And everybody does that, either phone number or email.
The only software I could find for anonymous communication was old Polish communicator http://gg.pl which uses arbitrary numbers as identifiers
I understand that startups are scared that they won't be able to build up userbase from scratch but come on! Discord and Slack did it.
It's pretty simple - user friendliness and sign-up friction.
Signal's main market is not us HN user tech bros who want (pseudo)anonymity. It's main market is closer to regular people, the same people who are fine with using WhatsApp or Facebook messenger or whatever, with their phone number.
They also want it to be as easy as possible for new users to sign up. Simply enter your phone number and boom you have a signal account. With email the sign up process is not insanely difficult - but its still more steps than phone signup for the regular person.
One counterpoint to using phone numbers: In China mobile phone numbers are almost universally enforced as your digital identifier because it makes surveillance extremely easy for a government while making it relatively hard for platforms themselves. Registering for a phone number mandates an ID check at the point of the service provider. This means that with a phone number based login, (1) you can be largely anonymous to platforms as you can have > 1 phone number, (2) you have 2fa built in automatically, but also (3) that the government can easily figure out who owns what accounts because your accounts are directly linked to your phone(s) and your phone(s) directly to you.
It would be a great step forward if Signal moves towards alternate verifications that don't involve phone numbers...
They just wanted to piggyback on already existing network of people contacts.
Standard startup "growth hack".
,,To Signal'' it is a graph of random numbers.
Taking a new device into use was as simple as authorizing it from one of your existing devices. All the data would sync over and be encrypted with a device specific key locally. And you could disable that key from any of the other devices.
Too bad that company more or less failed. They never really figured out a business and the zoom acquisition looked more like an acquihire than a long term commitment to the product. But it's a good design that is worth copying.
Decentralisation and all that - again, other people.
I remember looking into this a few years back and the only issue I found was that the company that owns it now itself wasn’t entirely trustworthy.
Spam protection is hard. Forcing to use phone numbers is a "easy" protection against spam. It's harder to get thousands of SIMs than thousands of usernames.
I don’t use slack but the few times I tried to use discord it always said something suspicious was going on and asked me for my email (needless to say I immediately closed the window) I wasn’t using vpn, only my default ublock and Firefox built in track blocking.
Phone numbers though are terrible because they're tied to countries, their security depends only on your carrier, you can't run your own carrier to take it into your own hands, and sending SMS costs money. Also the underlying interconnection networks like SS7 aren't secure at all and rely on trust.
TLDs are managed by governments or government-adjacent organizations. Domains are managed by the TLD manager. Email addresses are managed by the domain manager.
I've never had a phone number or a domain name taken from me, but I've heard of more cases of the latter than of the former.
I've heard stories of how a US carrier issued a replacement sim card to a fraudster. I've also heard stories of how a Russian carrier intercepted someone's SMS messages to break into their Telegram account.
SIM swapping is a big problem, but that is more equivalent to DNS hijacking of your domain than to the concept of legal/contractual "ownership" or rights to operation.
But semantics aside, the important question is how easy would it be for a malfeasant to interfere with your quiet enjoyment of your public identifier (phone number or email address). SIM swapping is way too easy. Domain hijacking isn't hard either, and sometimes one attack can leverage the other.
> Can you send SMS to a regular number with this?
Why would it do that? Every phone has perfectly good sms app.
What would that even mean? Using sms as a transport layer? Or making messages passed through internet look like pseudo sms messages to someones phone number?
https://support.signal.org/hc/en-us/articles/360007321171-Ca...
Something like Google Fi can provide a web-based client for your SMS (which works on any device and doesn't require cellular) because they know your virtual SIM and can emulate it as needed. But I don't see how Signal could pull that off.
To avoid splitting one's messaging threads between two different apps.
> Every phone has perfectly good sms app.
Eh, I find the default Android SMS app to be lacking. I can't organize threads or mark messages as unread. You know, basic stuff that email apps figured out a long time ago.
If I remember correctly, Signal was first explained to me as a secure SMS app. That is it stores your SMS's more securely than the stock apps did... and if you were messaging somebody who also used Signal, then you'd be upgraded to an end-to-end encrypted message.
That said, now I'm on iOS, it doesn't let me do that, so I only use it for contacts with Signal.
If I have this level of trust with someone they are about at level of adding them as a friend on Facebook. Who knows, I even might invite them on Facebook sooner than I decide to give them my phone number.
> what's the big issue with them having your number?
Seriously? With my number you can harass me endlessly with phonecalls, text messagers, registering for various services that will harass me basically forcing me to abandon this phone number and notify all of my valuable contacts of the number change.
Hell, they might even plaster town with my number with advert saying "Win 50$ in Chewbaca noise contest by subitting your best attempt at that number." as one creative asshole did to some poor girl.
> There's nothing stopping your interlocutor from leaking all of the messages you send to them
That way less of a problem if I haven't doxed myself in those conversations. All he will publish is some conversations he had with someone.
Yes that's exactly what Signal is for. Talking to people you would otherwise talk to on facebook messenger but you rather not have facebook engineers be able to read your personal conversations.
I don't care if you seen my dick if you have no way of knowing it was mine.
Do you want me to continue?
Yes actually.
The problem I'm seeing here with the responses is that people are only thinking of "one move." That first move is creating a anonymous username. Yay. Easy. Now here's the problem. How do I share that while staying anonymous? What conditions do I need? If I can only have one username for all of Signal, does that create a bigger problem? There's a few more "moves" for you and these are what I'm looking for answers to.
But some people are happy messaging people based on the phone number, because everything else is too cumbersome. Different people have different threat models, and one chooses the best UX for their threat model. For millions of people (maybe not you), apparently it is Signal.