It costs around $50 million every year to ensure Signal is robust and available all over the world for anyone whenever they need it.
And as a nonprofit, that money comes from all of you; the people who believe that we all deserve a place to speak freely.
And if you want to know more about the economic reality behind running high availability, actually innovative tech…
Signal is the world’s most widely used truly private messaging app, and our cryptographic technologies provide extra layers of privacy beyond the Signal app itself. Since launching in 2013, the Signal Protocol—our end-to-end encryption technology—has become the de facto standard for private commu...
@signalapp If possible, wouldn't it be cheaper and as secure for the Signal Foundation to be on the receiving end of the account verification SMS? The new #signal user:
I hereby open a Signal account. My hash is: gdhduehdbyrifhhdywuhdjcisncuqihdusjhdywofpaljwkduejgdhd
Perhaps, step 3 and 4 can be automated in a way that the Signal app creates a SMS draft that the new Signal user just has to send out after double checking.
@duxsco @signalapp Wouldn't it be much cheaper and just as secure to not have SMS or phone number as a requirement at all?
SMS confirmations would be insecure, actually, because SMS is susceptible to MITM attacks. And I didn't even mention hijacking such as SIM swapping or phishing.
What's worse is that Signal relies on Twilio, a company that has already been breached numerous times, to send out SMSes, that come to about $6 million/year, which is mindbogglingly insane and a waste of money.
Even more so, because by sending an SMS, you directly expose your actual phone number, compared to a hash that Signal stores on their servers, so anyone breaching Twilio could read the phone numbers, or if Signal gets compelled by law enforcement, and if they collect the SMSes themselves, law enforcement could also find the phone numbers.
@duxsco Yes, they'd receive the SMS, which means they'd also receive the user's ACTUAL phone number, unlike the encrypted hash Signal stores on their servers currently.
Which means, that if Signal gets compromised or subpoenaed by law enforcement, they would have to share both the hashed phone number AND the plaintext phone number, which would allow law enforcement or a nefarious third-party to directly create graphs that would identify specific users by matching the phone numbers to the hashes.
This is very dangerous, so it's not a good idea at all. Unless they decide to drop the phone number requirement altogether, they cannot switch their SMS approach without creating massive privacy issues for the user base.
@duxsco Signal already has a user's encrypted phone number, but they can't decrypt it. Your proposed approach hands Signal both the encrypted number and the plaintext number. Which, for Signal, just can't work from a privacy perspective.
They can reduce cost by de-centralizing Signal, and allowing it to federate. That and cutting compensation for employees, especially executives.
@alextecplayz I hope nobody puts their life on the line by expecting that Signal ensures anomity. I have the same hope for VPNs. They don't grant anomity.
Wouldn't it be great if Signal didn't require a phone number?
I don't answer rhetorical questions. And, as I said, my initial post was about cost reduction.
Signal
David Sardari
AlexTECPlayz