Signal is working on a paid option to create an account without a phone number
aboutsignal.com
aboutsignal.com
I wonder if Signal missed the forest for the trees with a paid registration. I imagine privacy is the primary reason for registering without phone number and yet they ask one to register by giving them money which 99% of the case involves means of payment tied even tighter to one's identity than a phone number.
https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars."
However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud.
see:
https://web.archive.org/web/20250117232443/https://www.vice....
https://web.archive.org/web/20230519120156/https://community...
[1] https://support.signal.org/hc/en-us/articles/360007059792-Si...
The data is avilable to anyone who brute forces the pin or uses an attack on SGX which has a history of being leaky.
Note that they have been refusing to update their privacy policy after adding all the cloud storage. The fact that they don't make it extremely clear where, when, and how they store such sensitive data in their privacy policy should tell you everything you need to know about how trustworthy they are. In fact, the very first line of the privacy policy says that the service is designed to never collect and store sensitive information which used to be true, but is now a lie.
It's a bad look for a service that advertises itself to whistleblowers, activists, and others whose lives and/or freedom depend on that information being safe. They should make it very clear to people what their risks are, but as it stands today Signal's website actually misleads them.
- Folks running businesses without a business phone number
- People who want to give their kids the ability to text them, but their kids only have an iPad
- People who want to give texting capabilities to bots without having their own phone number involved
I already have a VoIP phone number through JMP and would be happy to use it for Signal, but I've read that registration isn't an option on the desktop client, even if I also have a phone number. I looked for a fork or alternate compatible client that allows registration but didn't find one.
I notice the README file for signal-cli [1] says registration "may require solving a CAPTCHA challenge", which might involve running proprietary software. I found a forum post that says this also sometimes happens on sign-in [2], which might make it difficult to use Signal without proprietary software. I might try it anyway at some point because it does say "may" :)
[1] https://github.com/AsamK/signal-cli [2] https://community.e.foundation/t/signal-and-hcaptcha/83470
Signal's privacy policy says "Signal is designed to never collect or store any sensitive information." but that hasn't been true for a long time now. They just refuse to update their policy; maybe that's them trying to warn people away from the service as loudly as they can.
https://web.archive.org/web/20230519120156/https://community...
Of course price is unknown, because it doesn’t matter, what matters is linking your real identity to signal. As I mentioned before, many times, that the main purpose of the phone requirement isn’t to fight “spam”, is to fight privacy and always have the option to expose the real person behind that account whenever needed. Most countries around the world require an ID to be issued a new phone number, rest will require payment of any sort to activate it, not to mention the ability to accurately track someone’s location only knowing their phone number, which is why it’s still used almost anywhere online as an ID, sometimes as “2FA” too, is to find you with little recourses whenever needed, and Canada now are having a unified single “login portal” for anything government wise, and as you guessed, the 2FA is only a phone number!
So Signal will try to fool some privacy conscious people with the “no phone number required anymore, we are private, woohoo!!” While linking your whole payment and KYC to that account. Hard pass.
Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society.
I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones.
This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.
Not sure about that. You do not need Google Play Store to download or update Signal. I use Obtainium to update directly via signal.org for a very long time now.
Moxie -knew- this was a path almost no one has time to use safely and liked it that way. He actively blocked attempts by the community to put Signal in f-droid, so in cases where it is the system package manager, automated signed reproducible builds can be updated painlesssly. By his own admission, moxie blocked convenient and secure community package managers because he wants most installs to happen from Google Play or the App Store so he gets analytics.
In the end Molly made it to f-droid anyway and Signal has no way to stop it, but they actively discourage the use of any binaries they did not compile and cannot track and modify at any time.
Enabling "unknown sources" does not make my device less secure. The setting is also disingenuously named: It is in fact "known sources" I am installing (not "sideloading") software from. It is just not a source Google wants to know of.
I also do not need to reproduce every new release from source. It is a signed APK I'm getting from signal.org.
If the antagonists in my threat model are so capable they could serve a tailored, signed APK from signal.org for the IP I'm using, I should absolutely not use a messenger whose identifier is my phone number, aka my real world identity AND permanent location marker. That feels absurd. A threat actor that capable could just locate me, pick me up and shake me until I unlock the device.
You are saying Molly exists and works fine, so I'm not really sure the whole problematization of Signal holds up. Does the existence of Molly not disprove your criticism that users would have to use the mainline Signal app from the Play Store?
I think it might be a good sign that criticism of Signal tends to presuppose absurdly capable threat actors. It suggests there is little low-hanging fruit left to criticize.
By disabling signature verification you open yourself up to man-in-the-middle attacks and supply chain attacks. How do you know the signal CDN account was not compromised to serve certain IP addresses different signal binaries with backdoors? Independent reproducible build signatures, like f-droid supports, are the only way out of this, which f-droid offered to do and was refused. Accountability was refused.
> If the antagonists in my threat model are so capable they could serve a tailored, signed APK from signal.org for the IP I'm using, I should absolutely not use a messenger whose identifier is my phone number, aka my real world identity AND permanent location marker. That feels absurd. A threat actor that capable could just locate me, pick me up and shake me until I unlock the device.
Do you think the Signal team signs all their Android binaries in a full source bootstrapped secure enclave that requires a quorum of signal team members to sign each release following their own deterministic builds and code review to ensure only a -single- variant of every version of Signal exists with multi-party verified code with multi-party verified signatures?
It would be weird to keep it secret if they did all this work for public safety. I do this sort of thing for most projects and am pretty loud about it so people understand they do not need to trust me.
Instead, it is likely how everyone else does it. A release engineer builds and signs it with a key they fully control, that could be coerced or bribed or given a secret court order.
That is a massive massive single point of failure for a messenger whose goal is supposedly privacy without having to trust the Signal foundation.
Their negligence in supply chain security gives them, Google, and Apple an incredible amount of power to covertly backdoor any conversation at any time, for seemingly no reason.
> You are saying Molly exists and works fine, so I'm not really sure the whole problematization of Signal holds up. Does the existence of Molly not disprove your criticism that you have to use the mainline Signal app?
Molly only helps if both sides of the conversation are using it. At that point the network effects of Signal, and the privacy loss of being forced to identify yourself, no longer makes sense. Both parties could use an open network alternative instead.
Also I personally do not use Android or iOS so I am not welcome on the Signal network at all afaict.
I am no expert, but AFAIK Android does not disable signature verification when installing from "unknown" sources. It verifies the APK is signed and unmodified on every install, and enforces key continuity on updates.
Signal uses the same signing key for both the Play Store and signal.org APK, so if you at any point installed from the Play Store, the key identity is (as far as I understood) attested by Google, and every subsequent update from either source is verified against it.
I do think that Obtainium pins the key as well, so even without Play Store: If the original install through Obtainium wasn't a manipulated version, you should enjoy the same continuity.
I get the idea about a hypothetical threat actor from within Signal poisoning my specific install. But I think I'll roll with it for now.
SimpleX has more privacy and anonymity but has worse usability.
Matrix has terrible metadata privacy and terrible usability.
Federated, can run server and have strong metadata privacy talking to your family but still talk to people on other servers publicly when you wish so you have choices to control your privacy as much as you wish.
> Signal is the best private messenger in terms of privacy and usability.
Requires proprietary operating systems, a phone number, and centralized US infrastructure where all network metadata lands in one place for much easier timing analysis. With MobileCoin, which was definitely something all users wanted and great messenger UX.
Right.
I've been annoyed and suspicious since they stopped being TextSecure and dropped support for SMS messages, and still don't buy the reasons given.
It started as offering opportunistic end-to-end encryption on "direct" (SMS) communications to help privacy. It didn't even need a data connection. People bought into it and as an Android user it was good [1]. Data then got added. First boiling frogs to the side, and then SMS support was removed completely, for what I still think are disingenuous reasons (see [1]), and the summary of it's technically impossible and not worth it. Trust us.
So what did we get? Well instead of leaking metadata to my phone provider, I'm now sending even more metadata to signal. They've put themselves in the path of every kex, every message, every group chat, every call, every read-recipt. Moxie Marlinspike is my new Santa; he knows when I'm sleeping and he knows when I'm awake.
And for something sold as privacy, what the heck is with their Linkedin-be-proud dark pattern of convincing people to upload their contacts (it's safe - honest!), or announcing proudly that "contact I haven't spoken to in 15 years and for good reason" has joined signal! Would I like to connect with the person I was really hoping had forgot I existed and was only saving the number so I could make sure I never answered it? Yes please - and I hope you told them that as well - FML... I'm also suspicious about the encrypted cloud backups, but that might just be me.
They also spent years making it difficult for people on de-googled phones, or to use it on desktop, or to run their own servers, or to run custom clients which seemed at odds with encrypt-all-the-things.
I should be happy about the mass adoption of the encryption protocol. I should see WhatsApp adopting it just before they got bought out by Facebook as a win for privacy for the common folk. I should trust it more now that there's so many eyes on it. I should be in no way suspicious of the lack serious objection the lack of LA provision by the authorities, or the fact Spy-on-You INC would continue buying the messaging platform they can no longer look at.
Things have felt off for a while and I wouldn't be shocked to see it on a future list alongside EncroChat, or Sky ECC, or Exclu or maybe even ANOM - a honeypot from the start. I can't prove anything, and don't know anything, but it sets _all_ of my "there's something wrong and I don't know what it is" senses tingling. But also I'm pretty bad at feelings. Maybe I just need to wee, or drink more water. My gut feel still insists there's a pattern to my RSA dongle's one time codes, so really you shouldn't believe a single word I've said.
[1] There were issues. iirc it didn't work on Apple devices, sms is bad for images and group chats, it broke in a messy but easily bypassed (& fixable) way and it would never work for calls. It also still leaked metadata to the phone network. And SMS is just fundamentally dead and costly - but it absolutely served a purpose.
Signal is regarded as the best mainstream messenger by many security professionals.
>they are obsessed with centralized control and user tracking, via app store stats.
Do you have any evidence they are obsessed with user tracking via all store stats? It seems reasonable to use any stats given to try to improve your app. Signal doesn't control the app stores and looking at provided stats doesn't compromise their users privacy.
"Obsessed" is a weird way to personify a company. Signal chose centralization because it's best for UX which is clear when they have 100x the users of Matrix while being more private.
>Also relying on app stores that can, with a court order
What law would legally require Apple or Google to do this? Signal doesn't rely on app stores on android as you can a signed apk download directly from them. Other apps like Element or SimpleX also are distributed on app stores.
>ship anyone an extra special fork of signal with compromised encryption, and they will never know.
This is wrong. "Anyone" can clearly not do this or it would have happened to a single app in history, and yet it has not. It would be trivially detected through reverse engineering and would only ever happen in an insane targeted attack which is not in the threat model of 99.9⁹% of people. It wouldn't be the easiest attack and authorities would use something like Pegasus instead.
>But F-Droid with independent control and reproducible builds? Unacceptable to Signal. Their stance is use proprietary partner platforms with their centralized servers so you can be tracked and backdoored at any time or GTFO.
FDroid has had terrible security practices in the past. Not sure their current status but it's not recommended by GrapheneOS.
Proprietary software is not less secure by default and can be analyzed.
>Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society.
Signal can be used without any proprietary software on GrapheneOS and by downloading Signal from their website. iOS and Android are proprietary anyway so your aren't avoiding it on those OSes.
>I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones.
Their goal is more privacy for everyone, which they are clearly quite good at achieving with their skyrocketing user counts.
>This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.
This was bad but I respect the intentions. They should have worked on Monero instead. It doesn't compromise their apps privacy, though.
Either that or they’ve been manipulated into believing this, which is actually more powerful in the long term. Either way, people should ignore these types of takes.
This post is FUD. Signal is about privacy. Nowhere do they mention anonymity as a goal of their messenger. They don't sacrifice contact privacy by using sealed sender (trustless) and by not keeping metadata (trust required that the server isn't malicious but proven in legal documents).
It barely would help an investigation to know the identity of a Signal account. All they disclose is the account creation time [1] when handed a court order.
See:
https://web.archive.org/web/20250117232443/https://www.vice....
https://web.archive.org/web/20230519120156/https://community...
Mathew Green has continued to use and recommend it.
If you have the threat model to worry about Intel SGX being cracked, you will also know to use a long passphrase.
You could also use a GrapheneOS phone with a weak pin, it makes it easier to access the data. You can use a long passphrase if you want to protect your data. It doesn't make GrapheneOS bad. Other apps can see that data themselves.
It's not outdated, it's from March 2026.
See: https://web.archive.org/web/20230616082821/https://old.reddi...
https://signal.org/blog/sealed-sender/ says "By design, it does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars."
However, today the reality is that signal collects your name, photo/avatar, and your contacts and stores it forever in the cloud.
When Signal's rule was "We don't collect and store data period" no one had to worry about any of that. That's no longer the case.
But it’s a smart technique eh? Signal is not literally perfect across every dimension. Might as well use the totally insecure alternative that governments have backdoored amirite?
If you want privacy you shouldn't use the internet at all.
Signal messaging between two iPhone users is more or similarly private and secure communication compared to what governments use.
I can't argue that Signal adoption rate hasn't been fantastic, but the paternalistic "opinionated" crypto has always rubbed me the wrong way. I remember the initial announcement claiming that binding themselves to Google Play was "more secure" because it would lead to more adoption. This is of course patently absurd when Google is one of your primary threat actors.
My "mobile phone" is not the center of my digital existence, and never will be. When I am home I leave it by the door, and use different devices - desktop, laptop, and a different pocket device for photos, afk, messaging, yardwork music, etc. So similarly, this argument that Signal is super sekoor by relying on treacherous hardware enclaves etc just falls super flat. If I'm not able to choose between competing open clients for each of my use cases, then I will always consider your system as a proprietary nuisance that I just need to mitigate my exposure to and cope with otherwise.
Open clients/protocols/ecosystems create individual freedom and choices at the edges. One size does not fit all, even if you market it as an "experience".
My mother, a 70 year old retired special education teacher, got me and my extended family (21 people) on Signal. I didn't tell her about it, I didn't encourage her to use it, I didn't step her through the process. She doesn't know how to make a folder.
Signal hasn't beaten WhatsApp (which still uses Signal protocol) due to network effects, but it is a great solution for everyday users.
One such mechanism I often lament is that closed systems attract investment dollars seeking to capture a market then eventually enshittify, and that investment can be spent on marketing/polish/etc to drive adoption. I don't think this is the dynamic around Signal though, per se.
I can envision a world in which Signal still did everything they did to promote themselves, while also not binding themselves to mobile phones, Google Play, phone numbers as identity, secure enclaves, etc - where they were just as successful at gaining "normie" adoption, while also having a free foundation. This is where my criticism is coming from.
The last I heard there was a "desktop client" but it was actually going through the mobile client. This could be out of date, although I haven't seen anything directly refuting it and I haven't bothered to dig.
To the original point, the proprietaryesque policies rooted in the authoritarian desire for centralized have severely hampered my interest/adoption, and I still don't see how policies disrupting the libre ecosystem in any way encourage adoption in the non-libre ecosystem.