so their unidentified SIM usage is presumably low anyway, though it remains a possibility in those countries.

Edit: Sorry, 6 are listed as "State of SIM registration inconclusive" which I have missed, so "SIM registration mandated" count should be 153.