• Signal’s new beta introduces numberless registration for new users.

  • It costs a one-time fee of $3, which is paid anonymously and not linked to your Signal account.

  • It also adds support for two-factor authentication for numberless accounts.

all 8 comments

sorted by: hot top controversial new old
[–] 8 points 1 month ago

Registering without a phone number is easy, but users must store their ID and password safely in a password manager. Since no phone number is attached to the account, if a user loses either the ID or the password, they will be completely locked out and have no way to regain access. The app now also supports adding two-factor authentication for numberless accounts.

After registration, users can create a username to share with others. They can also opt not to create one. However, in that case, they can only participate in chats they initiate, because other users will have no way to search for them to start a conversation.

  • source
  • [–] 4 points 1 month ago (5 children)

    Can someone (such as Signal itself) please explain how the "anonymous" payment is supposed to work? Concisely but in sufficient detail to understand the principle I mean, without just saying "zero knowledge" and doing a bunch of hand waving when you get to the complicated part.

  • source
  • hideshow 5 child comments
  • [–] 4 points 1 month ago (2 children)

    Looks like it currently requires Google play. Not sure how it works on iphone.

    Can I buy an account on a device that has no Play Services?

    Not yet. We have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    I suppose you'd be buying some kind of generated token that doesn't correspond to your account ID in any way, then doing some fancy math to prove to the Signal servers that you have such a token without revealing which one it is, while at the same time preventing the same token being used more than once. Given that there's no need to tie it to any real-world attributes of the user (i.e. this is not like "age verification") it seems like this should be possible, but I'm curious about the details.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 month ago (1 child)

    TL/DR: You can read about it in detail here: https://eprint.iacr.org/2019/1416.pdf


    According to PrivacyGuides, regarding this announcement:

    The payment uses the same zero-knowledge proofs as Signal's donation system, so they won't be able to correlate your payment info to you.

    According to Signal's support article:

    Is my payment information linked to my Signal account?

    No. Your payment information is not associated with your Signal account. Using the anonymous credential scheme that we introduced for Signal private groups, clients make payments and then associate a badge to their profile such that the server can authenticate the client is in the set of people who made a payment, but doesn’t know specifically which payment it corresponds to.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago

    You can read about it in detail here

    Not exactly it seems, but we can read there about something which is apparently related to it in some way. If I ever manage to figure out which 3 of the 58 pages of mathematics paper it would take to explain the basic flow of the protocol, maybe it will become clear.

  • source
  • parent
  • [–] 2 points 1 month ago

    HAPPY to pay the price. Much cheaper than a phone number

  • source
  • 34 comments in c/android@lemdro.id view that post
    [–] 54 points 1 month ago (15 children)

    Oh hey great, I don't need a phone number anymore, I just need a...Google account and a credit card? That's so much worse...

  • source
  • hideshow 15 child comments
  • [–] 17 points 1 month ago (8 children)

    A Google account is required?? Well that's just dumb..

    This is a red flag.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 3 points 1 month ago (7 children)

    Signal is a paid contractor for Google, Facebook, Microsoft, and others since many years.

    They openly talk about this on their own blog: https://signal.org/blog/allo/

  • source
  • parent
  • hideshow 7 child comments
  • [–] 5 points 1 month ago* (last edited 1 month ago) (6 children)

    While this may be true, I don't understand what this has to do with a tool that peaches privacy requiring a tool that violates all aspects of privacy.

    EDIT: ah I believe you are saying that I never should have expected such purism in the first place.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 2 points 1 month ago

    I believe you are saying that I never should have expected such purism in the first place.

    What I'm saying is that Signal have a conflict of interest when it comes to Google and other customers.

  • source
  • parent
  • [–] 2 points 1 month ago (4 children)

    Hey, at least their clients are open source so you know that their chats are actually encrypted.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 month ago* (2 children)

    their clients are open source

    Their clients are but they sell proprietary licenses, so when they proclaim that There is no WhatsApp 'backdoor', you have to take their word for it.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago (1 child)

    It doesn't matter how many back doors they have on the server side. As long as the clients are open source (and end-to-end encrypted), the only thing they can tell is that two people communicated.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 1 month ago (5 children)

    Agreed. They should not have tied it into a Google account, literally ruins the whole point of being anonymous on there. I get they needed to implement some sort of easy payment method, but this isn't it.

    Only thing I could think to do is create a burner Google account, buy a Google play card in cash, and add those funds to your burner account to pay the 3 dollars.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 14 points 1 month ago (4 children)

    This plus their longstanding refusal to implement things like an official FDroid client or UnifiedPush notifications leads me to believe they're not committed to privacy.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 1 month ago (2 children)

    Those are also my two biggest gripes about Signal as well. At least the Molly fork solves both of those issues, that's what I use.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 month ago (1 child)

    molly is no longer maintained properly. It's worse than signal as last molly version is from Jul 31 and last signal is from Sept 11.

    i would think twice about using molly as the only benefit over signal is db encryption.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 1 month ago*

    I'm aware they lag behind in updates, only reason I chose to use Molly was because if I recall correctly they use Google Firebase for notifications, and I use grapheneOS and don't have Google play service installed. So not sure if I would get notifications in my setup if I used signal witn no play services.

    Correct me if I'm wrong though

  • source
  • parent
  • [–] 16 points 1 month ago* (1 child)

    If you’re worried about the payment being tied to your account, Parrelli also explains that the app will use the same zero-knowledge proofs Signal uses for its donation system.

    Trust me bro.

    This is just a quicker way of de-anonymizing than having to track down how you paid for a phone number. At least you can get a phone number with crypto.

  • source
  • hideshow 1 child comment
  • [–] 6 points 1 month ago* (last edited 1 month ago) (1 child)

    Looks like before it gets out of beta it will be available in fucking whatsapp.

  • source
  • hideshow 1 child comment
  • [–] 17 points 1 month ago (2 children)

    Parrelli explains that Signal is instituting the $3 fee to prevent scammers from creating multiple accounts and flooding the network.

    $3 does not seem like nearly enough to prevent this

  • source
  • hideshow 2 child comments
  • [–] 9 points 1 month ago

    You can only reach a few people before an account is banned due to reports.
    And most people won't fall for scams.
    And you also wanna pay the remaining operation not spend most returns on signal accounts.

    Because of that there's a massive difference in the kind of spam you get when it costs cents vs a few bucks per account.
    I definitely get more spam on discord than signal for example.

    3 bucks is also a lot more than it takes in some places to get numbers, so maybe long-term signal will try to also limit those number spaces with a fee? Either way this is enough to keep numbers as the weak link not numberless signups.

  • source
  • parent
  • [–] 8 points 1 month ago*

    So $3 and Google is to "prevent spam"

    But yet I can pay less then 0.25$ for an SMS and get 4x the accounts.

    I don't think its going to prevent spam, I think its going to eventually lead to someone getting got for linking a gmail to a signal account.

  • source
  • [–] 4 points 1 month ago (6 children)

    simplex folks. use simplex.

  • source
  • hideshow 6 child comments
  • [–] [S] 3 points 1 month ago (1 child)
  • [–] 7 points 1 month ago

    simplex requires zero identifiable information.

    you have to add users to the trust to get access to the channel/dm.

    the relay is self-hosted, meaning you have control over where your messages are handled. this means you could run it entirely on an intranet or pipe it through a lora-wan.

    personally I run a local instance within my LAN, and another instance in the cloud. both terminate with the same DNS. this means I can have quick very secure chats with family while at home that never leaves my network and when we're out messages are still going through my infrastructure.

  • source
  • parent
  • [–] 1 point 1 month ago

    I would support them than having to provide a phone number.

  • source
  • [–] 1 point 1 month ago

    Signal has always been shady. Never trusted them

  • source
  • [–] 1 point 1 month ago

    Is there no better way of doing this for Signal?!

  • source