Signal’s new beta introduces numberless registration for new users.
It costs a one-time fee of $3, which is paid anonymously and not linked to your Signal account.
It also adds support for two-factor authentication for numberless accounts.
Registering without a phone number is easy, but users must store their ID and password safely in a password manager. Since no phone number is attached to the account, if a user loses either the ID or the password, they will be completely locked out and have no way to regain access. The app now also supports adding two-factor authentication for numberless accounts.
After registration, users can create a username to share with others. They can also opt not to create one. However, in that case, they can only participate in chats they initiate, because other users will have no way to search for them to start a conversation.
Can someone (such as Signal itself) please explain how the “anonymous” payment is supposed to work? Concisely but in sufficient detail to understand the principle I mean, without just saying “zero knowledge” and doing a bunch of hand waving when you get to the complicated part.
TL/DR: You can read about it in detail here: https://eprint.iacr.org/2019/1416.pdf
According to PrivacyGuides, regarding this announcement:
The payment uses the same zero-knowledge proofs as Signal’s donation system, so they won’t be able to correlate your payment info to you.
According to Signal’s support article:
Is my payment information linked to my Signal account?
No. Your payment information is not associated with your Signal account. Using the anonymous credential scheme that we introduced for Signal private groups, clients make payments and then associate a badge to their profile such that the server can authenticate the client is in the set of people who made a payment, but doesn’t know specifically which payment it corresponds to.
You can read about it in detail here
Not exactly it seems, but we can read there about something which is apparently related to it in some way. If I ever manage to figure out which 3 of the 58 pages of mathematics paper it would take to explain the basic flow of the protocol, maybe it will become clear.
Looks like it currently requires Google play. Not sure how it works on iphone.
Can I buy an account on a device that has no Play Services?
Not yet. We have plans to add more payment methods, but currently only offer Play Store in-app payments, which requires Play Services.
I suppose you’d be buying some kind of generated token that doesn’t correspond to your account ID in any way, then doing some fancy math to prove to the Signal servers that you have such a token without revealing which one it is, while at the same time preventing the same token being used more than once. Given that there’s no need to tie it to any real-world attributes of the user (i.e. this is not like “age verification”) it seems like this should be possible, but I’m curious about the details.
I’ve heard this schema described theoretically, but never seen an example in production, though i also don’t really seek it out
HAPPY to pay the price. Much cheaper than a phone number
