Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.
Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.
It says something about Play Billing being used specifically to mitigate spam?
I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.
Add ability to pay for a signal login.
https://github.com/signalapp/Signal-Android/commit/7da3357b5...
Wouldn't that be related to data storage? Which they offer now? Or is that different?
Ah, I thought you meant using google play to do the payments to prevent spam unrelated to the cost. I know they are costing something.
What about their built-in cryptocurrency? It's a perfect use for it. They could require payment post-install yet before message can be sent.
Nobody uses that and I think it was pre-mined. They should have implemented Monero but the UX isn't there. Maybe a Monero light wallet server run by Signal.
They probably avoided Monero to not attract the additional scrutiny. They don't even accept donations in Monero.
I always thought they didn't want monero because they were pushing their own crypto thingy. Which indeed nobody uses.
They avoid Monero because Signal and the EFF are actually the feds and this is all theater.
Claims without evidence can be dismissed without evidence.
Signal is not robust for metadata protection. Neither do they advertise anonymity. They take steps to protect metadata but it's nothing compared to SimpleX.
If it's "the feds", then how? There's reproducible builds on all platforms except iOS so we know the source code is what's running on our devices. Can you point to the code where the E2EE is compromised?
They are the largest messenger that has E2EE backups by default.
If I was the NSA, I would be using the fact that signal uses AWS for their backend combined with the cudgel that .us.gov has with the AWS govcloud contract to mandate that all traffic to and from signal's backend also gets routed to NSA traffic analysis servers, which could then be correlated with other sources like ISP data to get a pretty complete record of all Signal message metadata.
To be clear, I use signal pretty heavily, but that's because my threat model doesn't really include competent .us.gov actors. I don't think that they'd either prove they're doing this or go through the trouble of parallel construction over anything in my messages or who I'm talking to.
Nobody is arguing the e2ee isn't valid, its useful as a metadata collection platform, which is all they care about. Former NSA and CIA Director Michael Hayden famously stated: “We kill people based on metadata." and then he tried to hold back a smile and said "but not with this metadata". It's usefulness as a metadata collection platform becomes much less useful if people don't trust it, so of course it's secure.
If you can convince as many of your enemies (the american people who politically organize against them) to use the same platform, your job becomes easier than having to ETL from 20 different privacy platforms..
To be honest, I use signal, I have nothing to hide but it is useful in that nobody can spoof me (easily). I even talk to my 60 year old mother on signal. It has it's uses. But the EFF is definitely a federal psyop to get people using tools and techniques they control.
Just look at the people who created TOR, they're all feds. All these projects are funded by feds. These tools are advertised in CIA recruitment campaigns, they are literal weapons to circumvent nation state firewalls and deliver psychological weapons, overthrow governments or allow covert recruitment of foreign traitors.
[dead]
True, if they're not even going to allow that for payment then they might as well remove it from the app altogether. Because what's the point if they don't even believe in it themselves.
I've literally never seen anybody mention it, much less use it since it was announced.
Ugh wtf so I need a Google account on Android? That's not going to happen.
For an org that pretends to care about privacy you'd imagine there'd be a way to avoid, you know, the biggest privacy invader on the planet.
Just allow monero payments or something. Alongside Google play for the sheep that want to use that.
Are you being hyperbolic, or do you really consider Google the worst with regards to privacy.
The most ubiquitous, absolutely. Their data collection is unparalleled. They're on almost every website, app, they have fingers into payment and browsers and mobile OSes.
In terms of what they do with big data there's more evil parties like Palantir but data abuse starts with collecting it, and I would object to it even if Google promised to only use it for good. For me my privacy is already violated when my data is collected, not just when it's abused. And I do consider Google's use of that data abusive, just not in the worst ways.
Hopefully they eventually make a way to pay without it.
You wouldn't believe the spam if they did that
Why? Just raise the prices if they get more spam on non-google payments.
I've literally registered a Signal account on one of the free SMS sites floating around. Why would spammers choose the payment route over phone numbers? They would just choose the one that's cheaper.
googles obligation to hand out all account linked info notwithstanding, one may still create google accounts without associating a phone number, by doing so on old android versions. signal does however explicitly force credit card info here, thus providing direct individual traceability ..
Plus they are mandating you give your details to Google. So much for privacy