All my investigations are free to access, thanks to the generosity of my readers. Independent journalism nonetheless requires investment, so if you took value from this article or any others, please consider sharing, or even becoming a paid subscriber. Your support is always gratefully received, and will never be forgotten. To buy me a coffee or two, please
For a project like Signal, there are competing aspects of security:
privacy and anonymity: keep as little identifiable information around as possible. This can be a life or death thing under repressive governments.
safety and anti-abuse: reliably block bad actors such as spammers, and make it possible for users to reliably block specific people (e.g. a creepy stalker). This is really important for Signal to have a chance at mass appeal (which in turn makes it less suspicious to have Signal installed).
Phone number verification is the state of the art approach to make it more expensive for bad actors to create thousands of burner accounts, at the cost of preventing fully anonymous participation (depending on the difficulty of getting a prepaid SIM in your country).
Signal points out that sending verification SMS is actually one of its largest cost centers, currently accounting for 6M USD out of their 14M USD infrastructure budget: https://signal.org/blog/signal-is-expensive/
I’m sure they would be thrilled if there were cheaper anti-abuse measures.