Everything you do online leaks bits of identifying information that eventually deanonymize you. It’s a massive game of Guess-Who and every cookie, web-bug, LSO, list of available fonts, every canvas fingerprint and IP-address, every post you write with your language, unique writing style, vocabulary, punctuation can be used to rule out other people, and eventually reveal your identity.
So
The ability to act without a persistent identifier
is a bit misleading, as your actions again reveal information that can deanonymize you. You can act anonymously, so depending on situation, there’s a limit of “Largest amount of actions under maximum amount of blending/masking you can take without being singled out”
Keeping your identity private, but not your actions
Again, same thing.
“Anonymity is allowing people to see what you’re doing, but not that you’re the one doing it”.
Again, same thing
The sender and/or recipient’s real ID is unknown
Describes anonymity in the context of secure communication, which is practical, but a bit narrow definition.
claims that the purpose of anonymity is to protect an identity from being revealed.
This is a bit circular and sure defines what anonymity means in one way.
Merriam-Webster says:
the quality or state of being anonymous
As for Anonymous, it says
- of unknown authorship or origin
- not named or identified
- lacking individuality, distinction, or recognizability
So to tie these all into something practical context, anonymity means your real life identity can not be linked to any pseudonymous (shadow) profile, under which every action and piece of partially identifying information, that you and/or your devices have ever leaked about you, have been collected.
I believe anonymity is preserved if someone on Signal who has chatted with me cannot assure that the opponent is me
It boils down to what they can infer about your writing style. If you’re the only one who at the same time is
- interested in crypto anarchy,
- who does beekeeping,
- who thinks French fries come from France, and
- who writes
license as liesense,
That may be enough for a buddy of yours to tell its you. So anonymity requires quite a bit of OPSEC.
It won’t boil down to just phone number.
The reason why we say Signal is not anonymous, is because the client does not take steps to protect your anonymity.
-
It again, requires your phone number it sends to the server. If the service was in secret run by an intelligence establishment, they could trivially cross-correlate your phone number with your IMEI and triangulate your position with IMSI catchers, and then look up your identity based on your location/address. This applies even to a burner phone with pre-paid SIM.
-
It does not actively protect your IP-address from your server. For that you’ll want something
- That connects to the server via Tor exit node, or even better,
- That uses a Tor Onion Service server, or even better,
- That uses Tor Onion Service based peer-to-peer architecture
This prevents a service run by the intelligence establishment from asking the ISP to whom the IP-address block is assigned to, to which subscriber the IP was assigned on a given date and time.
Also, Signal has the username feature as an alternative to phone number for initiating chats.
This allows hiding the phone number from contacts, and if Alice is just JaneDoe.012 then one could argue she’s anonymous from her contacts, at least until she leaked too much information about herself.
The good thing is she knows how much she’s leaking. The bad thing is she might not be able to stop; As peers can’t tie her next username together with her old one, they can’t reach her once she changes her username.
Knowing this might make Alice stick to her username, which might also come back to bite her in another way: Bob can prove to Charlie he knows Charlie’s contact, and leak to him information about her.
EDIT: Signal apparently uses usernames in more throw.away fashion. See discussion below.
Still, Cwtch handles it much better as you can have very granular control over which profiles you have are throwaway, and which ones are persistent and reserved to IRL friends etc.
What Signal is doing is pretty good for a content-private messenger. But Signal doesn’t advertise itself as a metadata-private messenger.
End-to-end encryption is a technology used to protect content. It’s deployed on the Signal client that’s open source, and that you can compile and run on devices you own and control. The mechanism features public key fingerprints in the form of safety numbers, that allows you to verify the E2EE indeed happens between you and your contact, and that there is no man-in-the-middle attack by server or some third party. Signal thus has content-privacy by design.
Cwtch’s Onion Service routing mechanism is a technology used to protect metadata. It’s deployed on the Tor client running as a subprocess. It’s open source, and you can compile and run it on devices you own and control. The Tor-network is not run by you, but the odds of all 9000+ Tor nodes running backdoored code blindly, are rather slim. Tor gives the best technical chances of hiding IP-address out there, and the NSA has admitted it on its top secret slides it can’t deanonymize Tor users on demand. Cwtch thus has metadata-privacy by design.
Signal’s metadata protection is based on the company wide decision to run their servers in a way that masks phone numbers, and that doesn’t collect metadata about users conversing. If Signal was malicious, or greedy like Meta/WhatsApp, or compelled by national security law, Signal’s service could collect as much metadata as WhatsApp does. Because users don’t get a say in this, we say Signal has metadata-privacy by policy.
So because Signal client doesn’t take active steps to protect your identity from the Signal server with Tor, and because Signal server has a policy of requiring phone number for registration, it’s not anonymous in the same way it’s E2EE.
This is fine, Signal isn’t lying about it boasting metadata-privacy it doesn’t provide. It’s enough users know this and use Cwtch when they need the protections.