Signal Wants Registration Without a Phone Number Based on Zero-Knowledge Proofs

A multi-page discussion continues on the Signal community forum about one of the most sought-after features of the messenger — the ability to register without providing a phone number. Participants in the discussion agree that the technical foundation for this will be zero-knowledge proofs (ZKP).

As explained in the thread, this is not a new technology for Signal. ZKPs are already used in donor badges, in payments for backups, and in the operation of groups: the server cannot link a specific donation or membership in a particular group to a specific user. The same math is being proposed for registration as well — for example, to verify that a username fits within an allowed set of characters and length, without revealing the content itself.

Signal's philosophy is emphasized separately: the client is designed from the outset not to trust the server. According to one participant, the messenger's security can be demonstrated without even looking at the server-side code.

Open questions

The fate of already-registered accounts raises many questions. Users ask whether it will be possible to “unlink” a phone number from a username without re-registering, and what exactly will remain afterward — both on the device and on the server. It has been suggested that fully “unlinking” a number is unlikely to work, so creating a new account without a phone may turn out to be a more reliable solution than unlinking an old one.

There are also concerns about abuse. If unlinking were made free and unlimited, spammers could register a single number, unlink it, and repeat the cycle, obtaining an endless number of accounts. A waiting period (cooldown) is proposed as a deterrent, but participants themselves admit: too short a one is useless, while too long a one would hurt ordinary users, so a timeout alone is probably not enough.

It is important to note that this is still about the community's wishes and assumptions, not officially announced implementation details. Participants directly call on Signal to clarify the technical aspects of privacy if the feature does appear after all.

Source: Hacker News