For those who missed it, unrelated to this specific ZKP thing the release cycle also now permits Android tablets without a SIM to be first-class adjunct devices without using wierd tricks or alternate clients. It may permit them to be the initiation/sign-on device, which would invoke the ZKP, but the point for me as an existing phone number denominated user, the point is I can be on my tablet with true signal now. Nothing against molly, wanted it in the base.

Signal needs to release all the infra automation code behind their backend. How they setup and manage it all should not be secret. It also makes it easy to rebuild if for some reason they are compromised. They've ghosted multiple people about this question. There's no reason a 501(c)(3) shouldn't release it.

Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.

I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".

What a headline!

Meanwhile SimpleX and Delta Chat (over chatmail protocol) have it by default for years without any payment requirements, offer relatively better level of data security and are available on F-Droid main repo.

Lots of discussion at that link, but what's the bottom line? Can you register without a phone number yet?

Especially with AI agents being more common this would be very useful. I'd prefer to use Signal over telegram but haven't gotten around to getting another number.

you can't wave your hands, say "zero knowledge", and be private. this is too little information to be useful

any link to presentations/papers on this?

I'm interested on learning ZKPs -- they seem so much like "fairy-tale come true" because I don't know much

Does the protocol preserve its privacy benefit when payment, recovery, and anti-abuse metadata are considered together?

I know for a fact If you use "signal" matrix or whatever "security" app, you will get branded a terrorist in India, your life will be upended and you will face a long list of problems.

https://timesofindia.indiatimes.com/india/ats-probes-use-of-...

https://www.aninews.in/news/national/general-news/accused-da...

https://www.deccanherald.com/india/secure-messaging-apps-lik...

https://india-employmentnews.com/tech-category/delhi-blast-n...

https://timesofindia.indiatimes.com/tech-news/Dangerous-Sign...

And it doesn't matter you use a connected phone or not, they just get data from ISPs.

And yes, using a VPN will get you knocked up as well.

https://www.aljazeera.com/news/2026/1/12/indias-vpn-ban-in-k...

How does ZKP keep payment data seperate from the account. You can add a payment reference to your payment in some kind of cryptographic protocol, but if it's not in their database you can't login and if it is you can. So completely identifiable?

Some combination with TEE to act as a mixer with a time limited internal secret in the TEE sandbox for verification before converting it to a "paid" flag?

Is Signal still a trusted company in the industry? They are based in the USA.

Unrelated.

But if you have a spare phone with your account on, e.g. kids or whatever

You can install Authenticator and get codes, even if the other phones need biometrics.

Once phones are gone from signup, what do they use that attackers can’t mint cheaply?

I'm curious about the cost because you can buy a phone number for Signal for ~10 cents (spammers likely get them cheaper). I would still buy it because you don't have to worry about losing your number or something.

How do they prevent sybil attacks and bots then?

wake me up when signal can be used with no significant loss of feature or extra-hoops like signal-cli+SMS on non-google/non-apple devices like my linux desktops / linux phones.

The commit history is kinda wild

Yeah, ditching the phone number sounds good.

But if the replacement is Google or payment info, then... did we really fix much?

Kinda feels like trading one ID for another.

Ahh yes, it is the technology that is the easiest gate to break down first. *takes puff on elaborately rare-wood pipe*

I stopped using signal when they made their weird change about not supporting SMS due to... whatever weird problem they had with normies. Come on dude. Even my realtor was on Signal. Instantly killed the product.

Signal still uses proprietary blob and uses google/apple service for notifications. Use molly.im instead which has solved these problems.