It costs around $50 million every year to ensure Signal is robust and available all over the world for anyone whenever they need it.
And as a nonprofit, that money comes from all of you; the people who believe that we all deserve a place to speak freely.
And if you want to know more about the economic reality behind running high availability, actually innovative tech…
Signal is the world’s most widely used truly private messaging app, and our cryptographic technologies provide extra layers of privacy beyond the Signal app itself. Since launching in 2013, the Signal Protocol—our end-to-end encryption technology—has become the de facto standard for private commu...
@signalapp If possible, wouldn't it be cheaper and as secure for the Signal Foundation to be on the receiving end of the account verification SMS? The new #signal user:
I hereby open a Signal account. My hash is: gdhduehdbyrifhhdywuhdjcisncuqihdusjhdywofpaljwkduejgdhd
Perhaps, step 3 and 4 can be automated in a way that the Signal app creates a SMS draft that the new Signal user just has to send out after double checking.
@duxsco @signalapp Wouldn't it be much cheaper and just as secure to not have SMS or phone number as a requirement at all?
SMS confirmations would be insecure, actually, because SMS is susceptible to MITM attacks. And I didn't even mention hijacking such as SIM swapping or phishing.
What's worse is that Signal relies on Twilio, a company that has already been breached numerous times, to send out SMSes, that come to about $6 million/year, which is mindbogglingly insane and a waste of money.
Even more so, because by sending an SMS, you directly expose your actual phone number, compared to a hash that Signal stores on their servers, so anyone breaching Twilio could read the phone numbers, or if Signal gets compelled by law enforcement, and if they collect the SMSes themselves, law enforcement could also find the phone numbers.
@duxsco Yes, they'd receive the SMS, which means they'd also receive the user's ACTUAL phone number, unlike the encrypted hash Signal stores on their servers currently.
Which means, that if Signal gets compromised or subpoenaed by law enforcement, they would have to share both the hashed phone number AND the plaintext phone number, which would allow law enforcement or a nefarious third-party to directly create graphs that would identify specific users by matching the phone numbers to the hashes.
This is very dangerous, so it's not a good idea at all. Unless they decide to drop the phone number requirement altogether, they cannot switch their SMS approach without creating massive privacy issues for the user base.
@duxsco Signal already has a user's encrypted phone number, but they can't decrypt it. Your proposed approach hands Signal both the encrypted number and the plaintext number. Which, for Signal, just can't work from a privacy perspective.
They can reduce cost by de-centralizing Signal, and allowing it to federate. That and cutting compensation for employees, especially executives.
@alextecplayz I hope nobody puts their life on the line by expecting that Signal ensures anomity. I have the same hope for VPNs. They don't grant anomity.
Wouldn't it be great if Signal didn't require a phone number?
I don't answer rhetorical questions. And, as I said, my initial post was about cost reduction.
@alextecplayz @duxsco @signalapp yeah...i wonder why that isn't an option,,,but i guess it's cos they're tryna…idk limit spam or something?
a direct consequence of this is that users in Nigeria can't sign up because Twilio (or whoever) refuses to send SMSes to them: https://github.com/signalapp/Signal-Android/issues/13573
and of course, spending almost 50% of infra costs on SMSes is just…like nah cmon
I wish they had a phone-number-if-you-want-to-be-reached-easily option but they probably don't because of the social graph
[x ] I have searched open and closed issues for duplicates [x ] I am submitting a bug report for existing functionality that does not work as intended I have read https://github.com/signalapp/Signa...
@ditol @signalapp non profit finances are available here:
https://projects.propublica.org/nonprofits/organizations/824506840
Since 2013, the IRS has released data culled from millions of nonprofit tax filings. Use this database to find organizations and see details like their executive compensation, revenue and expenses, as well as download tax filings going back as far as 2001.
Since 2013, the IRS has released data culled from millions of nonprofit tax filings. Use this database to find organizations and see details like their executive compensation, revenue and expenses, as well as download tax filings going back as far as 2001.
@Orca
Thank you. At least someone does the job for Signal.
Please post in summer not before Christmas. There are 200 organizations that rember to share a donation post in December.
@signalapp I would not say "deserve", but I would say we have the "right to". And I appreciate that #Signal allows people to exercise this right.
Please make it a decentralized service. The way it is now is like Twitter versus Bluesky. Same stuff in a new package.
Allow developers to create a Signal compatible app, allow people to setup their own Signal instance.
Otherwise, you will just stay Whatsapp #2. All the eggs in one basket. One app, One instance.
@signalapp I use Signal to talk to almost every meaningful person in my life. It’s a fantastic piece of technology, run by a truly badass and altruistic organisation, and I think we are incredibly lucky to have such easy access to it.
Thank you for all your work. I have been donating monthly for 3 years, inviting others to join, and will continue to do so.
@signalapp For *anyone*? I thought it still required having a compatible smartphone and a phone number.
Or have things changed? I mean, if I can now register with and try Signal without these, I'll give it a try.
@signalapp I need Signal but it is not available to me. This is because of the phone number requirement. I'm not the only person that's unable to use Signal due to the phone number requirement. I'd love to donate to Signal because I agree with the cause & I hear endless good things about it, but I also don't want to donate for something I can't use.
Also, SMS verification is insecure, see SIM swap attack. It also does not help that SMS is plaintext, so anyone listening can see when you've made a Signal account.
@jackemled there are at least two ways around the phone number requirement for registration.
1. buy a prepaid Sim card which you only use for the registration and destroy afterwards.
2. during registration select "landline" and have Signal call you for the registration code if you have access to a landline phone.
Either way the phone number is not required anymore after initial account setup, including when transferring the account to a different device or using it on the desktop.
@jackemled the number is only used for the initial creation. Your identifier is a locally-generated ID. See: https://signal.org/blog/phone-number-privacy-usernames/
I'm on my 4th phone number since signing up for Signal.
As to your last question, I'm not sure but assume not.
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your...
@jackemled the number can (but doesn't have to) be used to exchange contact information with your partners. So no, it is not necessary afterwards.
If you need two accounts you will most likely need to use two different Sim cards or landline numbers, although you could certainly try to reuse the first for the second. Like I said, I don't know if it'll work. You will also not be able to use both identities on the same phone AFAIK.
vivami
Signal
David Sardari
AlexTECPlayz
fumnanya
Luna Lactea
Martin 
Oven🧪
𝟜𝟚𝟘 𝑠𝑖𝑛𝑐𝑒 𝟿𝟻
arutaz
Janik 
s1m0n4
Chao-c'
CpyJx 🍉
Ditol
root42
Orca 🌻 | 🎀 | 🪁 | 🏴🏳️⚧️
🇺🇦 Lauteshirn 🏳️🌈
Underfaker
Jan Vlug
Frans Veldman ⁱ ᵃᵐ ᵃⁿᵗⁱᶠᵃ🚩
utzer 
Chris Wood
Howard Chu @ Symas
njsg
fedops 💙💛