Your "major problems" are fair, but nothing's perfect, so unless you have a better solution with the same design constraints (e.g. https://github.com/signalapp/

Your "major problems" are fair, but nothing's perfect, so unless you have a better solution with the same design constraints (e.g. https://github.com/signalapp/Signal-Android/blob/main/CONTRIBUTING.md#development-ideology https://github.com/signalapp/Signal-Android/blob/main/CONTRI...), they are rather moot, because they're not actionable. That being said: > - it is not that private after all since it requires a phone number. Yes, you can override this by using some virtual throwaway number if you are geeky enough but your account will be associated with this phone number anyways. You still leak very little because of their sealed sender feature. If you allow arbitrary usernames, you need to bootstrap your trusted channel from no assumption instead of a weak one (if I receive a message from @barack_obama for the first time, I have no clue if it's actually someone I know, while a message from @+1235312 indicates that the sender at least had access to this number at some point to register). All solutions have tradeoffs. > - as a consequence you _will_ receive spam from bots fanning out messages to phone numbers. There's very little spam now on Signal (I think I've had 2 spam messages in about 4 years). At one point there was a bit, but server-side measures are now preventing that. You can't really have no spam at all as long as you have a common id that's shared among your contacts, which is the case most of the time for usability, as any of these contacts can leak this id somehow. > - Signal protocol is probably great from the e2ee perspective but it is not federated and unlike XMPP you cannot spin up your own server and have full control over it. Signal's approach is that you shouldn't care about the server. Why do you? > And I am sure you cannot run an end-to-end audit of the whole Signal platform to verify that what they actually run has been built from the source code you have audited. You can do that on the client code, which is reproducible, and again mostly what you should care about. > - Since it is centralized, Signal is prone to censorship in those countries that decide to fight it. I'd say that their reliance on phone numbers is the main issue with censorship: if new users can't receive their registration text message, they cannot register. AFAICT people in censored countries still rely on WhatsApp, Signal and similar messengers instead of more niche but more decentralized alternatives like Tox. Again, however bad their current approach might be, it's a moot point until there's something that works better in practice.