14 ms·
> Storage: $1.3 million dollars per year. > Servers: $2.9 million dollars per year. > Registration Fees: $6 million dollars per year. > Total Bandwidth: $2.8
by Dunedan 3y ago
> Storage: $1.3 million dollars per year.
> Servers: $2.9 million dollars per year.
> Registration Fees: $6 million dollars per year.
> Total Bandwidth: $2.8 million dollars per year.
> Additional Services: $700,000 dollars per year.
Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive.
- bilal4hmed 3y agois there any way they can reduce that cost?
- java-man 3y agoYeah, decouple Signal user identity from the phone number.
- tapoxi 3y agoThis will probably never happen. One of the reasons WhatsApp blew up is because using a phone number as your source of identification means there's much less friction in the signup flow. No username/password to create and your social graph is already there in your contact list. My mom was able to get our entire extended family on Signal without my involvement, which is a testament to how easy that is.
- yjftsjthsd-h 3y agoThey're already working on it: https://www.bleepingcomputer.com/news/software/signal-tests-usernames-that-keep-your-phone-number-private/ https://www.bleepingcomputer.com/news/software/signal-tests-... Not whether that's a good idea is more debatable; you're not wrong about discoverability.
- tapoxi 3y agoThose are in addition to the phone number, but it will still require a phone number under the hood.
- yjftsjthsd-h 3y agoIn the short term it will, and quite possibly in a long-term also, but if you were going to fully make phone numbers optional, I'm pretty sure this is the first step you would take. At the very least it sure looks like they're starting to build the possibility.
- GuB-42 3y agoThey also blew up because it was also quite decent SMS app, so you just had to install Signal and use it instead of your default SMS app. All your messages are there, you can continue to communicate exactly like you did before, except that now, if the other person also has Signal, your messages are encrypted. They stopped doing that (and I uninstalled Signal as a result), so they can also stop with the phone number thing, in fact, it would make more sense than with the current situation where Signal needs a phone number but doesn't use it (except for registration). I could even reinstall Signal if they do this.
- panarky 3y agoWhy not both? If I want discoverability, let me provide my phone number. If I want privacy, just assign a random identifier.
- lxgr 3y agoNobody is demanding them to stop supporting phone numbers as identifiers/verification methods. I'm not mad at all if somebody prefers using their phone number and not having a password for a service – just give me the option to use my email address and/or a username. There are too many "phone number only" services out there these days.
- tapoxi 3y agoUsernames are currently available in beta, the post I was replying to wondered if SMS verification could be removed because it's expensive.
- goodpoint 3y ago> Nobody is demanding them to stop supporting phone numbers as identifiers/verification methods. Plenty of people are, and for good reasons.
- goodpoint 3y agoIt has nothing to do with friction...
- xhkkffbf 3y agoWhich might be said to increase privacy. I suppose there's something to the point about combating spam. But surely there are other ways to do this, right?
- smt88 3y agoGetting rid of phone numbers would make anonymity easier, but it wouldn't affect privacy. Signal is explicitly private but not anonymous. In most countries, you can get an anonymous phone number anyway.
- j45 3y agoPhone numbers are the easiest login for people, especially in a world where not everyone has an email address. I know this will invite comments about usernames. I would like usernames a lot too.
- i67vw3 3y agoSend them via whatsapp. A lot of online services give an option to send OTP via whatsapp along with SMS/Email.
- lxgr 3y agoAs far as I understand, this is even more expensive than SMS in many cases due to WhatsApp's B2C messaging fee structure. It's also not a great idea to make sign-ups for an instant messaging service contingent on having an account with another, competing service.
- blakesterz 3y agoTwitter said that's why they got rid of the SMS 2FA. They said it was costing millions to have that enabled for them. https://www.cnn.com/2023/02/18/business/twitter-blue-two-factor-authentication/index.html#:~:text=Disabling%20text%20message%202FA%20won,year%20%E2%80%9Con%20scam%20SMS.%E2%80%9D https://www.cnn.com/2023/02/18/business/twitter-blue-two-fac...
- chimeracoder 3y ago> Twitter said that's why they got rid of the SMS 2FA. They said it was costing millions to have that enabled for them. Previous Twitter employees have said that this is incorrect. Because Twitter began as an SMS-only (and then SMS-first) application (remember 40404?), they very early on established direct-connection infrastructure for sending SMS, meaning that they have a marginal cost of literally $0.00/message in most markets. Twitter still has to maintain that infrastructure, because they didn't get rid of SMS 2FA - they just restricted it to Twitter Blue users, so the overhead is still the same. Almost nobody else who delivers SMS today has that infrastructure, because it doesn't make sense for most services to build. The only place where Twitter was paying significant amounts for SMS was due to SMS pump schemes, which is a consequence of Twitter gutting its anti-spam detection, resulting in them paying for SMS pumping which was previously blocked.
- hn_throwaway_99 3y ago> they very early on established direct-connection infrastructure for sending SMS, meaning that they have a marginal cost of literally $0.00/message in most markets. I am very, very interested to understand how that works, because without more detail or sources I'm calling bullshit. I definitely understand how Twitter could have greatly reduced their per-message fee with telecom providers, but at the end of the day Twitter is not a telecom and is still at the mercy of whoever is that "last mile" for actually delivering the SMS to your phone, so I don't understand how they have no marginal cost here. Happy to be proven wrong.
- dghlsakjg 3y ago
- baby 3y agoI really wonder why it’s so expensive to run. I always hear things about scaling but I used to run a top 500 alexia website and it was just a php app running on a mutualized offer for $5/month. Lots of manual caching though but still. My wild guess is that either the stack is not really optimal (last I heard it was java) or they do other costly things at scale (sgx?)
- suriyaG 3y agoI guess, then the question is how real time was the website. Was it as real time as supporting, instant messaging, voice/video calls etc
- baby 3y agoOh I forgot that signal is not just about forwarding messages. I’m wondering how much the VOIP costs.
- AlecSchueler 3y agoDon't forget media!
- zimpenfish 3y agoFTA: "Signal spends around $2.8 million dollars per year on bandwidth to support sending messages and files (such as photos, videos, voice notes, documents, etc.) and to enable voice and video calls."
- willsmith72 3y agohow is that in any way comparable? it's not about java vs php
- mi_lk 3y ago> the stack is not really optimal (last I heard it was java) how's java relevant here?
- 3y ago
- RunSet 3y agoI did my part to help reduce costs by switching to the decentralized alternative, Session.[0] Bonus: Session does not demand users' phone number. Also no bundled cryptocurrency.[1] [0] https://getsession.org/ https://getsession.org/ [1] https://www.stephendiehl.com/blog/signal.html https://www.stephendiehl.com/blog/signal.html
- bsilvereagle 3y ago> Also no bundled cryptocurrency.[1] It seems like Session relies on Oxen's network, so while there is no inherent coin it is blockchain backed. > Session’s onion routing system, known as onion requests, uses Oxen‘s network of Oxen Service Nodes, which also power the $OXEN cryptocurrency. Check out Oxen.io to find more information on the tech behind Session’s onion routing. https://getsession.org/faq#onion-routing https://getsession.org/faq#onion-routing
- pluto_modadic 3y agoSession depends on the Loki blockchain, so I dispute point 1.
- RunSet 3y agoI don't consider Session to "bundle" the Loki blockchain or the Oxen network in any sense. Here is more information about what I meant when I used the term "bundled". https://www.techopedia.com/definition/4240/bundled-software https://www.techopedia.com/definition/4240/bundled-software
- xkcd-sucks 3y agoCool, glad to hear about this - However, it is still coupled to a cryptocurrency (https://oxen.io/ https://oxen.io/) even if not bundled wechat-style
- itstaipan 3y agoI think simpleX[0] is a better choice at this point with all the recent issues around oxen: not coupled to any crypto, no user ids, can host your own servers if need be, etc [0] https://simplex.chat/ https://simplex.chat/
- jawns 3y agoPhone numbers have become the de facto version of "Internet stamps" for identity verification. They are near-ubiquitous on a per-user level, but hard to accumulate without significant cost. (Unlike email addresses.) But the down side is that phone verification tends to be on a per-service level. So, for instance, Signal incurs these costs when they verify their users, and every other service incurs these same costs when they verify _their_ users. There are a number of businesses out there that are trying to act as clearinghouses, where they verify the users once, then allow the users' verified profiles to be confirmed by multiple services. I wonder if any of those could be used to reduce these "registration" costs.
- supriyo-biswas 3y agoPhone number verification is used to verify the user's registration intent, so not really.
- explaininjs 3y agoA Flow: > Service A => User: Please Enter Your Phone Number and Email > Service A => Clearinghouse: Please verify phone number XXX wants to sign up for an account with us > Clearinghouse => User (SMS): Please respond with the Email you used at signup to confirm you want an account with Service A Later... > Service B => User: Please Enter Your phone number and Email > Service B => Clearinghouse: Please verify phone number XXX wants to sign up for an account with us > Clearinghouse => User (Email): Please verify you want an account with Service B Not saying it's great (providing email twice is annoying), but it's something.
- deleted 3y ago[deleted]
- rezonant 3y agoThis does not reduce the overall cost, it just shifts it to the clearinghouse. Who pays the clearinghouse so that they can cover their own exorbitant SMS costs?
- supriyo-biswas 3y ago> we can rent server infrastructure from a variety of providers like Amazon AWS, Google Compute Engine, Microsoft Azure Moving off cloud services to lower-cost provider like Hetzner, Vultr and DigitalOcean might provide a lot of cost savings. I also imagine they're using managed SMS services from one of these clouds, and moving off them to a combination of local SMS gateways in each country can also further reduce costs (and in one case I've personally observed, by upto two orders of magnitude). This obviously pushes a lot of complexity on Signal's side, but is usually worth it.
- slaw 3y agoAny idea what prevents Signal from using cheaper alternatives? Edit: I meant moving off cloud to Hetzner, Vultr, DigitalOcean.
- supriyo-biswas 3y agoAs I understand it, you have to often use multiple gateways based on which one is cheaper and can deliver your message to the recipient, and also take care of handling retries in case one gateway fails. This is not something you typically want to handle if you're not aware of it, and the process of having to talk to each vendor and figure out their limitations is tedious.
- lxgr 3y agoThere's a lower bound on what these services can charge in the form of interconenction fees charged by the mobile service providers delivering the messages. In the US, that's effectively zero due to the US phone infrastructure largely using a shared-cost model, but in most other countries which use "sender pays", these fees can be significant.
- wolverine876 3y agoIn business, you get what you pay for. Cheaper hosting might raise more issues that need to by handled by your employees, who also are expensive, and also the organization's focus gets disrupted. The hosting company / cloud vendor has an enormous economic advantage, with access to the entire hardware and software stack, the engineers who built it, people whose full-time job is operating it. Often it's cheaper to pay more for better. As I have to explain about open source, 'Free is only free if your time is worth nothing.' (And I use a lot of FOSS, it just not always the solution.)
- munk-a 3y agoSMS rates are absolutely bonkers considering the technical way they're transmitted. The US is an outlier in SMS rates actually being reasonable (usually unlimited or close to) for consumers - but for the rest of the world the insane mark up on that communication method has mostly obsoleted it... That'd be all well and good... the technology would die naturally, but all my American relatives continue to stubbornly use iMessage.
- lxgr 3y ago> for the rest of the world the insane mark up on that communication method has mostly obsoleted it... For P2P communication. SMS is alive and well for B2C messaging, most importantly for 2FA OTP delivery, but also as a first line of defense against spam/bot account creation. It's not a good solution to either problem, but it's slightly better than nothing (which apparently makes it good enough for many), so I suspect we're stuck with it for now. > That'd be all well and good... the technology would die naturally, but all my American relatives continue to stubbornly use iMessage. iMessage is not SMS, though. It just uses phone numbers as identifiers, but so do many other popular over-the-top messengers, including the most popular one globally.
- munk-a 3y agoTo clarify - iMessage does not use SMS if you're going from Apple to Apple device and both devices have data/wifi available. iMessage refuses to support messaging to Android clients and defaults to SMS for these messages. I've got an Android phone so all iMessage transmissions come across as SMS (or MMS).
- tofuahdude 3y agoWhy is it that SMS is so damn expensive? (or more specifically, what is it about Twilio et al's businesses that makes them cost so much?)
- j45 3y agoNothing just profit and existing system access costs set by the incumbents.
- sonicanatidae 3y agoIn the US, shafting customers as hard and fast as you can is the current business model. What are they going to do? Move to 1 or 2 remaining competitors with the exact same business model?
- mardifoufs 3y agoMost of that cost is literally coming from sms outside the us though. The rates for us sms are much lower than almost anywhere else.
- sonicanatidae 3y agoI'll have to do some research here. Prices in the US for bandwidth, phone services, etc. are insane.
- renewiltord 3y agoWhen you control access to the customer you can charge people a lot. Just like Apple can take 30% primarily because they’re the gatekeeper to iPhone users, telecoms are gatekeepers to their users so they can charge you a lot to text them. You don’t really have a choice. L
- myself248 3y agoWhat's it cost to be an SS7 peer for a year? Could they spin up their own "phone company" for the purpose of delivering SMS verification and nothing else, cheaper than they're paying someone else's markup?
- bloggie 3y agoFunny, because that's the reason I can't use Signal - I don't have a phone number.
- barbazoo 3y agoIn case one isn't aware, you can get a $1/month throwaway phone number from Twilio for that purpose.
- lxgr 3y agoThat's a neat workaround for the people that can figure that out, but doesn't change the underlying problem for the majority of users at all.
- alternatex 3y agoMajority of users don't have phone numbers?
- lxgr 3y agoI'm referring to the majority of users not having (or wanting to use) phone numbers. Some of these will be willing and able to pay $1/month to Twilio for a workaround, but most probably won't.
- bonton89 3y agoAren't these VoIP? Almost every service blocks VoIP numbers for sign ups these days, but perhaps Signal is an exception.
- barbazoo 3y agoThey work with Signal, Facebook, etc. Sometimes you have to try another one to get it to work.
- pierat 3y agoSounds like a great case to get the fuck away from SMS and phone numbers. But hey, they still want your whole address book, and announce you're on signal to everyone else on signal. The whole "secure" thing is a joke. Its all linked to your identity via your phone#.
- alternatex 3y agoThey want the address book because if you don't have engagement promotion features like that, there is no way to ever become remotely popular in the chat app space. Why is the security a joke? The data is e2e encrypted, and isn't related to a phone number in any way after registration. Do you know of a better way of combining privacy and anti-abuse measures? If you don't offload identity checks to telecom providers during registration some bad actor will immediately create a million accounts and send millions of spam messages and destroy the slim chance of this type of app to exist for free.
- pierat 3y ago> They want the address book because if you don't have engagement promotion features like that, there is no way to ever become remotely popular in the chat app space. Intentionally ignoring the fact that Signal splatters your phone number to everyone else is a humongous problem. And you can even put your phone number block in your address book, and it'll tell you everyone who has Signal. This happens all the time, with Signal servers leaking all of this metadata. And doing "engagement promotion" is what companies do to sell more shit. So, exactly what are they "selling"? >Why is the security a joke? Metadata, pertaining to communication patters and to whom matters just as much as what's being said. And that metadata, like "your phone number" and "contact's phone number", and "when data is being sent to/from" is that metadata. > The data is e2e encrypted, > and isn't related to a phone number in any way after registration. Bullshit. I see new people hopping on signal fairly regularly. If that was true, it'd be a simple verify-once-and-delete. It aint. > Do you know of a better way of combining privacy and anti-abuse measures? I reject your claim of "privacy", with regards to metadata. Secondly, Tox has an alternate way to handle this, by allowing any number of accounts not tied to anything. Sure, it's a SHA256 id, but who cares. There, its secure AND anonymous. Basically, I look at Signal as "better than SMS, but not much". It's basically a way to keep the phone company from scanning messages.
- renonce 3y agoJust wondering, are they relying on these big name cloud providers (AWS/Azure/GCP), known for predative traffic and storage pricing? Have they considered cheaper providers such as Backblaze B2 for storage and Hetzner/OVH for servers? The fees for storage, server and bandwidth could be cut by 80% if they did that.
- macNchz 3y agoOut of interest, their top vendor costs on their 2021 form 990: $7m Twilio $4m Microsoft $3m AWS $1.3m Google https://projects.propublica.org/nonprofits/organizations/824506840/202212729349301631/full https://projects.propublica.org/nonprofits/organizations/824...
- deleted 3y ago[deleted]
- wolverine876 3y agoSignal agrees: (from the article:) ... legacy telecom operators have realized that SMS messages are now used primarily for app registration and two-factor authentication in many places, as people switch to calling and texting services that rely on network data. In response to increased verification traffic from apps like Signal, and decreased SMS revenue from their own customers, these service providers have significantly raised their SMS rates in many locations, assuming (correctly) that tech companies will have to pay anyway. ... These costs vary dramatically from month to month, and the rates that we pay are sometimes inflated due to “toll fraud”—a practice where some network operators split revenue with fraudulent actors to drive increased volumes of SMS and calling traffic on their network. The telephony providers that apps like Signal rely on to send verification codes during the registration process still charge their own customers for this make-believe traffic, which can increase registration costs in ways that are often unpredictable.
- sowbug 3y agoSMS has become a kind of real-world PoW (proof of work) mechanism. A phone number typically has a recurring fee to keep it working. So a live number indicates that someone is spending money (a proxy for effort) to maintain it.* It still seems like a lot of money to spend on simple, old technology, but from the PoW perspective, making it cheaper would defeat its purpose. *Which is why many sites reject Google Voice numbers, for example, for SMS verification.
- thaumasiotes 3y ago> In response to increased verification traffic from apps like Signal, and decreased SMS revenue from their own customers, these service providers have significantly raised their SMS rates in many locations, assuming (correctly) that tech companies will have to pay anyway. There's nothing that requires tech companies to use SMS for registration or for 2FA. The normal way to do it is by email, which continues to be free. For Signal, there is no need to do 2FA registration at all. Signal is ideologically committed to publicizing your phone number, and apparently they'd rather pay $6 million to hold to their commitment than just... not do that.
- chefandy 3y agoI wish their justification for dropping SMS capability from their Android app to move away from phone numbers was a little more transparent about the obvious cost aspect rather than solely sticking to the patronizing "we're saving insecure messaging users from themselves" messaging they had. I found it pretty obnoxious. I think people generally get "valuable nonprofit + huge expense = not-sustainable = bad."
- rstuart4133 3y ago> their justification for dropping SMS capability from their Android app ... was a little more transparent about the obvious cost aspect I'm not following. Signal gets stung for the registration SMS costs because they send the SMS to the user. They don't pay when one user sends an SMS to another user. If you send an SMS, you're the one who pays. (I didn't realise they were moving away from phone numbers. Don't they they stay mandatory when PNP comes along?)
- eythian 3y agoIt's a lot more nuanced than that: https://news.ycombinator.com/item?id=33258684 https://news.ycombinator.com/item?id=33258684
- chefandy 3y agoIt would be great if that was what was in their announcement.
- mhh__ 3y agoI wonder if you could do something clever such that you can have people volunteer their SIM for sending 2FA?
- jjav 3y ago> Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive. Particularly when the phone requirement is the biggest weakness in Signal. Getting rid of it will make it substantially cheaper to operate and much more private. Win-win.