7 ms·

> Now, you can connect on Signal without needing to hand out your phone number. (You will still need a phone number to register for Signal.) Why is it so hard

> Now, you can connect on Signal without needing to hand out your phone number. (You will still need a phone number to register for Signal.) Why is it so hard for Signal and Telegram to not require a phone number as an account identifier? I don't need to verify anything by phone or even email. If I lose the password, the account is lost, so be it. I'll create a new one. If I really want to, then I'll set up email/phone.

sedatk 3y ago
Because it’s resilient against spam, and extremely easy to recover.
- WhyNotHugo 3y ago
  They're resilient to spam, but often impossible to recover. I had a spare SIM card that friends and family use when visiting from abroad. It's been unused for 90 days and has been deactivated. The number is lost, and irrecoverable. A friend had created a (second) Signal account with this number and can no longer log into new devices. As a more mundane example: If I accidentally drop my phone into a river, the SIM is gone forever, and so is that line. Sure, you can have a contract line which allows recovery. Depending on where you live, these can be several times more expensive than a regular pre-paid line.
  - hahn-kev 3y ago
    Easy to recover your Signal account using the phone number. Not saying it's easy to recover a phone number.
    - sedatk 3y ago
      No. I believe that it's way easier to recover your phone number when you lose your SIM or change your phone (eSIM). When you lose your email password and the recovery code at the same time, your email is gone, forever. That's a huge difference, IMO. Yeah, it may not work when you buy a prepaid SIM and decide not to use it for a long time, but for billed plans, it's impossible. I've been using the same cellphone number for the last 23 years. I'd got my phone stolen, I was able to reactivate my cell the same day with another phone.
  - deleted 3y ago
    [deleted]
  - crazygringo 3y ago
    You don't need a "contract" for recovery, just an account. E.g. in the US, Mint Mobile is $15/mo. and is prepaid in the sense that you buy blocks of months at a time. But if you lose your SIM they'll still send you another one with the same phone number. So no, if you lose your SIM you don't necessarily lose your number, even if it's prepaid. That only happens if you're buying your SIM as an "anonymous" one-off purchase, which is not what most people do these days. Not to mention the increasing prevalence of eSIMs.
  - sedatk 3y ago
    "Often impossible"? Not my experience at all. Maybe it would be more problematic with prepaid SIMs, but why would a monthly billed account get deactivated? You lose your SIM? You go to a branch, verify your identity, and get a fresh new SIM for your line. There's no more straightforward and surefire way to recover any other type of account as of today.
- herbst 3y ago
  Email is easier to recover and unlike a phone number you can actually own and control your email. There is no way of actually owning a phone number.
  - sedatk 3y ago
    > You can actually own and control your email Email isn't easier to recover at all unless you own and control it which nobody does.
    - herbst 3y ago
      Well nobody is a bit a overstatement when thousands if not millions of people actually do run their own or partial email stack. If you don't own your email it's just as bad as a phone number, but not worse. In general emails don't just get removed and given out again if you don't interact with them for a few months. Phone numbers do usually after 6-12 months or even after 3 months for some providers. You can prepay a domain for up to 10 years or more and always setup a email server when you need it so you essentially have full control, long term. And don't get me started with possible SIM copy and stealing attacks. Things already pretty much solved with email and DMCA
      - sedatk 3y ago
        I said "nobody does" because nobody can. It's a practical impossibility to run your own email today. It doesn't even matter if you have the necessary advanced technical skills. It's just not possible. https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-... As the owner of the same cell phone number for the last 23 years, proposing hosting your own email as an alternative to SIM cards that's available at every corner doesn't sound feasible to me at all. I don't even like cell operators, but that's just the way it is.
        herbst 3y ago
        That's one anecdotal experience and simply not an ultimate turth. I've had a email startup (sold meanwhile, but still running) and seen all these mentioned issues and know very well how painful this can be, but far from impossible. There is a market for clean IPs for company infrastructure, that's a thing still as well. Probably I shouldn't say email is much better. But phone numbers definitely are a very weak decision for any kind of security.
cpa 3y ago
Unfortunately, spam exists and phone verification is one of the least-bad-way to ensure that the user is a real person (there are other options, but it really is one that has many advantages). Given that Signal does not have access (by design) to much information about their users when they use the service, they can't really fight spam once accounts are created. You could do spam detection on the client and privacy-preserving voting in order to ban spammers, but the UX would be very poor and that opens a whole new can of worms.
- dns_snek 3y ago
  This reasoning doesn't make sense to me. A spammer can make an account, but how would they contact me if they don't know my account handle? Even if that leaks, the handle should be changeable, and the spam issue could be completely mitigated by having a tab for first time "message requests" separate from the normal inbox. I can't take a private messenger seriously when they require an identifier that's linked to your government-issued ID in many parts of the world.
  - _heimdall 3y ago
    > I can't take a private messenger seriously when they require an identifier that's linked to your government-issued ID in many parts of the world. Well that's a whole separate rabbit hole. Governments shouldn't be requiring something as simple as a SIM card and phone number to be directly linked to a government ID. The right to privacy is a hell of a thing and the only reason a government would require this is to be able to spy on or track everyone.
    - dns_snek 3y ago
      You're right but it's Signal's mission to provide private messaging in the face of government overreach. Even if they have a good reason for the paywall, it's so bizarre that they don't ask for $2-$5 donation via their own cryptocurrency MobileCoin as an alternative to providing a phone number.
      - 3y ago
dakial1 3y ago
Apart from Spam, phone number is also one of the few unique identifiers, which is valuable to, among other things, to ID you cross-channel and show you ads. It is easy to create a new email, but not so easy to create and keep a new phone-number.

sedatk 3y ago

Because it’s resilient against spam, and extremely easy to recover.

WhyNotHugo 3y ago
They're resilient to spam, but often impossible to recover. I had a spare SIM card that friends and family use when visiting from abroad. It's been unused for 90 days and has been deactivated. The number is lost, and irrecoverable. A friend had created a (second) Signal account with this number and can no longer log into new devices. As a more mundane example: If I accidentally drop my phone into a river, the SIM is gone forever, and so is that line. Sure, you can have a contract line which allows recovery. Depending on where you live, these can be several times more expensive than a regular pre-paid line.
- hahn-kev 3y ago
  Easy to recover your Signal account using the phone number. Not saying it's easy to recover a phone number.
  - sedatk 3y ago
    No. I believe that it's way easier to recover your phone number when you lose your SIM or change your phone (eSIM). When you lose your email password and the recovery code at the same time, your email is gone, forever. That's a huge difference, IMO. Yeah, it may not work when you buy a prepaid SIM and decide not to use it for a long time, but for billed plans, it's impossible. I've been using the same cellphone number for the last 23 years. I'd got my phone stolen, I was able to reactivate my cell the same day with another phone.
- deleted 3y ago
  [deleted]
- crazygringo 3y ago
  You don't need a "contract" for recovery, just an account. E.g. in the US, Mint Mobile is $15/mo. and is prepaid in the sense that you buy blocks of months at a time. But if you lose your SIM they'll still send you another one with the same phone number. So no, if you lose your SIM you don't necessarily lose your number, even if it's prepaid. That only happens if you're buying your SIM as an "anonymous" one-off purchase, which is not what most people do these days. Not to mention the increasing prevalence of eSIMs.
- sedatk 3y ago
  "Often impossible"? Not my experience at all. Maybe it would be more problematic with prepaid SIMs, but why would a monthly billed account get deactivated? You lose your SIM? You go to a branch, verify your identity, and get a fresh new SIM for your line. There's no more straightforward and surefire way to recover any other type of account as of today.
herbst 3y ago
Email is easier to recover and unlike a phone number you can actually own and control your email. There is no way of actually owning a phone number.
- sedatk 3y ago
  > You can actually own and control your email Email isn't easier to recover at all unless you own and control it which nobody does.
  - herbst 3y ago
    Well nobody is a bit a overstatement when thousands if not millions of people actually do run their own or partial email stack. If you don't own your email it's just as bad as a phone number, but not worse. In general emails don't just get removed and given out again if you don't interact with them for a few months. Phone numbers do usually after 6-12 months or even after 3 months for some providers. You can prepay a domain for up to 10 years or more and always setup a email server when you need it so you essentially have full control, long term. And don't get me started with possible SIM copy and stealing attacks. Things already pretty much solved with email and DMCA
    - sedatk 3y ago
      I said "nobody does" because nobody can. It's a practical impossibility to run your own email today. It doesn't even matter if you have the necessary advanced technical skills. It's just not possible. https://cfenollosa.com/blog/after-self-hosting-my-email-for-twenty-three-years-i-have-thrown-in-the-towel-the-oligopoly-has-won.html https://cfenollosa.com/blog/after-self-hosting-my-email-for-... As the owner of the same cell phone number for the last 23 years, proposing hosting your own email as an alternative to SIM cards that's available at every corner doesn't sound feasible to me at all. I don't even like cell operators, but that's just the way it is.
      - herbst 3y ago
        That's one anecdotal experience and simply not an ultimate turth. I've had a email startup (sold meanwhile, but still running) and seen all these mentioned issues and know very well how painful this can be, but far from impossible. There is a market for clean IPs for company infrastructure, that's a thing still as well. Probably I shouldn't say email is much better. But phone numbers definitely are a very weak decision for any kind of security.

cpa 3y ago

Unfortunately, spam exists and phone verification is one of the least-bad-way to ensure that the user is a real person (there are other options, but it really is one that has many advantages). Given that Signal does not have access (by design) to much information about their users when they use the service, they can't really fight spam once accounts are created. You could do spam detection on the client and privacy-preserving voting in order to ban spammers, but the UX would be very poor and that opens a whole new can of worms.

dns_snek 3y ago
This reasoning doesn't make sense to me. A spammer can make an account, but how would they contact me if they don't know my account handle? Even if that leaks, the handle should be changeable, and the spam issue could be completely mitigated by having a tab for first time "message requests" separate from the normal inbox. I can't take a private messenger seriously when they require an identifier that's linked to your government-issued ID in many parts of the world.
- _heimdall 3y ago
  > I can't take a private messenger seriously when they require an identifier that's linked to your government-issued ID in many parts of the world. Well that's a whole separate rabbit hole. Governments shouldn't be requiring something as simple as a SIM card and phone number to be directly linked to a government ID. The right to privacy is a hell of a thing and the only reason a government would require this is to be able to spy on or track everyone.
  - dns_snek 3y ago
    You're right but it's Signal's mission to provide private messaging in the face of government overreach. Even if they have a good reason for the paywall, it's so bizarre that they don't ask for $2-$5 donation via their own cryptocurrency MobileCoin as an alternative to providing a phone number.
    - 3y ago

dakial1 3y ago

Apart from Spam, phone number is also one of the few unique identifiers, which is valuable to, among other things, to ID you cross-channel and show you ads. It is easy to create a new email, but not so easy to create and keep a new phone-number.