Signal's new(ish) URI Scheme

Terence Eden — Thu, 23 Feb 2023 12:34:31 +0000

A few years ago, I idly wondered "Whatever happened to URI Schemes?". Older communications protocols didn't rely on http. You can use mailto:me@example.com to send email, sms:+447700900123 to send a text message, and skype:terence.eden to use Skype. There are dozens of these sorts of protocols.

But modern apps seem to prefer making everything an https: link. That way, if the user doesn't have the app installed on their phone, they get taken to a friendly landing page - rather than seeing an error message.

The Signal messaging app launched signal.me URls for this purpose back in 2021. It allows you to share a link like https://signal.me/#p/+447700900123 and have your signal client open up a chat with that person.

Then, towards the end of 2022 they added support for their own scheme! sgnl (although it doesn't appear to have been submitted as an IETF draft, and isn't listed on IANA).

It has exactly the same layout as it's https sibling: sgnl://signal.me/#p/+447700900123

Of course, not everyone has (or wants) a phone number. So Signal are adding support for usernames.

Sadly, they've taken the same xenophobic attitude as GitHub and insist that only good ol' American letters and numbers can be used. No fancy accents, right-to-left languages, or Korean Hangul.

Nevertheless, it will be interesting to see if this prompts a surge in Signal take-up. Especially important as Signal are dropping SMS support

Questions to ask before launching a crypto-payments feature

Terence Eden — Thu, 08 Apr 2021 11:23:39 +0000

Messaging app Signal is launching a payment service in the UK. This will allow users to send each other ~~money~~ cryptocurrency. Many people have written about why this is a daft idea. But they've mostly talked about why cryptocoins corrupt everything they touch. I want to talk about why this is a shitty idea from a product perspective.

It all comes down to user needs. What pain point are you removing? Uber made taxis mildly less irritating, for example. But the UK already has a fairly mature mobile money market, so what does Signal add? Here are a few obvious questions I asked them:

The UK already has faster payments in all major banks. I can send and receive money instantly from app or Web. Will Signal be as fast as that?
The UK has a problem with authorised push payment fraud. Banks can recover funds which have been sent as a result of phishing / fraud. How can someone reverse a payment on Signal if it was fraudulent?
The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How does Signal stop impersonation?
There's no cost to sending payments on most mainstream banks. How much does Signal charge?
Most banks let the user block receiving payments from specific accounts. Can Signal stop harassers sending unwanted money?

Those were the questions I immediately thought of with my "product" hat on. I'm sure you can think of more.

The responses were... not well thought through. I'll respond to each one.

A: MobileCoin is as fast (or faster in some cases) than a bank payment in the UK with greater privacy. As far as settling back to Fiat, if that's what you're asking about, the velocity of that depends on on-ramp and off-ramp integrations which will come over time (but it looks like there's no reason MobileCoin can't help developers deliver payments at the same speed as banks).

I've yet to see a settled crypto transaction which is as fast as a UK bank transfer. We'll come back to "privacy" later. In terms of getting real money out of the system, the answer seems to be "variable" - which doesn't sound like a great customer experience.

Payments on MobileCoin cannot be reversed at the protocol level. If you want escrow and reversibility, you should use a wallet or payment service that supports those primitives. We believe that developers will build such services on top of the foundation of the MobileCoin protocol.

So, no. If you get scammed, tough. Neither a bank, nor a regulator, nor a court can reverse a dodgy transaction. Where's the user need for that?

Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification.

So, again, if someone pretends to be your mate and cons you out of money, there's no independent verification. I bet users just love sending money and not knowing who it is going to.

Fees are set by the foundation (which has a stated goal of keeping transaction fees to around $.04 when the network isn't congested). Currently fees are higher as they need to be adjusted by a foundation vote.

That's pretty high! People in the UK literally use their banking apps to message each other - sending penny payments to get someone's attention. What is the user getting for this proposed transaction fee?

Signal doesn't allow people you haven't keypaired with to send you funds. If you have accepted a message request from someone, they can send you money.

If you can't block people - even after accepting them - that's a vector for harassment, or worse. Your psycho-ex can bombard you with micropayments. Your dodgy mate can offload his illegitimate gains into your account. It sounds like a nightmare.

So, I ask again, what is the use-case for this feature? It isn't faster, it costs more, it is in a volatile cryptocurrency, it has no fraud protection, and it facilitates abuse.

The one thing it has going for it is that it is "anonymous".

Except, of course, it isn't anonymous in any real sense. You need the user's phone number - which means law enforcement can track their activity. While the ledger may be anonymous, if you send a unique amount of money, and it gets received instantly, it's going to be pretty easy to work out who is at either end of the transaction.

Perhaps there is a huge untapped desire to send expensive pseudonymous payments. Perhaps people want to pay for stuff using a speculative instrument. Perhaps everything I thought I knew about people is wrong.

Or, perhaps this is another pump-and-dump cryptoscam?

I wonder who was "investing" in those coins before the big announcement? Nothing to see here...

signal – Terence Eden’s Blog

Signal's new(ish) URI Scheme

Questions to ask before launching a crypto-payments feature