Tangentially related, but since we're talking about Signal and have Moxie's attention ...
Does anybody know how the "privacy preserving contact discovery" works?
One of my unpleasant experiences with Signal was receiving a greeting from an unknown number when I installed it. Fortunately, it was a friend with a new number I hadn't known ... but the potential privacy leak - without any apparent warning, consent or opportunity to opt-out - bothered me.
Best info I could find is a blog basically saying "privacy preserving contact discovery is an unsolved problem" ... which is hardly reassuring:
I posted on the issue tracker and a few other places about this and was shut down. Apparently it's a support issue, not a technical one. From my (limited and potentially erroneous) understanding, Signal hashes each of your local contacts and uses that hash to query whether the number is registered with OWS. If so, you receive a notification to that effect. Essentially, you can identify Signal users without actually communicating with them. Though the same is true with PGP if you use a public keyserver.
That said, it gave some friends quite a fright. It's really unfortunate this wasn't opt-in or publicized before-hand.
Does anybody know how the "privacy preserving contact discovery" works?
One of my unpleasant experiences with Signal was receiving a greeting from an unknown number when I installed it. Fortunately, it was a friend with a new number I hadn't known ... but the potential privacy leak - without any apparent warning, consent or opportunity to opt-out - bothered me.
Best info I could find is a blog basically saying "privacy preserving contact discovery is an unsolved problem" ... which is hardly reassuring:
https://whispersystems.org/blog/contact-discovery/
What's the story?