It would be better if it was randomly generated, I'm looking at you CoralApples216
this post was submitted on 08 Mar 2024
149 points (100.0% liked)
Privacy
789 readers
4 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
Doesn't really matter with them being non unique. Multiple people can have the same username, there's a randomly generated number that goes with it
It generated a suffix of two digits when I tried (you can set it explicitely but it is mandatory).
I can be your Guest1234 anytime you want ;)
This is the best summary I could come up with:
Based on a phone number, the federal prosecutors were asking for the user’s name, address, correspondence, contacts, groups, and call records to assist with an FBI investigation.
Whenever Signal receives a properly served subpoena, they work closely with the American Civil Liberties Union to challenge and respond to it, handing over as little user data as possible.
Whittaker stressed that this is “a pretty narrow pipeline that is guarded viciously by ACLU lawyers,” just to obtain a phone number based on a username.
Signal’s leadership is aware that its critics’ most persistent complaint is the phone number requirement, and they’ll readily admit that optional usernames are only a partial fix.
She gave an example of a person who faces severe threats and normally maintains vigilance but whose mother is only on WhatsApp because she can’t figure out the numberless Signal.
Signal engineers have discussed possible alternatives to phone numbers that would maintain that friction, including paid options, but nothing is currently on their road map.
The original article contains 1,894 words, the summary contains 165 words. Saved 91%. I'm a bot and I'm open source!
just two pieces of data: the date the target Signal account was created, and the date that it last connected to the service.
And how does Usernames help here? Should be the same 2 data Points and not more?
The idea is that you change or remove your username after someone else starts a conversation with you, so the username can no longer be used to subpoena your account details.
Put another way, signal is able to provide those 2 pieces of information to law enforcement based on a phone number. This helps you to prevent law enforcement having a phone number to ask signal to look up in the first place, assuming you change your username every time you hand it out.
They also hash the usernames that they store on your account which means law enforcement can't ask what usernames are being used, only being able to ask for specific usernames which are currently in use.
I understand that right now LEA can serve up a subpoena and give Signal a username and get a phone number, but they can't give them a phone number and get a username.
Is it also possible for Signal to keep track of past usernames/associated hashes for a particular phone number?
(For comparison, Signal could record IP addresses, but we trust they don't due to unsealed cases. Could they keep a username history?)
Yes it entirely depends on whether they store previously used usernames along with the date range it was in use (to tell apart multiple people who used the same username at different times)
We'll have to see if any unsealed cases in the future support that they don't keep those records like how they don't keep IP logs, but personally their track record is enough for me to have confidence in the feature, especially since my "threat model" is primarily opportunistic hackers or spearphishers at most, not police or state / nation state level actors.
They don't track username history and don't have a server side list of plaintext usernames, and others can't find your phone number from the username alone. That makes it harder to confirm which account is yours.
still waiting for this to roll out on ios...
edit: nevermind, it updated
I have this for some time now on iOS
you have the beta?
the beta is closed now...
I dont. I got it via normal update. The 7.1 has been installed recently on my iPhone
hmm... well shit, i swear i tried to update it before...
but i did just update it to 7 just now... thanks
Not-a-paywall paywall.