Signal has started rolling out Signal Login, an optional registration method that allows users to create a Signal account without providing a phone number. The feature will be rolled out first on Android and will come to iOS later.
As we previously reported, Signal Login is not a free alternative registration method. Signal requires users who choose to register without a phone number to make a one-time payment. The price at launch is $2.99 / € 3.49, although this may vary by region and currency.
Or the server(s), no? It’s trivially easy to archive, filter by account, and then decrypt if the one key has been found
Delta chat assumes the relays are evil and of course doesn’t send private keys there
I think we’re talking past each other. To refer to your previous comment:
Or if you run an evil relay that logs encrypted messages, and later you get the single necessary private key. Which is the problem.
Yes and I’m saying that since the only way to get access to that private key on delta chat is to get access to an unlocked device at which point you have access to all the messages on that device anyway (on signal too)
What do you think makes Delta Chat uniquely impervious to leaking your private key compared to the other E2EE messaging apps that do implement forward secrecy?
I’m saying those others that pretend to implement pfs, still leak all chats the user didn’t delete (and in some cases even then) when an attacker has access to the private key because that’s stored in the same database.
Can we focus on the apps that do implement it instead? I’m getting more and more lost in the point you’re trying to make here.
E2EE messaging puts encrypted messages on a server without the private keys. The concern PFS addresses is to prevent a server from getting one private key and using it to decrypt all messages. This is a vulnerability of Delta Chat, and not one of Signal.
Okay and how would you get that private key?
By having access to an unlocked device: which means you also have access to all messages. Therefor this attack vector is not as big a deal as you are making it.
You are, by extension, saying that PFS is not as big a deal as you are making it. Do you have anything to back this up that Signal et al aren’t aware of? Would you like to argue Delta Chat should stop arguing in favor of it too?
Seems super dangerous to assume security due to ignorance of harm, but okay, I guess, we can play “look for why”.
With DeltaChat, you can get a private key just by accessing a file on a desktop client. Or a backup file . Then you can pass that onto a compromised server and restore chat history that wasn’t present on the client or backup file.