2026-02-03 16:59 UTC
@mike805@noc.social @muzicofiel@mastodon.nl @EUCommission@ec.social-network.europa.eu Signal is IMO a security failure anyway because has mandatory phone number as "identity". If someone freely decides they are not interested in the IMO overpriced, underperforming commercial service "phone number" anymore, the person who gets their phone number after them will be able to hijack their Signal account. If the registration lock works as alleged that means on the other hand that when you buy a SIM, it can happen that you won't be able to use Signal with it if the previous owner of the number has set up the registration lock.
Also nice that if the number is registered in a dictatorship and the dictator wants to hijack your account, they can phone the provider and ask them to temporarily reregister your number to their internal SIM, hijack the account and register the number back, so that you won't even notice your phone number stopped working and you may not even notice your Signal was hijacked.
I feel
c o n t e m p t
towards Signal when it uses a "security" architecture like this.
Replies (1)
-
@mike805@noc.social 2026-02-03 20:41
@clock@f.cz @muzicofiel@mastodon.nl @EUCommission@ec.social-network.europa.eu How does that work cryptographically? I assume "recover account" via the phone number does not unlock previous messages? So it must publish a new key. Signal is the best you can do without deploying your own infrastructure. I have personally tried twice to do open source tools that let you deploy your own, and got no take-up either time. Signal is the best thing people will actually use. I've been trying to do encryption since the 90s and people won't bother.