They are [1] implementing unlinkable payments so all that is known by credit card is that you purchased Signal and Signal doesn't know which credit card goes with which account.
>Signal is an obvious honeypot.
Claims without evidence can be dismissed without evidence. You might say they don't do enough to protect metadata privacy but it was never made to be an anonymous messenger, it was made to be a private messenger. You can easily check the end-to-end encryption in the code (reproducible builds on all platforms except iOS BTW!). This person audited Signal recently [2].
>They make no money and have no plans to.
They make money from donations and paid backups and they might make money from paid accounts.
[1] https://github.com/signalapp/Signal-Android/commit/7da3357b5...
[2] https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...
Replacing the need to register with a phone number with a requirement to pay is a better option how, exactly ?
When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.
If they accept monero or something then ok but I doubt they will.
Ideally they accept Monero and do unlinkable payments but I doubt they will accept Monero. Hopefully they accept some crypto.
That is not the same thing.
You buy a Mullvad scratch card on Amazon and you redeem the token string.
Mullvad also offer the option to put your card number into the Mullvad website, and I'm sure many privacy conscious people would be very reluctant to do that.
Card payments these days leave far too big a trail. The bank knows, the intermediary (e.g. Stripe) knows, and the merchant (e.g. Mullvad) has to keep records for accounting/tax requirements.
Molly is going to add a Monero integration while also having various other advantages.
They don't accept crypto donations directly or accept them for their backups so I assume they wont for registration.
It's already the case today (and has been for years) that you don't need to give strangers your phone number to chat on Signal. My username is soatok.45; try to get my phone number if you can.
If you want absolutely no info to be collected, ever, and there to be zero cost on the end user too, be prepared to welcome your new spam overlords. Because the people who will benefit the most from a zero cost signup that only requires a username are spammers.
For example:
* Are you absolutely positive signal will never have a bug that let attackers reveal contact phone numbers? I really trust in their secure coding skills, but this class of vulnerabilities (like 2fa leaj) happened to even the biggest players.
* One of the reasons signal collects phone numbers (and asks for a contacts permission) is to check which contracts are already on signal. For some people or in some governments even having a signal account is an opsec problem (to be fair, they have a secure privacy-preserving protocol for this - as you know - and it's possible to avoid this footgun if necessary)