Oh hey great, I don't need a phone number anymore, I just need a...Google account and a credit card? That's so much worse...
post
If youβre worried about the payment being tied to your account, Parrelli also explains that the app will use the same zero-knowledge proofs Signal uses for its donation system.
Trust me bro.
This is just a quicker way of de-anonymizing than having to track down how you paid for a phone number. At least you can get a phone number with crypto.
Looks like before it gets out of beta it will be available in fucking whatsapp.
Parrelli explains that Signal is instituting the $3 fee to prevent scammers from creating multiple accounts and flooding the network.
$3 does not seem like nearly enough to prevent this
You can only reach a few people before an account is banned due to reports.
And most people won't fall for scams.
And you also wanna pay the remaining operation not spend most returns on signal accounts.
Because of that there's a massive difference in the kind of spam you get when it costs cents vs a few bucks per account.
I definitely get more spam on discord than signal for example.
3 bucks is also a lot more than it takes in some places to get numbers, so maybe long-term signal will try to also limit those number spaces with a fee? Either way this is enough to keep numbers as the weak link not numberless signups.
I don't think the same credit card can be used for multiple accounts.
So it is not about money but hoops one needs to jump through to pay that money.
So $3 and Google is to "prevent spam"
But yet I can pay less then 0.25$ for an SMS and get 4x the accounts.
I don't think its going to prevent spam, I think its going to eventually lead to someone getting got for linking a gmail to a signal account.
simplex folks. use simplex.
Why Simplex over Molly?
simplex requires zero identifiable information.
you have to add users to the trust to get access to the channel/dm.
the relay is self-hosted, meaning you have control over where your messages are handled. this means you could run it entirely on an intranet or pipe it through a lora-wan.
personally I run a local instance within my LAN, and another instance in the cloud. both terminate with the same DNS. this means I can have quick very secure chats with family while at home that never leaves my network and when we're out messages are still going through my infrastructure.
Simplex have different design and does not cover the same use case. For me I just want a middle ground between the two.
definitely a comparative turd to use in my. expernce and mine just sh! the bed and froze solid, losing everything with a decryption error, while attempting to do that most boring of things, a backup
Registering without a phone number is easy, but users must store their ID and password safely in a password manager. Since no phone number is attached to the account, if a user loses either the ID or the password, they will be completely locked out and have no way to regain access. The app now also supports adding two-factor authentication for numberless accounts.
After registration, users can create a username to share with others. They can also opt not to create one. However, in that case, they can only participate in chats they initiate, because other users will have no way to search for them to start a conversation.
Can someone (such as Signal itself) please explain how the "anonymous" payment is supposed to work? Concisely but in sufficient detail to understand the principle I mean, without just saying "zero knowledge" and doing a bunch of hand waving when you get to the complicated part.
Looks like it currently requires Google play. Not sure how it works on iphone.
Can I buy an account on a device that has no Play Services?
Not yet. We have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.
I suppose you'd be buying some kind of generated token that doesn't correspond to your account ID in any way, then doing some fancy math to prove to the Signal servers that you have such a token without revealing which one it is, while at the same time preventing the same token being used more than once. Given that there's no need to tie it to any real-world attributes of the user (i.e. this is not like "age verification") it seems like this should be possible, but I'm curious about the details.
TL/DR: You can read about it in detail here: https://eprint.iacr.org/2019/1416.pdf
According to PrivacyGuides, regarding this announcement:
The payment uses the same zero-knowledge proofs as Signal's donation system, so they won't be able to correlate your payment info to you.
According to Signal's support article:
Is my payment information linked to my Signal account?
No. Your payment information is not associated with your Signal account. Using theΒ anonymous credentialΒ scheme that we introduced for Signal private groups, clients make payments and then associate a badge to their profile such that the server can authenticate the client is in the set of people who made a payment, but doesnβt know specifically which payment it corresponds to.
You can read about it in detail here
Not exactly it seems, but we can read there about something which is apparently related to it in some way. If I ever manage to figure out which 3 of the 58 pages of mathematics paper it would take to explain the basic flow of the protocol, maybe it will become clear.
all 34 comments