215
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 16 Sep 2026
215 points (98.6% liked)
Privacy
6187 readers
1 users here now
Welcome! This is a community for all those who are interested in protecting their privacy.
Rules
PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!
- Be civil and no prejudice
- Don't promote big-tech software
- No apathy and defeatism for privacy (i.e. "They already have my data, why bother?")
- No reposting of news that was already posted
- No crypto, blockchain, NFTs
- No Xitter links (if absolutely necessary, use xcancel)
Related communities:
Some of these are only vaguely related, but great communities.
- !opensource@programming.dev
- !selfhosting@slrpnk.net / !selfhosted@lemmy.world
- !piracy@lemmy.dbzer0.com
- !drm@lemmy.dbzer0.com
founded 2 years ago
MODERATORS
Still depends on Google? Into the trash bin it goes.
Hopefully they can adopt FOSS payment methods soon. I've heard good things about Taler, but am still waiting for a good reason (in terms of commerce support) to use it.
You don't want to have to use a payment method at all... the problem with not having a phone number is there is no way to tie the account to someone who is responsible for the content, and Signal does not want the liability nor the spam traffic, of potentially harmful traffic (in whatever sense that may mean).
Or if you want the tinfoil hat response... they need/want to tie your account to a real identity for surveillance purposes, and they can't do that if there is no phone number, so they use a payment record instead. (I made all that up and have no idea if it's true)
They're using zero-knowledge proofs for the payments so they can't link the account to the credit card used to pay it.
Zero-knowledge proofs as a concept sound sus to me. How do you prove that you don't know something? The fact of being tested already means you know of it. What's a good writeup n how Signal does it? And how can a user of Signal test or certify it?
Here is a basic explanation for how zero-knowledge proofs can work in a very similar context as Signal.
Google can, since it's their OS and their payments.
But even if you're not using Play Store to pay, the vast majority of people who are paying are going to be using the same device/IP/fingerprint/etc. where Signal is running, so it's not impossible to put the two together to link an account to a specific payment, if say, a government forced them to do so in order to track someone. It's just a bad idea for several different privacy reasons.
Google can know you've paid but they can't link it to your Signal account thanks to zero-knowledge proofs.
Except for tracing IP addresses, timing etc... as you've mentioned, but that's much more involved and cannot be done retroactively.
They can... as I said they control the entire OS. They can see you're running Signal with account# XYZ, that you clicked the pay button, that Signal generated the ZKP (which they can read in memory or network packets), and all the key clicks and numbers entered of the payment details for that ZKP, the entire process.
That's just conspiracy theories at this point. If you assume google is constantly spying on the memory of all applications on your phone there is no reason at all to believe that.
I never said they were doing it or that people should assume it, just that it's possible. Whether or not that matters is up to each individual's own threat model and should be weighed accordingly.