Ah, I see. I use Telegram and it doesn’t announce, but if someone in my contacts list installs it, that person will show up in my Telegram contacts list, so that’s the reference I was using. What your describing does sound like a bit much to me, its awful… social for a secure messenger.
First definition:
Signal have not this information. Read my first post.
It’s still more complex than current app.
When I want to call someone, I don’t have to send a email to ask them if they have a phone app on their smartphone.
When I want to email someone, I don’t have to send a mail to ask them if they have a email app.
When I want to mail someone, I don’t have to send a telegram to ask them if they have a mailbox.
Etc.
Signal is a replacement for SMS app.
1 Like
No, but you perfectly illustrate my point.
When you get a new email address, no one is emailed and notified that you got a new email address. Your friends and relatives don’t get a letter or email or phone call from your carrier when you get a new phone number. Same for text messages. Every one of your examples requires prior information in order to use (phone number or address) that you had to collect by some other means. And that’s exactly what @ChriChri wants for signal.
2 Likes
One of the things that rubs me the wrong way about Signal (although I still recommend it) is the mindset behind some of the development decisions they’ve made. Signal states that their goal is to make E2E communications something everyone can have. Furthermore they believe that everyone should be using E2E now. Behind this is also the belief that making decisions for users is sometimes a something they have to do because it is better to default to certain settings than make it all too easy for someone to leave the defaults and not be secure.
The reason why all of your contacts who also use Signal are notified that you just installed and are using Signal? To help further the use of the app. Many people download the app and find they have 1 or 2 friends who are on it, but not enough to warrant using the app often.
Thus this decision is purely to help people rekindle a desire to use the app by blaring that a contact joined. (You can disable push notification of these events, but can’t disable the event happening.)
Now as to this feature infringing on GDPR, I doubt it.
The reason for this is because both individuals need to have the user as a contact on their phone. Any lawyer worth their salt would just argue that the information being passed between the two is already assumed.
Edit: The receiver is the only one required to have the phone number. I think the point is still valid as discussed in a later post.
Do I like the feature? Meh. I don’t really care. I think they should make it something you can turn off and on, but I don’t think they are ethically wrong because of it. I think they are just a little arrogant on the way they think security for the masses should be done.
Wrong.
I tried it to understand it better: The notification happens when the receiver has the phone number of the newly joined member.
I made a screen video of all of this on two different phones while testing to document it and maybe later submit a GDPR violation.
The situation like you describe and suspect it would be somehow grey. But the actual behaviour as I describe it and as I successfully tested and documented it is way on the dark side of the force.
1 Like
- ‘data subject’ is identified by phone number
- ‘any information relating’ to above: above uses software xyz
Signal might not have and/or store this information, but it processes this information in a way that it transfers this personal information to an unknown number of other persons.
I’d still believe that GDPR applies.
1 Like
I don’t know, the receiver having the number of the recently joined signal user is still along the same lines. One could argue that the number is the more crucial piece of personal data, and thus the signal notification is irrelevant. That isn’t my argument of course, just what I could see happening in court.
I agree with you though! If someone would like you to use an app for work or something along those lines, but you don’t want to (despite already using the app) that is your right. (I’m talking about voluntary stuff here. If you sign up for a job and they mandate the use of certain software, your chance to dissent about that was in the job interview not after you’ve accepted their employment.)
as far as i see it - this IS the job interview 
It’s the same with Signal, if you don’t give your phone number, nobody can text you.
Signal doesn’t transfer your phone number. Your contact already have your phone number. Signal only transfer encryption keys. There is no GDPR violation.
I think the potential exploit concern is that one could add all numbers to their contacts list then know anyone who joins and knows their number is active and in use. This would be different than just spamming all numbers hoping for a reply as this exposes your number as active on the date you signed up for signal.
Also this enables a stalker to know you signed up for signal and a presumably using it.
I’m sure there are other ways this could be exploited but those are the obvious ones that come to mind by having the system default to notifying people that their contacts have joined.
2 Likes
Again, I believe this is not correct. I didn’t look into the protocol, but to archive what I described there are in my opinion the following possibilities:
- the new users phone number hash that is transmitted to Signal (and possibly stored as the users identification) is forwarded to any Signal user to be compared to their local address books
- any Signal user request periodically information about the phone numbers in their address books to verify if (new) users are available via Signal.
What you write has to be wrong, because somebody with my phone number in her/his address book wouldn’t know my encryption key beforehand and couldn’t match it to - once received - to their information to show a notify that I joined.
I bet you can dig it up in the source and/or protocol description: for finding other users a hash over the phone number is used.
The outcome (which is important in the light of GDPR, because GDPR protects people rights and doesn’t care about the technical method you use to break them) is that you transfer the information (person is using that software and reachable via it) about a person (identifiable by her/his phone number) to third persons without knowledge and consent.
As you might notice, I do not come up with really new information, because everything about it is described and said from my side.
I’ll be happy to learn something and discussing with you if you start proving the information I provided wrong.
Whether the behaviour of Signal breaks GDPR might or might not evaluated by authorities - depending of my available time to file a request. Therefore we can leave that part out of our discussion and I apologize for bringing it up without real knowledge or prove.
Let’s get back to technical and I still say that the behaviour of Signal is absolutely unacceptable and described in the right way by me.
1 Like
That’s true, I think I’d gotten a couple wires crossed earlier. Someone needs your info in order to contact you, which is as it should be.
But Signal.shouldn’t broadcast your usage of it to all those people. If they marketed it as a “social messaging app,” it’d make more sense. I would expect this behavior from WhatsApp or twitter. Something that sells (not literally) itself as “secure,” I feel, shouldn’t engage in this behavior. Moreover, I still don’t think its an unreasonable expectation to not do it.
As an aside, this seems to illustrate an interesting example of where secure communication != private communication.
How can I take an article written by this guy seriously, when in another article written by him, he boldly claims that the official facebook messenger app is the best communication app on Android?
Honestly, I don’t understand why Threema is never mentioned among the privacy conscious. That is a company and an app which demonstrates how a closed source elements can be trusted because they earn that trust. I would argue that the average customer is better served in this way, and has reasonably more PROOF that the app is secure and private as claimed.
This might help explain why.
1 Like
Sure I get that Telegram is more feature rich but threema is a drop in place replacement for WhatsApp.
Telegram funding is questionable and the fact that it is developed in Russia makes the funding perhaps even more important.
I’m not trying to slander Russians or their ingenuity because their intelligence and capability has been demonstrated throughout history often. I’m merely suspect of their government.
Telegram is developed and funded by Russian expatriates based in Dubai, if that makes you feel better.
1 Like
I see I work quite differently than you.
-
As soon as I saw Signal as an available app on my first smartphone (2017), I was interested to secure and private communication. Therefore I read ALL the information that Whisper Systems was offering. So I read the pertinent documents under => “https://support.signal.org/hc/en-us/”.
-
You seem to prefer formulating conjectures, articulating fears (that are understandable), and making lots of people loose hours in fora like this one, with never ending chatting. Thousands of hours altogether!
Here what I still remember from then:
-
As soon as you join Signal and agree to lookup your contact list, Signal scans your contacts for cell numbers, and queries its own sever for the cell phones on your contacts, if they have Signal installed. If yes, your Signal gets notified per SMS, and the contacts as well.
-
That sounds weird, I know. But you then should read this=>“https://signal.org/bigbrother/eastern-virginia-grand-jury/” . And the real point for me is what follows:
In the “first half of 2016” (the most specific we’re permitted to be), we received a subpoena from the Eastern District of Virginia. The subpoena required us to provide information about two Signal users for a federal grand jury investigation.
We’ve designed the Signal service to minimize the data we retain about Signal users, so the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user’s connectivity to the Signal service.
Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with.
All message contents are end-to-end encrypted, so we don’t have that information either.
My own position in this matter is as follows:
-
The data referring to me on Whisper Systems server are insignificant.
-
Their methods to exchange contact information among Signal users are somewhat invasive, but I accept them for the sake of practicability.
Others may come to other conclusions.
I find there are worse problems: I have a Jolla 1 phone from 2013, and cannot find any app/program for running Signal on it, because Whisper offers only Google Play Store apps ( and they are too modern for Jolla1, which partially supports Android 4.1).
Since 2013 several native apps for Signal got orphaned of their developers. Starvation from side of Whisper? Whisper could be much more collaborative towards the broad community!
OT: I do not see any Preview Option for my replay (this is my first post here). I am sorry for all the formatting errors I have surely produced. Not to speak about orthography, style…
4 Likes
Looked into it again and it really did. I can see why the international community seems to prefer Telegram. I do wonder if their encryption protocol has been audited as extensively as Signal’s.
Also, on Signal for Android at least, you need to permit the app being able to see your contacts. If you deny that, then there is no way for the App to check and notify people with your number that you are using the app?
Or was it saying that the server is checking your number against other users who have allowed the app to access their contacts?
According to the link from Signal you provided here, one answer states: “They just see a number they know is registered. If someone knows how to send you an SMS, we want them to see that they can send you a Signal message instead.” While my English is not even close to be perfect, can you explain what is that @ChriChri, together with myself, are getting wrong from sentences I’ve just copied here, from their official page? Is it “somewhat invasive” = invasive, or just = somewhat invasive on top of GDPR?
1 Like