logoalt Hacker News

ddtayloryesterday at 10:22 PM1 replyview on HN

I would think being able to subpoena records for all active signal users would be a cause for concern.

Ironically enough Reddit seems to have a pretty good take on this: https://www.reddit.com/r/law/comments/1qogc2g/comment/o21aeh...

I was genuinely surprised when I went to Reddit and saw that as the most voted comment on the story.


Replies

OneDeuxTriSeiGotoday at 1:21 AM

I think that's a fair assessment on their part however it's worth noting that your phone number does not serve as your account ID. It can be used to look up an account but there are caveats to that.

The lookups go through a secure enclave, the system is architected to limit the number of lookups that can be done, and the system has some fairly extensive anti-exfiltration cryptographic fuckery running inside the secure enclave to further limit the extent to which accounts can be efficiently looked up.

And of course you can also remove your phone number from contact discovery (but not from the acct entirely) but I'm not sure how that interacts with lookup for subpoenas. If they use the same system that contact discovery uses, it may be an undocumented way to exclude your account from subpoena responses.

The rest of what they say however is pretty spot on. The priority for signal is privacy, not anonymity. They try to optimise anonymity when they can but they do give up a little anonymity in exchange for anti-spam and user-friendliness.

So of course the ending notes of "use a VPN, configure the settings to maximise anonymity, and maybe even get a secondary phone number to use with it" are all perfectly reasonable suggestions.