Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Close, but not quite.

You see, if the other person didn't use registration lock, now you've got access to complete strangers account.

Problem solved!



Not exactly. Registering again will make an entirely new identity with different key pair. The new phone holder won't get access to your contacts or your message history. I believe your contacts will also know about signature change as well.


Fair enough. I was just making a bit of a joke. :)


Which is less scary than it sounds because a signal "account" is a phone number. Oh no your privacy!

If you view Signal as "a service that allows you to send E2E messages to phone numbers" then this is fine. Your friends will even get a message that says the chat has been rekeyed once the new person sets up Signal.

And if you're worried about government's compelling your cell carrier to turn over your phone number then rest assured that usernames wouldn't help you since they could just compel Signal to turn over your username. So much safer.

As long as the source of identity is something other than a private key that is owned and controlled by the user and devices must have their keys signed by that key to be considered valid it will be the same issue.


I was actually just trying to make a (poor attempt at a) joke. Honestly, I don't really know, or care, how Signal works.

I have no respect or interest in using any service which requires a cellphone to use it by fiat.

I don't really have any great concern about the government requesting my information, not because I "don't have anything to hide" or "because I'm too boring to care about" but simply because I don't care if they do. They will do what they will do. I will do what I will do. It's immaterial for me to worry and fret over the actions of someone else. Governments are simply a form of authority which protect those who pay up, and harm those who don't. It's neither my protector or my enemy, it's just a thing that demands money from me from time to time.

As far as secure communications are concerned, if someone is truly concerned about such things, the only reliable method I'm aware of is a one-time pad. [1] For most, such a system would be far too bulky and cumbersome to bother with, meaning that the communication itself is, in actuality, not worth securing to the highest degree. This, in turn, makes the thousands of digital alternatives "good enough" for all but nation-state threat actors. [2]

[1] https://en.wikipedia.org/wiki/One-time_pad

[2] https://nordvpn.com/blog/nation-state-threat-actors/




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: