That requires access to the actual phone and the unlock code in the case of WhatsApp (you need to identify to add a WhatsApp web client).
For telegram it's a bit easier yes, but the user can set up an additional password. I have done so of course. Note that telegram is not E2EE so they can give your stuff to the police at any time unlike WhatsApp and signal.
For signal I don't know as I don't really use it but i understand it works the same way as WhatsApp, scan a QR code and authenticate to the phone.
Also, with all 3 systems it's clearly visible when you look at the linked systems.
I have worked with Trail of Bits before and their cryptography teams are of the toppest of notches, I still have deep skepticism of Signal though. There are safer ways to use it, never getting push notifications is one part of it. I think their work is admirable, but the need for them to bootstrap you with SMS is a gotcha... they have usernames now, but even with those you have to have to bootstrap it with a number/identity.
Decreases what info Signal needs to collect and retain about a user. When using an SMS verification as a proof, Signal needs to log the phone number, because if they didn't, one spammer could use one phone number to create 10^99 accounts.
When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.
If your concern is "muh phone number", then you can pay and not have to give the phone number to sign up.
It's already the case today (and has been for years) that you don't need to give strangers your phone number to chat on Signal. My username is soatok.45; try to get my phone number if you can.
If you want absolutely no info to be collected, ever, and there to be zero cost on the end user too, be prepared to welcome your new spam overlords. Because the people who will benefit the most from a zero cost signup that only requires a username are spammers.
Signal's mission is to provide maximized privacy in a form the non-technical public can use.
A messaging service filled with bots and spammers is not usable, and possibly not affordable to Signal (what proportion of resources would be spent on spam/bots). What is a more private, usable solution for filtering them out than using a phone number?
Lots of security geeks want Signal to adopt practices unusable to the public. They've made clear that unsusable security is not in their mission.
True they can make their choices but it also means I won't support them in any way. Or recommend them.
I'd use something that's truly decentralised but signal is just another walled garden like WhatsApp. Just one that promises to behave better. But what's a promise worth these days?
A decentralised network would mean a guarantee that they can't do anything bad. I'll take that over promises and good intentions any day.
I don't care about the masses. If signing up for a matrix account is too annoying for them they don't really care about privacy anyway. After all it's the same they have to do for any online shop. Just create a username and password. Somehow it's not a problem for the masses if they wanna order a phone charger but for matrix it's suddenly 'too complicated'?
One possible solution is to only be able to contact someone if you have received an invitation code from them out of band. E.g. "scan this QR code to add me on signal". Such an invitation code should default to single-use but users should be allowed to generate standing invitations so that businesses and the like can print and post one in their store or whatever. Start getting spam from one of your standing invitations? Just revoke it and make a new one. Presumably the Signal folks can come up with more alternative solutions than the half baked one I came up with after thinking about it for a minute, they're clever cookies.
I'm also worried about that these days. They posted an article a while back that Signal costs $50m per year to run, and that they make that money from "things". Together with how low a profile they keep, I'm not convinced they aren't a honeypot.
I love Signal and it's still my preferred messenger, but if it came out that they're backed by some government agency, I wouldn't be extremely surprised.
I and not necessarily many, but at least some people I know donate (and, somewhat irregularly, will continue to do so) small-ish amounts to the foundation. [1]
You’d imagine that ought to be sufficient to cover running costs. However, it might actually not be enough with hardware prices these days? Not sure.
They’ve also recently (edit: “recently-ish”, it’s actually been a year!) introduced paid storage for backups, which I’d imagine comes with some amount of profit margin, too. [2]
50 million a year is about 50 cents per user as they are said to have 100M active users. So it's not that bad really. Nothing that would require a 10$/month subscription.
For telegram it's a bit easier yes, but the user can set up an additional password. I have done so of course. Note that telegram is not E2EE so they can give your stuff to the police at any time unlike WhatsApp and signal.
For signal I don't know as I don't really use it but i understand it works the same way as WhatsApp, scan a QR code and authenticate to the phone.
Also, with all 3 systems it's clearly visible when you look at the linked systems.
Replacing the need to register with a phone number with a requirement to pay is a better option how, exactly ?
When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.
If they accept monero or something then ok but I doubt they will.
It's already the case today (and has been for years) that you don't need to give strangers your phone number to chat on Signal. My username is soatok.45; try to get my phone number if you can.
If you want absolutely no info to be collected, ever, and there to be zero cost on the end user too, be prepared to welcome your new spam overlords. Because the people who will benefit the most from a zero cost signup that only requires a username are spammers.
A messaging service filled with bots and spammers is not usable, and possibly not affordable to Signal (what proportion of resources would be spent on spam/bots). What is a more private, usable solution for filtering them out than using a phone number?
Lots of security geeks want Signal to adopt practices unusable to the public. They've made clear that unsusable security is not in their mission.
I'd use something that's truly decentralised but signal is just another walled garden like WhatsApp. Just one that promises to behave better. But what's a promise worth these days?
A decentralised network would mean a guarantee that they can't do anything bad. I'll take that over promises and good intentions any day.
I don't care about the masses. If signing up for a matrix account is too annoying for them they don't really care about privacy anyway. After all it's the same they have to do for any online shop. Just create a username and password. Somehow it's not a problem for the masses if they wanna order a phone charger but for matrix it's suddenly 'too complicated'?
Since when is giving out your phone number a "more private" option ?
I love Signal and it's still my preferred messenger, but if it came out that they're backed by some government agency, I wouldn't be extremely surprised.
You’d imagine that ought to be sufficient to cover running costs. However, it might actually not be enough with hardware prices these days? Not sure.
They’ve also recently (edit: “recently-ish”, it’s actually been a year!) introduced paid storage for backups, which I’d imagine comes with some amount of profit margin, too. [2]
[1] https://signal.org/donate/
[2] https://signal.org/blog/introducing-secure-backups/
You don't need to be convinced of such things. In fact, it's better if technical people remain skeptical and check.
I did in 2025. https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...