Privacy

32442 readers

638 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

Whats the purpose for usernames on signal? (self.privacy)

submitted 9 months ago* (last edited 9 months ago) by Extrasvhx9he to c/privacy@lemmy.ml

17 comments fedilink hide all child comments

Been using signal for years and love it and got the majority of my contacts on to it. My question is how are usernames useful now? You still need to register with a phone number with signal to limit spam and bots afaik and I'm assuming you should protect your username just like you do your phone number anyways because spam, malicious files/messages, etc... What scenario is this addressing where an average person gives up their username to a stranger? The only one I can think of is online dating or other online interactions like on forums. Just seems this is just more tailored to the people who need to be pseudo-anonymous for whatever reason than an actual privacy feature. Even then for the anonymous people does that mean usernames will be able to be changed?

Tldr: Questioning what scenario does signal's new usernames address for the average Joe?

Edit: Just realized can be very useful for work relationships

you are viewing a single comment's thread
view the rest of the comments

[–] LWD@lemm.ee 0 points 9 months ago

FWIW if Signal did cooperate with law enforcement for any reason, they could be given the RndoUsr.40 account name and return a phone number, as long as that user was still rocking the username by the time they started looking... Or, I suppose, if Signal servers log those histories somehow.

Importantly, though, phone numbers cannot be queried for usernames. The data returned from a phone number will be the same as seen on previous FOIA requests.

From their blog (hard to find because it's hidden behind ellipsis):

Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs. Signal can’t easily see or produce the username if given the phone number of a Signal account. Note that if provided with the plaintext of a username known to be in use, Signal can connect that username to the Signal account that the username is currently associated with. However, once a username has been changed or deleted, it can no longer be associated with a Signal account.