Signal is working on letting users register without a phone number, and the company plans to use zero-knowledge proofs to keep that private. The proposal sparked a round of questions on Hacker News, with some users wondering whether the move might open the door to spam.
What ZKPs Actually Do
Zero-knowledge proofs let one party prove knowledge of a secret without sharing the secret itself. Signal already uses them for things like donation badges and group verification, according to comments in the thread.
The technology is designed so that the server can’t link a proof back to a specific user. That means Signal can check that a user meets certain requirements — like username rules — without ever seeing the content of the username itself.
The Phone Number Problem
The proposal aims to remove the requirement that users provide a phone number when signing up. Instead, registration would rely solely on the user’s identity, verified through ZKPs.
One user asked whether existing users who registered with a phone number could “unlink” it later. The response was that it’s possible, though the exact process hasn’t been detailed yet.
Spammers and Cooldowns
The biggest concern raised was spam. If anyone could register an account without a phone number, the floodgates could open.
One commenter suggested a cooldown period as a solution. But they noted that even a one-month wait might not stop determined spammers.
The Math Behind It
One user admitted that the math behind ZKPs is “waaaayyyyy above my head.” That admission landed as a kind of joke, given that the same person insisted ZKPs were the technology behind Signal’s features.
The thread also touched on the “save as PDF” feature, which was described as interesting but separate from the main discussion.
What Remains Open
Several questions remain unanswered:
- Is the phone number truly unlinked from the username?
- What data stays on the device after unlinking?
- What data stays on the server?
The thread made clear that technical details regarding privacy have not yet been clarified.
Why This Matters
Removing the phone number requirement would extend Signal’s existing privacy approach to new users who don’t want to hand over identifying information at all.
The trade-off is obvious: easier registration comes with the risk of abuse. Signal will need to balance convenience against security.
The Verdict on the Thread
The Hacker News discussion shows that users care deeply about how their data is handled. The questions about spam and cooldowns are practical, not paranoid.
The fact that technical details regarding privacy have not yet been clarified is notable. It suggests the company is still working through the design.
Key Facts Box
- The proposal allows registration without a phone number
- ZKPs are already used for donation badges and group verification
- One user suggested a one-month cooldown to prevent spam
- The thread discusses Android Beta feedback for releases 8.26 and 8.27
Signal has not announced a timeline for rollout beyond the beta. The company will likely address the remaining technical questions before the feature goes live.
For now, the conversation continues on Hacker News, with users waiting to see how Signal handles the trade-off between ease of use and protection against abuse.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.