I never said they were doing it or that people should assume it, just that it's possible. Whether or not that matters is up to each individual's own threat model and should be weighed accordingly.
"Bot" there doesn't necessarily imply a malicious spam/AI bot... legitimate B2B use is also included, which is a much higher percentage than illegitimate traffic. Same for AWS, other cloud providers, and even Cloudflare itself.
Bot traffic describes any non-human Internet traffic
I appreciate the sentiment, but I think the reality is the number of people who are so upset over this that they switch providers... is a rounding error.
They can... as I said they control the entire OS. They can see you're running Signal with account# XYZ, that you clicked the pay button, that Signal generated the ZKP (which they can read in memory or network packets), and all the key clicks and numbers entered of the payment details for that ZKP, the entire process.
they can’t link the account
Google can, since it's their OS and their payments.
But even if you're not using Play Store to pay, the vast majority of people who are paying are going to be using the same device/IP/fingerprint/etc. where Signal is running, so it's not impossible to put the two together to link an account to a specific payment, if say, a government forced them to do so in order to track someone. It's just a bad idea for several different privacy reasons.
there would be if it allowed unrestricted free accounts with zero barriers to entry, same with anything else like that.
I mean if you have physical access, then yea all bets are off. I was more thinking about remote exploits since most people (who aren't actually stealing/hacking on them directly) wouldn't be able to gain access otherwise.
How else would you solve the spam/bot problem on a system that already has > 100 million users?
SimpleX is more private anyways IMO
This camera is missing Android security updates for the last eight years.
Any RCEs though? Or do they all require local privileges?
You don't want to have to use a payment method at all... the problem with not having a phone number is there is no way to tie the account to someone who is responsible for the content, and Signal does not want the liability nor the spam traffic, of potentially harmful traffic (in whatever sense that may mean).
Or if you want the tinfoil hat response... they need/want to tie your account to a real identity for surveillance purposes, and they can't do that if there is no phone number, so they use a payment record instead. (I made all that up and have no idea if it's true)