The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Signal rolls out secure registration without a phone number

Signal, the end-to-end encrypted messaging app, has long required users to provide a phone number to register for the service. This number serves two purposes. First, until recently, it was the only identifier that allowed others to message you, while ensuring that Signal itself didn’t have access to your contact list. (Signal now allows users to optionally provide contacts with a username instead.) Second, because we typically have to pay for a phone number, the developers used phone numbers in the registration process to limit spam. No infinite phone numbers for you.

According to Signal’s lead Android developer, Greyson Parrelli, the app’s beta version for Android now supports the option to register without a phone number by paying a one-time fee of about $3 — a payment that is not linked to your Signal account. (The price varies by country.) This fee is intended to help cut down on the potential for spam and abuse. The same feature for iPhones is still in the works. Read more.

What you can do

  • Don’t know where to start? If you haven’t tried Signal yet, check out our guide for beginners. Those who want to dig even deeper on maximizing its settings should review our guide to locking down Signal.
  • Don’t want to wait? Try Signal beta. Android users can access this feature early by downloading the Signal beta app from the Google Play store.
  • Remember: This will change how you use Signal. Because you don’t have a phone number, you will need to use a username. This also means no one will be able to look you up in their contact list through a phone number.
  • If you share your username publicly, maintain it. The trade-off with a Signal username is that if you don’t maintain it, someone else can grab it and impersonate you. As we’ve written about previously, this could be a serious problem if you have a username that accepts tips from sources. This is why if you post your username publicly, you’ll want to take a few steps to ensure others are not able to use it. Read our guide to Signal account safety.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation