Hacker Newsnew | past | comments | ask | show | jobs | submit | jack1243star's commentslogin

> You still need to use your phone number to sign up, though.

Which defeats the whole point. What if the FBI politely asks Signal about a phone number?


All they'd learn that way is that that phone number has a Signal account, when it was registered, and when it was last active. In other words, it doesn't tell them whether it's part of a given Signal group. (See https://signal.org/bigbrother/.)


They publicly publish these requests. You can see how little information is provided — just a phone number and two unix timestamps IIRC. https://signal.org/bigbrother/


I might be misremembering or mixing memories but i remember something about them only storing the hash of the number.

So the FBI cant ask what phone number is tied to an account, but if a specific phone number was tied to the specific account? (As in, Signal gets the number, runs it through their hash algorythm and compares that hash to the saved one)

But my memory is very very bad, so like i said, i might be wrong


It would be absolutely trivial for the FBI to hash every single assigned phone number and check which one matches. Hashing only provides any anonymity if the source domain is too large to be enumerable.


Brief research says that Signal does store phone numbers.

Regarding hashing: while unsalted phone number hashes would be easy to reverse then I doubt that any hashing scheme today is set up like that.


You don't even need to think about how the hashing scheme and salt is set up. If Signal can check if a phone number matches the hash in any reasonable amount of time (which is the whole point of keeping a hash in the first place) then the FBI can just do that for all phone numbers with very realistic compute resources once they get Signal to cough up the details of the algorithm and magic numbers used.


Well, Signal would have to disclose the salt of course.


Totally understandable and even reasonable position, but the paying customer gets the worse treatment, which does not sit right.


> marking clipboard text with some magical locale indicator

The geniuses behind Unicode managed to make it mandatory anyways, at least if you want correct CJK text rendering :)


I know that before, Unicode and locale aware systems were supposed to use unicode tags (U+E0000..U+E007F) to invisibly and "for all plaintext purposes" mark text for such han unification handling but that use is now deprecated.

What I am supposed to use those days? HTML-encoded in utf-8, with lang attributes, so <span lang="ja-JA"> and <bdi lang="zh-Hans"> infested text?


Calling Half-Life 2D somehow feels right and wrong at the same time but I get what you mean.


That's what Sigil did with Buckethead, in a way.


Those fonts look awful in a hard to describe way. Font uncanny-valley? I feel like a barcode reader trying to OCR meaning out of ink blots.


Those fonts are completely indistinguishable from the average cartoon/artistic font from the 2000s which are definitely not created by AI. I don’t like most of them, but I don’t like most of the human-designed ones either. Plus AI-assisted fonts in CJK often means hand drawing a couple hundred characters, maybe more, then generating the thousands of remaining characters (I assume the current crop of SOTA models could change that, but these fonts have been going around for a while), so the odds are what you see in the samples are mainly or maybe even completely human-generated.


I'm convinced whatever Torment Nexus we can think of will get built.


Rule 34(B)?


That's just English being irregular. One that hosts websites should be called a hoster in principle :)


Host is both a noun and a verb. (The host can host a party.)

Hoster is new to me too.

But I get it as a pattern. (If you dine at the party then you are a diner.)


Wow, perhaps Nintendo/Konami actually learned this tactic from IBM, threatening smaller game developers with patents when their case for copyright is too weak...


That's like saying online banking is doomed because rubber-hose cryptanalysis exists. The defense does not have to stop 100% of the exploits to be effective.

I hate kernel level anti-cheats but they do provide friction and reduce cheating.


There are open source solutions out there. If anything there is less friction now.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: