Comment by chews
11 hours ago
I have worked with Trail of Bits before and their cryptography teams are of the toppest of notches, I still have deep skepticism of Signal though. There are safer ways to use it, never getting push notifications is one part of it. I think their work is admirable, but the need for them to bootstrap you with SMS is a gotcha... they have usernames now, but even with those you have to have to bootstrap it with a number/identity.
And apparently, just like Telegram, just like WhatsApp, they readily merge the username with your number if numbers are already saved.
They will allow registering without phone number as a paid option soon.
> registering without phone number as a paid option soon
Replacing the need to register with a phone number with a requirement to pay is a better option how, exactly ?
Decreases what info Signal needs to collect and retain about a user. When using an SMS verification as a proof, Signal needs to log the phone number, because if they didn't, one spammer could use one phone number to create 10^99 accounts.
When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.
3 replies →
If your concern is "muh phone number", then you can pay and not have to give the phone number to sign up.
It's already the case today (and has been for years) that you don't need to give strangers your phone number to chat on Signal. My username is soatok.45; try to get my phone number if you can.
If you want absolutely no info to be collected, ever, and there to be zero cost on the end user too, be prepared to welcome your new spam overlords. Because the people who will benefit the most from a zero cost signup that only requires a username are spammers.
two weeks
[flagged]
> Lol how is that any better at all?
They are [1] implementing unlinkable payments so all that is known by credit card is that you purchased Signal and Signal doesn't know which credit card goes with which account.
>Signal is an obvious honeypot.
Claims without evidence can be dismissed without evidence. You might say they don't do enough to protect metadata privacy but it was never made to be an anonymous messenger, it was made to be a private messenger. You can easily check the end-to-end encryption in the code (reproducible builds on all platforms except iOS BTW!). This person audited Signal recently [2].
>They make no money and have no plans to.
They make money from donations and paid backups and they might make money from paid accounts.
[1] https://github.com/signalapp/Signal-Android/commit/7da3357b5...
[2] https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...
Signal's mission is to provide maximized privacy in a form the non-technical public can use.
A messaging service filled with bots and spammers is not usable, and possibly not affordable to Signal (what proportion of resources would be spent on spam/bots). What is a more private, usable solution for filtering them out than using a phone number?
Lots of security geeks want Signal to adopt practices unusable to the public. They've made clear that unsusable security is not in their mission.
True they can make their choices but it also means I won't support them in any way. Or recommend them.
I'd use something that's truly decentralised but signal is just another walled garden like WhatsApp. Just one that promises to behave better. But what's a promise worth these days?
A decentralised network would mean a guarantee that they can't do anything bad. I'll take that over promises and good intentions any day.
I don't care about the masses. If signing up for a matrix account is too annoying for them they don't really care about privacy anyway. After all it's the same they have to do for any online shop. Just create a username and password. Somehow it's not a problem for the masses if they wanna order a phone charger but for matrix it's suddenly 'too complicated'?
People like you who equate signal and WhatsApp are also responsible for not making any progress due to ideological stubbornness it’s something that I absolutely despise from a part of HN crowd here.
1 reply →
> signal is just another walled garden like WhatsApp
For me the difference is in the ownership. Who owns each. Which is BigCorp? That’s why I trust one more than the other.
1 reply →
> What is a more private, usable solution for filtering them out than using a phone number?
Since when is giving out your phone number a "more private" option ?
You don't have to give out your phone number. You can mint an arbitrary "username" and give the username out to people.
If it's not, let us know a solution (to Signal's actual problem as stated in the GP) that is more private.
5 replies →