5 ms·

Signal is working on a paid option to create an account without a phone number

46 points by Cider9986 2mo ago

armchairhacker 2mo ago
Will they accept Monero?
mindslight 2mo ago
So finally a basic feature they should have had at the outset, and as a paid option? I'm left wondering if they just purchase a SIP DID in the background, solely to allocate a phone number lolol. I can't argue that Signal adoption rate hasn't been fantastic, but the paternalistic "opinionated" crypto has always rubbed me the wrong way. I remember the initial announcement claiming that binding themselves to Google Play was "more secure" because it would lead to more adoption. This is of course patently absurd when Google is one of your primary threat actors. My "mobile phone" is not the center of my digital existence, and never will be. When I am home I leave it by the door, and use different devices - desktop, laptop, and a different pocket device for photos, afk, messaging, yardwork music, etc. So similarly, this argument that Signal is super sekoor by relying on treacherous hardware enclaves etc just falls super flat. If I'm not able to choose between competing open clients for each of my use cases, then I will always consider your system as a proprietary nuisance that I just need to mitigate my exposure to and cope with otherwise.
- inigyou 2mo ago
  Opinionated is good. It means everyone gets the same predictable experience and it's easy to set up. On the opposite end of the spectrum you'd have something like IRC, which nobody uses because it's so hard to get started.
  - mindslight 2mo ago
    If we're just throwing around straw men, then a good example of "opinionated" is websites repeatedly hassling you with CAPTCHA "security checks". They're really concerned that you suffer their exact intended "experience", rather than being able to use your chosen software tools to view/analyze per your own needs. Open clients/protocols/ecosystems create individual freedom and choices at the edges. One size does not fit all, even if you market it as an "experience".
    - tapoxi 2mo ago
      We've had a lot of open systems and protocols, SIP, XMPP, Matrix, desktop Linux, Mastodon. It only gains adoption from the technologically savvy and fails to capture a regular user base. My mother, a 70 year old retired special education teacher, got me and my extended family (21 people) on Signal. I didn't tell her about it, I didn't encourage her to use it, I didn't step her through the process. She doesn't know how to make a folder. Signal hasn't beaten WhatsApp (which still uses Signal protocol) due to network effects, but it is a great solution for everyday users.
      - mindslight 2mo ago
        This relies on an implicit idea that a system being closed is required for encouraging adoption, but without actually stating a concrete mechanism for that. One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal though, per se. I can envision a world in which Signal still did everything they did to promote themselves, while also not binding themselves to mobile phones, Google Play, phone numbers as identity, secure enclaves, etc - where they were just as successful at gaining "normie" adoption, while also having a free foundation. This is where my criticism is coming from.
        inigyou 2mo ago
        That's one mechanism, but another mechanism is what I said - an open system fragments too much, making it completely unapproachable. Or even within one "vendor" if they can't make up their mind about how it should work (i.e. if they can't be opinionated) it's just as bad as being fragmented.
        mindslight 2mo ago
        If there is still one company pushing their own strongly opinionated client, how does having competing options available to power users detract from that? Like I'm not saying Signal-the-client should go away, rather that Signal-the-company who runs Signal-the-server could be accepting of third party clients, to the point where Signal was easily usable from F-Droid and whatnot. How would that undermine the mass market option?
JacobKfromIRC 2mo ago
If this works without proprietary software, it might actually convince me to use Signal. I already have a VoIP phone number through JMP and would be happy to use it for Signal, but I've read that registration isn't an option on the desktop client, even if I also have a phone number. I looked for a fork or alternate compatible client that allows registration but didn't find one.
- rudimentary_phy 2mo ago
  It's an absolute pain, but you can use signal-cli to do it (or at least you could a few months ago when I did). Just an FYI if you ever have time to burn.
  - JacobKfromIRC 2mo ago
    Good to know! Thanks. I notice the README file for signal-cli [1] says registration "may require solving a CAPTCHA challenge", which might involve running proprietary software. I found a forum post that says this also sometimes happens on sign-in [2], which might make it difficult to use Signal without proprietary software. I might try it anyway at some point because it does say "may" :) [1] https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli [2] https://community.e.foundation/t/signal-and-hcaptcha/83470 https://community.e.foundation/t/signal-and-hcaptcha/83470
- autoexec 2mo ago
  My advice is not to use any service which claims to be focused on privacy if they fail to update their privacy policy after even introducing major changes that would impact it such as moving your data into the cloud. Signal's privacy policy says "Signal is designed to never collect or store any sensitive information." but that hasn't been true for a long time now. They just refuse to update their policy; maybe that's them trying to warn people away from the service as loudly as they can. https://web.archive.org/web/20230519120156/https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096/2 https://web.archive.org/web/20230519120156/https://community...
tamimio 2mo ago
> Signal Login, one-time payment, price unknown Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to be issued a new phone number, rest will require payment of any sort to activate it, not to mention the ability to accurately track someone’s location only knowing their phone number, which is why it’s still used almost anywhere online as an ID, sometimes as “2FA” too, is to find you with little recourses whenever needed, and Canada now are having a unified single “login portal” for anything government wise, and as you guessed, the 2FA is only a phone number! So Signal will try to fool some privacy conscious people with the “no phone number required anymore, we are private, woohoo!!” While linking your whole payment and KYC to that account. Hard pass.
- lrvick 2mo ago
  This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying on app stores that can, with a court order, ship anyone an extra special fork of signal with compromised encryption, and they will never know. But F-Droid with independent control and reproducible builds? Unacceptable to Signal. Their stance is use proprietary partner platforms with their centralized servers so you can be tracked and backdoored at any time or GTFO. Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society. I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones. This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.
  - fwn 2mo ago
    > [Signal is] obsessed with [...] user tracking, via app store stats. Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now. JSON: https://updates.signal.org/android/latest.json https://updates.signal.org/android/latest.json
tomkarho 2mo ago
> The ability to register for Signal without a phone number is a frequently requested feature. I wonder if Signal missed the forest for the trees with a paid registration. I imagine privacy is the primary reason for registering without phone number and yet they ask one to register by giving them money which 99% of the case involves means of payment tied even tighter to one's identity than a phone number.
- prettywoman 2mo ago
  [dead]
- deepsun 2mo ago
  It might be done so that it only gives you a "ticket" to create an account, but they will not know what account was created.
- Yukonv 2mo ago
  Signal is private with a phone number for the purpose it serves. Its does not aim to be an anonymous chat service. For 99% of people Signal is ideal for private communication and we should not spread FUD about it not being private because you need a phone number.
  - zuhsetaqi 2mo ago
    If it’s not anonymous then it’s only a matter of time until it’ll lose its privacy …
    - Cider9986 2mo ago
      They have sealed sender which improves contact privacy.
      - Sayrus 2mo ago
        Worth a read about Signal's Sealed Sender and how it doesn't preserve its properties with receive and read receipts: https://news.ycombinator.com/item?id=46022279 https://news.ycombinator.com/item?id=46022279
drewbitt 2mo ago
Maybe I'd pay $2 for this.
expedition32 2mo ago
Lots of ranting here. Signal is a WhatsApp alternative. That's it. No money to Meta which is at the end of the day just an arm of American imperialism. If you want privacy you shouldn't use the internet at all.
- Cider9986 2mo ago
  >If you want privacy you shouldn't use the internet at all. Signal messaging between two iPhone users is more or similarly private and secure communication compared to what governments use.
HaloZero 2mo ago
Are they going to let you create bots now then? I'd love to organize me and my friend's dinner group using a bot that reads and responds to messages and pins something.
slopinthebag 2mo ago
I don’t understand the FUD and negativity I see about Signal on platforms like this. I’m not gonna argue that they are perfect but of all organizations involved in secure messaging I trust them the most. Their CEO appears sincere in her conviction for privacy and I see no reason to not trust them, at least to the extent you can trust any third party. And yet people seem to nitpick certain aspects of what they build with a level of criticality that is seemingly never applied to the alternatives. It seems like suspicious criticism. But it’s a smart technique eh? Signal is not literally perfect across every dimension. Might as well use the totally insecure alternative that governments have backdoored amirite?
- sylos 2mo ago
  There's a lot of astroturfing and psyops that work against that want any efforts in these areas to "vibe" negatively

46 points by Cider9986 2mo ago

Will they accept Monero?

So finally a basic feature they should have had at the outset, and as a paid option? I'm left wondering if they just purchase a SIP DID in the background, solely to allocate a phone number lolol. I can't argue that Signal adoption rate hasn't been fantastic, but the paternalistic "opinionated" crypto has always rubbed me the wrong way. I remember the initial announcement claiming that binding themselves to Google Play was "more secure" because it would lead to more adoption. This is of course patently absurd when Google is one of your primary threat actors. My "mobile phone" is not the center of my digital existence, and never will be. When I am home I leave it by the door, and use different devices - desktop, laptop, and a different pocket device for photos, afk, messaging, yardwork music, etc. So similarly, this argument that Signal is super sekoor by relying on treacherous hardware enclaves etc just falls super flat. If I'm not able to choose between competing open clients for each of my use cases, then I will always consider your system as a proprietary nuisance that I just need to mitigate my exposure to and cope with otherwise.

inigyou 2mo ago
Opinionated is good. It means everyone gets the same predictable experience and it's easy to set up. On the opposite end of the spectrum you'd have something like IRC, which nobody uses because it's so hard to get started.
- mindslight 2mo ago
  If we're just throwing around straw men, then a good example of "opinionated" is websites repeatedly hassling you with CAPTCHA "security checks". They're really concerned that you suffer their exact intended "experience", rather than being able to use your chosen software tools to view/analyze per your own needs. Open clients/protocols/ecosystems create individual freedom and choices at the edges. One size does not fit all, even if you market it as an "experience".
  - tapoxi 2mo ago
    We've had a lot of open systems and protocols, SIP, XMPP, Matrix, desktop Linux, Mastodon. It only gains adoption from the technologically savvy and fails to capture a regular user base. My mother, a 70 year old retired special education teacher, got me and my extended family (21 people) on Signal. I didn't tell her about it, I didn't encourage her to use it, I didn't step her through the process. She doesn't know how to make a folder. Signal hasn't beaten WhatsApp (which still uses Signal protocol) due to network effects, but it is a great solution for everyday users.
    - mindslight 2mo ago
      This relies on an implicit idea that a system being closed is required for encouraging adoption, but without actually stating a concrete mechanism for that. One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal though, per se. I can envision a world in which Signal still did everything they did to promote themselves, while also not binding themselves to mobile phones, Google Play, phone numbers as identity, secure enclaves, etc - where they were just as successful at gaining "normie" adoption, while also having a free foundation. This is where my criticism is coming from.
      - inigyou 2mo ago
        That's one mechanism, but another mechanism is what I said - an open system fragments too much, making it completely unapproachable. Or even within one "vendor" if they can't make up their mind about how it should work (i.e. if they can't be opinionated) it's just as bad as being fragmented.
        mindslight 2mo ago
        If there is still one company pushing their own strongly opinionated client, how does having competing options available to power users detract from that? Like I'm not saying Signal-the-client should go away, rather that Signal-the-company who runs Signal-the-server could be accepting of third party clients, to the point where Signal was easily usable from F-Droid and whatnot. How would that undermine the mass market option?

JacobKfromIRC 2mo ago

If this works without proprietary software, it might actually convince me to use Signal. I already have a VoIP phone number through JMP and would be happy to use it for Signal, but I've read that registration isn't an option on the desktop client, even if I also have a phone number. I looked for a fork or alternate compatible client that allows registration but didn't find one.

rudimentary_phy 2mo ago
It's an absolute pain, but you can use signal-cli to do it (or at least you could a few months ago when I did). Just an FYI if you ever have time to burn.
- JacobKfromIRC 2mo ago
  Good to know! Thanks. I notice the README file for signal-cli [1] says registration "may require solving a CAPTCHA challenge", which might involve running proprietary software. I found a forum post that says this also sometimes happens on sign-in [2], which might make it difficult to use Signal without proprietary software. I might try it anyway at some point because it does say "may" :) [1] https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli [2] https://community.e.foundation/t/signal-and-hcaptcha/83470 https://community.e.foundation/t/signal-and-hcaptcha/83470
autoexec 2mo ago
My advice is not to use any service which claims to be focused on privacy if they fail to update their privacy policy after even introducing major changes that would impact it such as moving your data into the cloud. Signal's privacy policy says "Signal is designed to never collect or store any sensitive information." but that hasn't been true for a long time now. They just refuse to update their policy; maybe that's them trying to warn people away from the service as loudly as they can. https://web.archive.org/web/20230519120156/https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096/2 https://web.archive.org/web/20230519120156/https://community...

tamimio 2mo ago

> Signal Login, one-time payment, price unknown Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to be issued a new phone number, rest will require payment of any sort to activate it, not to mention the ability to accurately track someone’s location only knowing their phone number, which is why it’s still used almost anywhere online as an ID, sometimes as “2FA” too, is to find you with little recourses whenever needed, and Canada now are having a unified single “login portal” for anything government wise, and as you guessed, the 2FA is only a phone number! So Signal will try to fool some privacy conscious people with the “no phone number required anymore, we are private, woohoo!!” While linking your whole payment and KYC to that account. Hard pass.

lrvick 2mo ago
This is why as a security engineer and researcher even I do not have a Signal account. My conversation with Moxie about Signal convinced me that Signal cannot be trusted as they are obsessed with centralized control and user tracking, via app store stats. Privacy assurances come from enclaves internet randos can freely manipulate as they chose not to implement full source bootstrapped remote attestation. Also relying on app stores that can, with a court order, ship anyone an extra special fork of signal with compromised encryption, and they will never know. But F-Droid with independent control and reproducible builds? Unacceptable to Signal. Their stance is use proprietary partner platforms with their centralized servers so you can be tracked and backdoored at any time or GTFO. Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society. I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones. This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.
- fwn 2mo ago
  > [Signal is] obsessed with [...] user tracking, via app store stats. Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now. JSON: https://updates.signal.org/android/latest.json https://updates.signal.org/android/latest.json

tomkarho 2mo ago

> The ability to register for Signal without a phone number is a frequently requested feature. I wonder if Signal missed the forest for the trees with a paid registration. I imagine privacy is the primary reason for registering without phone number and yet they ask one to register by giving them money which 99% of the case involves means of payment tied even tighter to one's identity than a phone number.

prettywoman 2mo ago
[dead]
deepsun 2mo ago
It might be done so that it only gives you a "ticket" to create an account, but they will not know what account was created.
Yukonv 2mo ago
Signal is private with a phone number for the purpose it serves. Its does not aim to be an anonymous chat service. For 99% of people Signal is ideal for private communication and we should not spread FUD about it not being private because you need a phone number.
- zuhsetaqi 2mo ago
  If it’s not anonymous then it’s only a matter of time until it’ll lose its privacy …
  - Cider9986 2mo ago
    They have sealed sender which improves contact privacy.
    - Sayrus 2mo ago
      Worth a read about Signal's Sealed Sender and how it doesn't preserve its properties with receive and read receipts: https://news.ycombinator.com/item?id=46022279 https://news.ycombinator.com/item?id=46022279

drewbitt 2mo ago

Maybe I'd pay $2 for this.

expedition32 2mo ago

Lots of ranting here. Signal is a WhatsApp alternative. That's it. No money to Meta which is at the end of the day just an arm of American imperialism. If you want privacy you shouldn't use the internet at all.

Cider9986 2mo ago
>If you want privacy you shouldn't use the internet at all. Signal messaging between two iPhone users is more or similarly private and secure communication compared to what governments use.

HaloZero 2mo ago

Are they going to let you create bots now then? I'd love to organize me and my friend's dinner group using a bot that reads and responds to messages and pins something.

slopinthebag 2mo ago

I don’t understand the FUD and negativity I see about Signal on platforms like this. I’m not gonna argue that they are perfect but of all organizations involved in secure messaging I trust them the most. Their CEO appears sincere in her conviction for privacy and I see no reason to not trust them, at least to the extent you can trust any third party. And yet people seem to nitpick certain aspects of what they build with a level of criticality that is seemingly never applied to the alternatives. It seems like suspicious criticism. But it’s a smart technique eh? Signal is not literally perfect across every dimension. Might as well use the totally insecure alternative that governments have backdoored amirite?

sylos 2mo ago
There's a lot of astroturfing and psyops that work against that want any efforts in these areas to "vibe" negatively