IdeaWell

Project ideas from Hacker News discussions.

How Trail of Bits helps verify the integrity of Signal chats

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1 – Phone‑number requirement and alternatives
Many commenters see the SMS‑based sign‑up as a privacy “gotcha” and discuss paid or cryptocurrency‑based work‑arounds.
- “the need for them to bootstrap you with SMS is a gotcha… they have usernames now, but even with those you have to bootstrap it with a number/identity.” – chews
- “They will allow registering without phone number as a paid option soon.” – ortekk
- “If your concern is ‘muh phone number’, then you can pay and not have to give the phone number to sign up.” – some_furry
- “When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.” – thecrash

Theme 2 – Trust, centralization, and decentralized alternatives
Several users view Signal as another walled garden and advocate truly decentralized networks like Matrix.
- “I'd use something that's truly decentralised but signal is just another walled garden like WhatsApp.” – wolvoleo
- “A decentralised network would mean a guarantee that they can't do anything bad. I'll take that over promises and good intentions any day.” – wolvoleo
- “Signal is an obvious honeypot… They make no money and have no plans to.” – johnnyApplePRNG

Theme 3 – Usability vs. spam prevention
The discussion repeatedly returns to the idea that phone numbers help curb bots and keep the service usable for the general public; removing them could invite spam.
- “Signal's mission is to provide maximized privacy in a form the non-technical public can use. A messaging service filled with bots and spammers is not usable… What is a more private, usable solution for filtering them out than using a phone number?” – mmooss
- “If signing up for a matrix account is too annoying for them they don't really care about privacy anyway.” – wolvoleo
- “One possible solution is to only be able to contact someone if you have received an invitation code from them out of band… Start getting spam from one of your standing invitations? Just revoke it and make a new one.” – snackbroken

🚀 Project Ideas

Generating project ideas…

SignalInvite

Summary

  • Enables Signal users to add contacts via single-use or standing invitation QR codes, eliminating the need to share phone numbers while providing revocable links to curb spam.
  • Core value proposition: privacy‑first contact exchange that works with the existing Signal protocol and can be used by anyone concerned about phone‑number exposure.

Details

Key Value
Target Audience Privacy‑conscious Signal users, journalists, activists
Core Feature QR‑code invitation generation, single‑use or reusable invites, revocation, optional micropayment to deter spam
Tech Stack React Native (or Flutter) for mobile client, Signal Protocol library, Node.js backend for invite metadata, IPFS for storing invite data
Difficulty Medium
Monetization Hobby

Notes

  • HN commenters lamented the phone‑number bootstrap and liked the idea of invitation codes (snackbroken: “scan this QR code to add me on signal”).
  • Provides a practical, low‑friction way to adopt Signal without exposing numbers, encouraging discussion on usable privacy solutions.

NymID Bridge

Summary

  • Issues zero‑knowledge proof‑based identity credentials (zk‑nyms) that let users prove they are a unique human without revealing phone numbers, usable as a Signal registration alternative.
  • Core value proposition: decentralized, Sybil‑resistant identity that preserves anonymity while thwarting mass account creation.

Details

Key Value
Target Audience Developers building privacy apps, Signal power users, crypto‑savvy individuals
Core Feature zk‑nym credential issuance/verification API, optional Monero payment for credential, integration layer for Signal registration
Tech Stack Rust (for zk‑SNARK circuits), Wasm for web verification, Go microservice API, libp2p for p2p credential storage, optional Monero RPC
Difficulty High
Monetization Revenue-ready: subscription for premium verification tiers (e.g., $0.99/mo)

Notes

  • Commenters pointed out that payment could replace phone numbers if done privately (Cider9986: “Ideally they accept Monero and do unlinkable payments”).
  • NymID offers exactly that: unlinkable, low‑cost credentials that deter spammers while keeping user data private, sparking debate on Sybil resistance vs usability.

SignalGuard

Summary

  • A self‑hosted moderation bot for Signal groups that enforces invitation‑only joins, reputation scoring, and automatic spam detection, with optional paid verification for businesses.
  • Core value proposition: reduces spam and abuse in Signal communities without requiring phone numbers, giving admins concrete tools.

Details

Key Value
Target Audience Signal group admins, community organizers, small businesses using Signal for customer support
Core Feature Invitation‑link enforcement, reputation‑based message filtering, spam reporting, business verification badge (paid)
Tech Stack Python (FastAPI) for bot logic, Signal service CLI (signald) via gRPC, PostgreSQL for reputation store, Docker for deployment
Difficulty Medium
Monetization Hobby (free) with optional paid verification badge via Stripe ($4.99/mo)

Notes

  • Users complained about spam when phone‑number verification is removed (thecrash: “spammers would benefit from zero‑cost signup”).
  • SignalGuard directly addresses that by making spam costly via reputation and paid verification, providing a concrete tool that HN discussants could adopt and improve.

Read Later