Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • I know for a fact If you use "signal" matrix or whatever "security" app, you will get branded a terrorist in India, your life will be upended and you will face a long list of problems.

    https://timesofindia.indiatimes.com/india/ats-probes-use-of-...

    https://www.aninews.in/news/national/general-news/accused-da...

    https://www.deccanherald.com/india/secure-messaging-apps-lik...

    https://india-employmentnews.com/tech-category/delhi-blast-n...

    https://timesofindia.indiatimes.com/tech-news/Dangerous-Sign...

    And it doesn't matter you use a connected phone or not, they just get data from ISPs.

    And yes, using a VPN will get you knocked up as well.

    https://www.aljazeera.com/news/2026/1/12/indias-vpn-ban-in-k...

    by 2Gkashmiri
  • > And yes, using a VPN will get you knocked up as well.

    Well, damn.

    by sans_souse
  • And WhatsApp is E2EE with the same protocol so I don't see the big deal.
    by Cider9986
  • Yes that's bad but that's an Indian government problem, not a signal or other messenger app problem. And really, it sounds like there was a lot more going on with these people than just using a particular app. Discord and WhatsApp are mentioned too.

    India also bans most satellite phones by the way. I have one so I looked into that as to not get caught out travelling.

    by wolvoleo
  • Does the protocol preserve its privacy benefit when payment, recovery, and anti-abuse metadata are considered together?
    by soltanov
  • Considering the eyebrow raising funding sources, probably not
    by voidnullvalue
  • any link to presentations/papers on this?

    I'm interested on learning ZKPs -- they seem so much like "fairy-tale come true" because I don't know much

    by sysguest
  • It's standard cryptography, not some new-fangled tech! Wikipedia even has some easy examples:

    https://en.wikipedia.org/wiki/Zero-knowledge_proof

    Main caveat is that ZKPs are probabilistic. The protocol (number of rounds etc) determines how sure, e.g. 99.9%. But never 100%.

    Second caveat: tech- and crypto-bros play fast and loose with the term "ZKP", either because they don't know any better (marketing) or they straight up lie. Whether any application you run actually uses ZKP (or any other cryptography scheme) is unknown unless you have the source code.

    by jval43
  • nym.com might have some. They use stuff like that heavily and there's a bunch of academics involved.

    Also ZCash.

    by Cider9986
  • I liked this: "I can prove I’ve solved this Sudoku without revealing it" https://youtu.be/Otvcbw6k4eo
    by hasley
  • Here's a site with a few (three) introductory articles on ZKPs: https://zkintro.com

    One in particular on pratical implementation of ZKPs was popular on HN back in 2024: https://zkintro.com/articles/programming-zkps-from-zero-to-h... (discussion at https://news.ycombinator.com/item?id=41398092)

    by jmusall
  • you can't wave your hands, say "zero knowledge", and be private. this is too little information to be useful
    by ynniv
  • usually, the implication of ZKP is that you buy coupons and claim them without attribution. in this coupon scenario the ZKP can just be a blind signature scheme.

    however signal has an obscene fondness for TEEs (secure enclaves) so they may actually be doing something stupid here which will require trust beyond the ZKP.

    by teravor
  • Especially with AI agents being more common this would be very useful. I'd prefer to use Signal over telegram but haven't gotten around to getting another number.
    by sarjann
  • Lots of discussion at that link, but what's the bottom line? Can you register without a phone number yet?
    by rkagerer
  • Likely soon.
    by Cider9986
  • Some say in this thread that it's supported by Google Play, but no mention of Apple's OSes, so I wonder if you can only do it on one platform.
    by commandersaki
  • By the end of the year (tm)
    by blitzar
  • I don't trust Signal. The device OSes and hardware are opaque, chatty, not private or trustworthy, the network backbone is completely owned by dragnet surveillance, Dual_EC_DRBG flavored shenanigans, so how could an app running on top of this suddenly be trustworthy? Especially one that's super high profile which signals inside a dragnet "someone is working especially hard to make this secret".
    by user3939382
  • Is it your expectation that E2E is broken by these "dragnet surveillance" networks? Surely not?

    I concede that if you can't trust the device itself you can't trust anything running on it, but why have you resigned yourself to that? And how does that reflect on signal at all?

    by 420official
  • Viewing any security thing as a binary is the wrong way to look at it. Figure out your adversaries, how much power they have and what they are willing to spend. Make your decisions from there.

    I personally think signal is sufficient for the threats the average person is concerned about, but that is a decision each individual has to make for themselves.

    by bawolff
  • What a headline!

    Meanwhile SimpleX and Delta Chat (over chatmail protocol) have it by default for years without any payment requirements, offer relatively better level of data security and are available on F-Droid main repo.

    by user10235
  • I wish Delta Chat would have a more polished UI... the poor UI / design makes the app unappealing.
    by DavideNL
  • Per the commits, this will require a purchase with Google Play Billing to mitigate spam while keeping the SMS verification option.
    by opengrass
  • What about their built-in cryptocurrency? It's a perfect use for it. They could require payment post-install yet before message can be sent.
    by mmooss
  • Ugh wtf so I need a Google account on Android? That's not going to happen.

    For an org that pretends to care about privacy you'd imagine there'd be a way to avoid, you know, the biggest privacy invader on the planet.

    Just allow monero payments or something. Alongside Google play for the sheep that want to use that.

    by wolvoleo
  • It says something about Play Billing being used specifically to mitigate spam?

    I understand using play payments initially but hopefully eventually there's a way to buy an account without going through google.

    by Cider9986
  • Ah OK, I wondered where is the "catch".

    You cannot keep all 3 of "no gatekeeping" - "anyone can message anyone" - "low spam".

    by karel-3d
  • How does ZKP keep payment data seperate from the account. You can add a payment reference to your payment in some kind of cryptographic protocol, but if it's not in their database you can't login and if it is you can. So completely identifiable?

    Some combination with TEE to act as a mixer with a time limited internal secret in the TEE sandbox for verification before converting it to a "paid" flag?

    by PinkiesBrain
  • Or does the server send a block of payment references to the client, with the client giving a ZKP to prove "yep, one of those is mine"?
    by PinkiesBrain