Signal's Zero-Knowledge Phone Decoupling: The Anti-Spam Trade-off with Big Tech
The privacy and systems engineering communities are engaged in a heated debate following technical commits revealing Signal’s upcoming support for registration without a phone number. To achieve this long-requested privacy feature, Signal is utilizing Zero-Knowledge Proofs (ZKP). However, the implementation has exposed an uncomfortable architectural trade-off: to prevent massive automated spam, Signal is tying free-to-register accounts to a mandatory Google Play / Apple Billing purchase, raising serious concerns about metadata leakage and dependency on the Big Tech duopoly.
The Cryptographic Breakthough
Historically, Signal has required a valid phone number for account registration, serving as both a unique identifier and an expensive anti-spam barrier. While this made the app highly accessible to non-technical users, it represented a major privacy vulnerability for activists, journalists, and high-risk individuals who could have their phone numbers linked to their real-world identities or targeted by SIM-swap attacks.
The upcoming release (spotted in Android beta commits) decouples registration from telephony. The client-side cryptography uses Zero-Knowledge Proofs (ZKPs) to verify user credentials and subscription badges without revealing the user’s identity, username, or payment details to Signal’s servers. Proponents argue that this mathematically guarantees that Signal cannot link a specific user account to a specific payment or identity.
The Anti-Spam Bottleneck: Tying Privacy to Google Play
While the cryptography is highly sophisticated, the practical implementation of spam mitigation has sparked intense criticism on Hacker News:
- The Big Tech Paywall: To prevent spammers from generating millions of free, anonymous accounts, Signal's new registration flow requires a paid transaction. According to the Android commits, this is implemented using Google Play Billing (and Apple's equivalent on iOS). This means a user must have a Google or Apple account with a valid payment method linked to their device to register.
- The Privacy Paradox: To register "privately" without a phone number, a user must now authenticate and pay through Google or Apple—the two biggest privacy-invasive platforms on the planet. While the ZKP prevents Signal from seeing the payment details, Google and Apple's operating systems can easily track the metadata, including the fact that the user is purchasing a Signal subscription, when they are doing so, and from what IP address.
- The Exclusion of De-Googled Devices: Privacy advocates running hardened, de-googled operating systems like GrapheneOS (which typically run without Google Play Services) are functionally locked out of this new feature unless they maintain a separate Google account, which defeats the purpose of running a de-googled device.
- The Monero/Crypto Avoidance: Commenters questioned why Signal does not allow payments via privacy-preserving cryptocurrencies like Monero. The consensus is that Signal likely avoids Monero to prevent attracting regulatory scrutiny and potential bans from the Apple App Store and Google Play Store, choosing instead to operate within the compliance boundaries of the dominant mobile operating systems.
The Metadata and Infrastructure Elephant in the Room
The discussion has pivoted into a broader debate over Signal’s overall security posture. While Signal's end-to-end encryption (E2EE) remains mathematically sound and independently verified, its metadata protection is highly centralized:
- Cloud Infrastructure Dependency: Signal’s backend is hosted on centralized cloud providers like AWS. Commenters noted that competent state actors (such as the NSA) do not need to break the E2EE; they can perform traffic analysis by correlating metadata (timestamps, IP addresses, and packet sizes) traversing AWS and ISP networks.
- The TEE Controversy: Signal’s heavy reliance on Intel/AMD SGX and other Trusted Execution Environments (TEEs) for secure enclaves on their servers remains a point of contention, as security researchers argue that TEEs require trusting proprietary, black-box hardware that has historically suffered from hardware-level side-channel vulnerabilities.
While Signal's move to ZKP-based registration represents a major cryptographic milestone, it highlights the immense difficulty of building a truly anonymous, consumer-scale communication platform within a centralized mobile ecosystem.