I didn’t expect to get cancer from a website called itsfoss.com, but I guess it’s time to put an adblocker on my tablet, too.

Adblocker is the minimum requirement for modern web.

Much better.

Firefox+unlock+unlock paywall extension is the bare minimum to navigate.

Brave as fallback if something breaks.

You mean they want to identify you from your credit card instead of your phone number? Bah.

Could possibly use a gift card?

IDK maybe that’s possible but I’d rather avoid Signal, except maybe for a self hosted fork.

I’ll call it right now and bet they wont 3DS supported cards. So no giftcards and no prepaid cards.

I use signal all the time but even I will admit some of the things they do don’t scream privacy conscious to me. This is one of those things.

For instance, no support for their shitty crypto no one ever uses? You know, the one they chose over an actual battle tested one like Monero? (Its basically a pump and dump, look at the all time chart on coingecko for Mobilecoin went from like $50 a coin to 0.07¢ now)

Nope. Just traceable cards or traceable phone numbers. Interesting choice. The lack of self hosting is also an interesting choice.

Way better than Telegram or Facebook or WhatsApp for sure for sure and I get all my friends to use signal but I do have doubts sometimes when I start to notice stuff like this.

People will get on here and say “only FEDS promote fud about signal!!” But honestly ask yourself if what you just read really aligns with privacy in any way. A lot of it does not.

Even the same people who hate crypto actively use signal which did its own pump and dump scheme. Its odd. And I wish an actual competitor would come out that isn’t based in another surveillance state like the UK.

Literally all the alternatives are from surveillance States. Every single one. All of them.

Idk man, I have doubts a lot.

And if it does support gift cards and prepaid cards?

This seems to me like a mild annoyance for someone using it legitimately, but a bigger barrier for scammers trying to get accounts in bulk. Sure they can get a lot of accounts still, but it’ll no doubt be lessened.

If they were going to do that they would not have just made an announcement about google pay’s “zero knowledge proofs” being the only way to pay it.

It becomes more than a mild annoyance it becomes borderline suspicious to be quite honest. None of the other private app competitors have ever needed a phone number or payment and a lot of them let you self host too something signal is vehemently against.

Idk man. The phone number thing I could kind of understand but now the only way around it is a google pay payment? What the fuck is that? The fact that they won’t even accept their “super private” shitcoin is a huge red flag here to be completely honest. Just gonna call a spade a spade. Its a very strange choice from a privacy oriented service.

Its like using the Tor browser or something but you have to do a “zero knowledge proof” payment through google pay to access it. Would that make you feel comfortable? No? Then why are we acting like its ok for signal?

It’s weird.

I have never trusted them, I always considered many of Signal’s decisions highly questionable, and I think they are either pressured into them by the US government, cooperating in what they think are limited and carefully-implemented ways while claiming and perhaps even believing they are fighting the good fight, or maybe they are just a psyop honeypot to begin with. I cannot trust them, and if they truly wanted me to, they would not do so many things that require me to trust them.

Their original post says this:

Can I buy an account on a device that has no Play Services?

Not yet. We have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.

I do not think this is suspicious. They are starting where most of their users are, and whether we like it or not, is play services.

Their implementation with play services seems to be correct if it were done for privacy, though we can’t ignore the fact it’s still supporting Google.

The fact that they won’t even accept their “super private” shitcoin is a huge red flag here to be completely honest.

Nobody uses this. Signal also never processes a card. You have to transfer money from another crypto. That is not user friendly, and people would be pissed about this implementation too.

None of the other private app competitors have ever needed a phone number or payment and a lot of them let you self host too something signal is vehemently against.

The open source decentralized projects? Those a great, and important, but they are different. Signal is balancing security with convenience. Most average people would give up the moment it asked for an instance. Signal is easy to use, even for the tech illiterate. It works just like their other messaging apps, but only because it’s centralized.

Its like using the Tor browser or something but you have to do a “zero knowledge proof” payment through google pay to access it. Would that make you feel comfortable? No? Then why are we acting like its ok for signal?

It’s about where the users are. Most tor users are going to be on a desktop device, probably Linux, maybe Windows, then everything else. A very small percentage are going to be on Android. It would be very weird to be on a Linux device in a Tor browser being sent to Google services for payment. Signal is a mobile messaging app, which means basically two ecosystems. I assume they started with play services because of number of users and/or the fact Google already had ZKP payment as an option.

And ZKP isn’t new, and it is real, and it’s exactly how more things should be implemented.

Look at how many scammers use WhatsApp, and how much spam there is. Signal is clearly trying to make it tje best user experience they can without compromising security. This is just one step further, and it’s only the first payment method, not the last.

But why not also accept crypto, like Bitcoin? That way actual privacy conscious people can just convert monero to bitcoin for a trustworthy decentralized private payment

The way I see it, that’s next. This feature is in beta, and I imagine they wanted to rollout the payment method that would be most used, or maybe easiest to implement first for testing. They have already officially said more payment methods will come, but they have not said what those payment methods will be. Given they already have their own crypto, that will almost definitely be one of the options

“That’s next” given that it took them years to make phone # optional, I’m not optimistic that this will happen anytime soon. Not to mention their current payment method requires play services, which has probably already de-anonymized the user

It tooks years to implement the whole functionality. They also weren’t working on this feature the whole time, but it was on the list. Adding another payment method isn’t the same.

Not to mention their current payment method requires play services, which has probably already de-anonymized the user

I agree it’s not great to require play services, but it isn’t going to always be the only option. It’s in beta, so clearly isn’t finished.

The users are not de-anonymized, they use a ZKP transaction (en.wikipedia.org/wiki/Zero-knowledge_proof). We don’t need to have to trust Google, it’s the whole point of a zero trust model. Zero trust is required

When I talk about de-anonymizing the user, I mean that Google Play has already identified the user of the device. Then they can spy on the Signal app to try to identify the Signal account.

But also, regarding ZKP, afaik their ZKP doesn’t account for timing attacks. Signal can log when each account was made, and collude with Google to figure out which payments correspond to which accounts

Yeah… Combine all that with being based in the US under the fascistic Trump admin, and I’m considering trying to get my friends and family to swap to a self-hosted XMPP server or something, but there are a couple elderly relatives that might complicate that.

Smh, now I have to get a Nintendo credit card?

(if you don’t get it, read the above comment again)

I miss Wikr before it enshittified

Very few online services accept. I’ll eat my hat if I’m wrong and hell I’ll sign up with one if they take them, but I sincerely doubt they will accept these.

You can, I was able to sign up on a tablet running Lineage OS with GApps that had credit loaded from a Play Gift Card

Not me. But the author.

They claim it’s “zero knowledge” proof through Google pay, meaning that Google will know you paid Signal, and Signal knows you paid them, but there is no link between the two that uses your PII payment info to identify the Signal account. I’m inclined to believe them.

Unless you wait a good while to use what you paid for (if that’s even possible), then I doubt it’d be hard to connect the dots. Never mind connecting transaction records.

It’s the exact same privacy protection as signing up with a phone number.

Not quite. With a phone number a random phone provider knows your identity. They do not get notified you are signing up for Signals. Google doesn’t know you signed up with that phone number for Signals either. Depending on your country and how these details are handled there may not be an easy way to lookup who you are from a phone number.

There’s obvious downsides to the phone number use, of course, but saying it the same in terms of privacy than this, doesn’t feel correct.

“Your Signal code is…”

There’s identical security for the payment too. Assuming you trust Signal, they don’t keep a record of it tied to your actual account the same with a phone number.

Oh, also, they’re just using Google Play for now. They’ll definitely be adding a generic CC option.

Could use a refillable credit card.

Google will know you paid Signal

That’s not ok either! Just stop playing these games and stop obstructing self hosting. When they come to round up all the Signal users, they won’t care what account belongs to who. So there should be no database that identifies the users.

If “they” get to the point of rounding up all Signal users, not using Signal will not prevent you from being rounded up.

First they came for the Treema users…

If Google and Signal collude can they link payments to accounts via timing attacks? My guess is yes

It is almost as if they have no fucking clue who their customers are. Hilarious.

Hopefully in the future they will offer the ability to pay with Monero.

“I have $3”

Why does a service that no longer does SMS want your phone number?

Secret CIA Operation. $3 is traceable through payments

Not if they let you send cash (although that is, alas, unlikely).

Digital should be monero or something

that is another issue, their reason is that it helps prevent people create unlimited spam accounts I think? It also helps to ease the transition from WhatsApp. It’s a compromise I can live with

Deltachat and Jabber, both decentralized encrypted messaging apps (as opposed to Signal, which is centralized), don’t even require an email to create an account, let alone a phone number or payment.

What are the practical differences between them?

Deltachat has an extremely smooth on boarding process and is the same app for all platforms, but it cannot do voice calls or screen share (you can leave voice messages though).

Jabber/XMPP generally has a less smooth UX, and different apps across different platforms (except the Movim client, which is a web app that works on all platforms, but doesn’t do reliable notifications on mobile).

With the Movim client, Jabber/XMPP is basically a complete Discord and Signal replacement. It can do group video calls, screensharing with audio (only with chromium based browser for now), as well as voice and text channels under different servers.

Audio and video calls are available in delta chat :)

Woah, how did I miss that?! Thanks for the heads up :)

It looks like it still doesn’t do group calls, but 1 on 1 is still great to have for sure.

Delta chat is also less secure than Signal because it runs on standard email servers, which inherently leak more tracking metadata (like sender and recipient addresses) and lack Signal’s advanced privacy features like Perfect Forward Secrecy.

Regarding metadata, you may want to read the FAQ.

It will have forward secrecy after they finish implementing Autocrypt2.

A person also has to determine their security threat level. If they think a state actor may take a personal interest in them, then they’re probably best using in-person offline communication. If they must communicate online, then IMHO I don’t think Signal is a good choice due to it being centralized (everything goes through their servers, and they are a single entity making them easier to infiltrate or coerce by governments) and requiring you to link a personally identifying number or credit card.

If they just don’t want a corporation datamining them to sell to advertisers, Deltachat is more than good enough.

These addresses are randomly generated addresses which you can rotate whenever you want which seems better than giving signal your phone number or payment information

From the official announcement

Can I buy an account on a device that has no Play Services?

Not yet. We have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.

Ok so given how long it took them to allow an alternative to phone numbers, it will probably be at least 5 years before you can pay using a de-googled phone. I really don’t understand what’s so hard for them to accept crypto, they already do for donations. Smells like government involvement.

That’s shitty, they have some cryptocoin don’t they? Sure it’s not great but if you exchange from some other currency and pay fast there’s not much risk

Yup they have their own crypto but they won’t accept it for creating accounts.

if you exchange from some other currency

Exactly. I can see why they probably won’t accept Monero for regulatory reasons, but just accept bitcoin so I can use a swap and pay with my monero

Seriously, if the point is to just have some monetary cost, why not just accept it as a bit of crypto?

Because setting up crypto portals at scale, and most importantly so they can’t easily be hacked and drained or used for money laundering, is not a simple matter.

By paying through a bank card, you are identifying yourself. So this means dick unless you can do it with an anonymous gift card thing, but even then, they trace that shit a lot more than you may think.

What do you think a phone number is

Signal is about privacy, it’s never been about anonymity. The purpose is to encrypt your communication, not hide who you are.

Signal is not trustworthy, because they ban unofficial clients.

Why is Signal always doing weird shit?

Signals reliance on phone numbers is my biggest problem with it. I don’t understand why they can’t move away from them entirely.

You can already today share a username instead of a phone number, this is just extra for signup.

Still need a phone number to sign up though, or pay.

Just use a secondary number not connected to you. It’s not that difficult.

You need something to limit spammers using the service to sign up a million accounts

Yeah why am I donating $10 a month every month for them to come up with shit like this. Google? Really? Now I question what else is going on behind the scenes.

If Signal had zero value to the three letter agencies, they probably wouldn’t be allowed to exist. Sucks, but I wouldn’t trust them much more than anything else American.

Honestly, for super secret communications, leave your phones at home and meet up irl.

if you’re donating, you should know they have a system to collect payments zero-knowledge (which they’ll also use for the $3)

Funny, cause they accept crypto for donating. Which they don’t use for the $3 fee.

it gets worse

The feature currently requires Google Play Services, as payments run through the Play Store, making it such that devices without Play Services cannot access it

I would rather give Signal my phone number than use a smartphone with Google services.

… don’t they know that as soon as you use your Google account you’re ID? Like doesn’t that defeat the whole purpose?

No, they DO know that.

The only way to communicate anonymously across the internet is Tor.

-in the arms angels plays- Sarah m: “for only zero dollars, we could all migrate to reticulum and really inconvience the rich.” -slideshow of rich reptiles plays- “May you fiiiiiind some comfort here…”

All the purist here would rather use matrix to send messages to themselves…

Signal is an amazing alternative to WhatsApp and one of the few apps you can actually get non-techies to install. If it’s not for you then don’t use but don’t say stupid shit like “why would anyone use it? it’s not perfect!”.

Actually I was installing signal in my relatives phone to replace the sms app, they used it even without knowing… I understund why they remove the sms part but it was a sad day for me, now noone from my “normies” use it anymore

Signal is as good as it gets for normies

you all are normies

There is no such thing as “perfect”. They will always find something to complain about.

What about Matrix is harder than email?

The getting people to use it.

Took me months after issueing my friends and family accounts for most of them to get the concept and install something to log into (I still get complaints about Element, and thats one of the nicer ones).

For mobile apps, if its not seamlessly integrated into their existing accounts or they have to remember a new password, you might as well have given them a bag of spiders.

The fact that every OS comes with pre-installed email client and everyone knows at least 3 free email providers but most people have no idea what matrix even is?

Those people have no idea about Signal either.

for me, it’s that it breaks randomly. all. the. time.

With element, it was constant across two different homeservers I tried. Either logging me out, or just randomly unverifying my client and failing to decrypt messages.

with fluffychat, it’s been more stable, but recently it’s taken to logging me and a friend of mine out at random just like Element. After logging back in, it constantly tells me there’s an error fetching the notification (even though I’m not launching from a notification) due to the account not existing.

The protocol feels incredibly fragile, since it seems every implementation trips over the same footguns, and it makes the user experience horrible.

delta.chat/en/download <---- It is the over socialised turdherd that is the problem. It is a mental thing mostly and not a software issue.

Hobestly, just migrate to simplex. It has accounts down. Create how ever many. Solves phone stalking as well.

How many of your contacts are on simplex?

My main problem with switching over. It’s easier for people to use signal because it’s popular.

Convinced the 5 important ones. I’m not popular. It was hard work. Gotta start somewhere.

I’ve found one willing to switch. Those are poor stats indeed.

Hmm, I bet there’s a hidden 50 cent surcharge. Damn it, Loch Ness Moster, I ain’t giving’ you no tree fiddy!

Oh God dammit, it’s nessy again.

I gave him a dollar to make him go away.

Well, of course he’s not gonna go away! You give him a dollar, he’s gonna assume you got more!

Oddly enough, once you make that three fiddy payment signal will now potentially have a payment method linked to your account.

If this is true that payment method can essentially be tied to a identity.

I suppose the reason they are choosing to do this is to prevent a influx of bot accounts and spammers/scammers.

And if you are worried about Google’s involvement in this, Greyson Parrelli of the Signal team points out that the payment runs through the same zero-knowledge proof setup it uses for donations.

Looks like there is some way of decoupling the payer identity from the signal user

I figured they must be doing something along those lines, thanks for sharing!

What zero-knowledge god damn? You are submitting your payment details, anything after that is pinky promise.

I was about to say, I feel like it’s easier to get a burner phone number to sign up with than to find an anonymous way of paying them 3 bucks

Could you all just stop trying to flee corporate greed jumping from one company to another? We already have XMPP, Matrix and other descentralized solutions.

I have this in Threema. Thank you

Instead of asking for your mobile number, Signal will ask you to pay a one-time $2.99 fee via Google Pay, and the exact pricing depends on your device’s region.

Google is a baby skull crushing weapons contractor. HAHAHA hopeful slaves hahahahah… yoyoyoyoy yo it is called delta chat boyeeee delta.chat/en/download phuck signal