Privacy is priceless, but Signal is expensive • Hacker News Board

Re: Privacy is priceless, but Signal is expensive

#21

Post by jph » Thu, Nov 16, 2023, 4:48 PM UTC

Signal can be better, IMHO, by separating from phone number requirements. In other words, let users have secure random ids, rather than forcing each user to hand over their phone number for phone company verification.

It turns out the budget shows the phone number registration problem: the costs to deal with phone number verification seem to be $6MM, which seems to be 10% of the entire budget.

If Signal staff are reading this, I'd gladly pay $100/year for a phone-free solution for all users.

Re: Privacy is priceless, but Signal is expensive

#22

Post by tapoxi » Thu, Nov 16, 2023, 4:49 PM UTC

yjftsjthsd-h wrote: post #20

tapoxi wrote: post #14

Earlier quoted context omitted.

This will probably never happen. One of the reasons WhatsApp blew up is because using a phone number as your source of identification means there's much less friction in the signup flow. No username/password to create and your social graph is already there in your contact list. My mom was able to get our entire extended family on Signal without my involvement, which is a testament to how easy that is.

They're already working on it: https://www.bleepingcomputer.com/news/software/signal-tests-... Not whether that's a good idea is more debatable; you're not wrong about discoverability.

Those are in addition to the phone number, but it will still require a phone number under the hood.

Re: Privacy is priceless, but Signal is expensive

#23

Post by MuffinFlavored » Thu, Nov 16, 2023, 4:49 PM UTC

If you really wanted to talk to somebody in a "non-decryptable" fashion, could you set up like a channel that encrypts itself with a ton of different encryption methods, keys, etc. (encrypted payloads inside each other)

Signal encryption is its main feature (I think) and how easy it makes it (abstracts handling key transfer and all that), I'm just trying to think through... if I wanted nobody to read what I was saying , would I use an app/target as popular as Signal or something homegrown?

Re: Privacy is priceless, but Signal is expensive

#24

Post by jawns » Thu, Nov 16, 2023, 4:49 PM UTC

Dunedan wrote: post #2

> Storage: $1.3 million dollars per year. > Servers: $2.9 million dollars per year. > Registration Fees: $6 million dollars per year. > Total Bandwidth: $2.8 million dollars per year. > Additional Services: $700,000 dollars per year. Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive.

Phone numbers have become the de facto version of "Internet stamps" for identity verification.

They are near-ubiquitous on a per-user level, but hard to accumulate without significant cost. (Unlike email addresses.)

But the down side is that phone verification tends to be on a per-service level. So, for instance, Signal incurs these costs when they verify their users, and every other service incurs these same costs when they verify _their_ users.

There are a number of businesses out there that are trying to act as clearinghouses, where they verify the users once, then allow the users' verified profiles to be confirmed by multiple services.

I wonder if any of those could be used to reduce these "registration" costs.

Re: Privacy is priceless, but Signal is expensive

#25

Post by supriyo-biswas » Thu, Nov 16, 2023, 4:50 PM UTC

Dunedan wrote: post #2

> Storage: $1.3 million dollars per year. > Servers: $2.9 million dollars per year. > Registration Fees: $6 million dollars per year. > Total Bandwidth: $2.8 million dollars per year. > Additional Services: $700,000 dollars per year. Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive.

> we can rent server infrastructure from a variety of providers like Amazon AWS, Google Compute Engine, Microsoft Azure

Moving off cloud services to lower-cost provider like Hetzner, Vultr and DigitalOcean might provide a lot of cost savings.

I also imagine they're using managed SMS services from one of these clouds, and moving off them to a combination of local SMS gateways in each country can also further reduce costs (and in one case I've personally observed, by upto two orders of magnitude). This obviously pushes a lot of complexity on Signal's side, but is usually worth it.

Re: Privacy is priceless, but Signal is expensive

#26

Post by bsilvereagle » Thu, Nov 16, 2023, 4:50 PM UTC

RunSet wrote: post #10

Dunedan wrote: post #2

> Storage: $1.3 million dollars per year. > Servers: $2.9 million dollars per year. > Registration Fees: $6 million dollars per year. > Total Bandwidth: $2.8 million dollars per year. > Additional Services: $700,000 dollars per year. Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive.

I did my part to help reduce costs by switching to the decentralized alternative, Session.[0] Bonus: Session does not demand users' phone number. Also no bundled cryptocurrency.[1] [0] https://getsession.org/ [1] https://www.stephendiehl.com/blog/signal.html

> Also no bundled cryptocurrency.[1]

It seems like Session relies on Oxen's network, so while there is no inherent coin it is blockchain backed.

> Session’s onion routing system, known as onion requests, uses Oxen‘s network of Oxen Service Nodes, which also power the $OXEN cryptocurrency. Check out Oxen.io to find more information on the tech behind Session’s onion routing.

https://getsession.org/faq#onion-routing

Re: Privacy is priceless, but Signal is expensive

#27

Post by nicolaslem » Thu, Nov 16, 2023, 4:50 PM UTC

sandworm101 wrote: post #18

craftkiller wrote: post #8

Back in the day Signal was called TextSecure and it did everything over SMS which required no centralized infrastructure aside from the cellular networks. They transitioned to internet-based messaging to support Apple devices. It seems that decision is now a 50 million dollar per year step backwards.

It's not a step backwards for me. Our organization uses signal in many situations where SMS isn't an option. When I land in a new country it is normal for my cell/SMS not to work. But I can hop on some local wifi and get signal messages. We had a widespread cell outage in my area last year. Signal not being on cell/SMS meant that I could still communicate with family without need of cell towers. This is a big step fo…

> When I land in a new country it is normal for my cell/SMS not to work. But I can hop on some local wifi and get signal messages.

WiFi calling is a standard feature that does exactly what you describe for texts and calls, without using a third-party. I have cell connectivity turned off constantly on my phone and yet receive texts and calls via WiFi.

It is actually an awesome feature for receiving 2FA SMS at my parent's place where there is great internet but poor cell coverage.

Re: Privacy is priceless, but Signal is expensive

#28

Post by supriyo-biswas » Thu, Nov 16, 2023, 4:51 PM UTC

jawns wrote: post #24

Dunedan wrote: post #2

> Storage: $1.3 million dollars per year. > Servers: $2.9 million dollars per year. > Registration Fees: $6 million dollars per year. > Total Bandwidth: $2.8 million dollars per year. > Additional Services: $700,000 dollars per year. Signal pays more for delivering verification SMS during sign-up, than for all other infrastructure (except traffic) combined. Wow, that sounds excessive.

Phone numbers have become the de facto version of "Internet stamps" for identity verification. They are near-ubiquitous on a per-user level, but hard to accumulate without significant cost. (Unlike email addresses.) But the down side is that phone verification tends to be on a per-service level. So, for instance, Signal incurs these costs when they verify their users, and every other service incurs these same costs w…

Phone number verification is used to verify the user's registration intent, so not really.

Re: Privacy is priceless, but Signal is expensive

#29

Post by vjk800 » Thu, Nov 16, 2023, 4:51 PM UTC

> Another $19 million a year or so out of Signal’s budget pays for its staff. Signal now employs about 50 people, a far larger team than a few years ago.

What? I know silicon valley salaries are a thing, but absolutely everywhere else in the world this would be insane. Maybe change the headquarters to somewhere cheaper?

Re: Privacy is priceless, but Signal is expensive

#30

Post by syspec » Thu, Nov 16, 2023, 4:51 PM UTC

craftkiller wrote: post #8

Back in the day Signal was called TextSecure and it did everything over SMS which required no centralized infrastructure aside from the cellular networks. They transitioned to internet-based messaging to support Apple devices. It seems that decision is now a 50 million dollar per year step backwards.

If you check their costs, SMS (used for registration) is the most expensive part of their operation.