Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.
You cannot keep all 3 of "no gatekeeping" - "anyone can message anyone" - "low spam".
I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.
https://github.com/signalapp/Signal-Android/commit/7da3357b5...
For an org that pretends to care about privacy you'd imagine there'd be a way to avoid, you know, the biggest privacy invader on the planet.
Just allow monero payments or something. Alongside Google play for the sheep that want to use that.
This is the right solution. A one-time payment in crypto, say $5, ought to be enough to prevent spam. That being said, Signal has demonstrated (when presented a warrant) that they do not store phone numbers. If I remember correctly all they stored was an account ID and a UNIX timestamp such as the last login.
How do they perform address book matching without an phone number? It just being accessible by SGX does not really count as not storing it.
Problem with phone numbers is they are to short to store as a hash, since you can brute force the sha256 of an phone number in a trivial amount of time on a single consumer device
In terms of what they do with big data there's more evil parties like Palantir but data abuse starts with collecting it, and I would object to it even if Google promised to only use it for good. For me my privacy is already violated when my data is collected, not just when it's abused. And I do consider Google's use of that data abusive, just not in the worst ways.
I've literally registered a Signal account on one of the free SMS sites floating around. Why would spammers choose the payment route over phone numbers? They would just choose the one that's cheaper.
They probably avoided Monero to not attract the additional scrutiny. They don't even accept donations in Monero.
Signal is not robust for metadata protection. Neither do they advertise anonymity. They take steps to protect metadata but it's nothing compared to SimpleX.
If it's "the feds", then how? There's reproducible builds on all platforms except iOS so we know the source code is what's running on our devices. Can you point to the code where the E2EE is compromised?
They are the largest messenger that has E2EE backups by default.
To be clear, I use signal pretty heavily, but that's because my threat model doesn't really include competent .us.gov actors. I don't think that they'd either prove they're doing this or go through the trouble of parallel construction over anything in my messages or who I'm talking to.
If you can convince as many of your enemies (the american people who politically organize against them) to use the same platform, your job becomes easier than having to ETL from 20 different privacy platforms..
To be honest, I use signal, I have nothing to hide but it is useful in that nobody can spoof me (easily). I even talk to my 60 year old mother on signal. It has it's uses. But the EFF is definitely a federal psyop to get people using tools and techniques they control.
Just look at the people who created TOR, they're all feds. All these projects are funded by feds. These tools are advertised in CIA recruitment campaigns, they are literal weapons to circumvent nation state firewalls and deliver psychological weapons, overthrow governments or allow covert recruitment of foreign traitors.
This is a known strategy of the Kremlin, by the way. They fund opposition groups which protest them, and then leak the fact of that funding so that people who are genuinely upset at the Kremlin get confused about who is captured opposition and who is legitimate.
It can be a signal in some cases, but funding sources are not a reliable way to make a conclusion about a group's motivations.
Signal is for protecting opposition groups that help in regime change operations.
Why would people embrace privacy nihilism? The Signal shills also agitate against gpg/PGP, so we know it is secure and you should use that instead.
SMS registration flow is trivially blocked in places where regimes are controlling telecom infra. And Twilio is unreliable in dozens of places for non-political reasons. Signal is very first-world centric from this point of view.