Comment by OneDeuxTriSeiGo

They weren't though? Signal requires a phone number to sign up and it is linked to your account but your phone number is not used in the under the hood account or device identification, it is not shared by default, your number can be entirely removed from contact disovery if you wish, and even if they got a warrant or were tapping signal infra directly, it'd be extremely non trivial to extract user phone numbers.

https://signal.org/blog/phone-number-privacy-usernames/

https://signal.org/blog/sealed-sender/

https://signal.org/blog/private-contact-discovery/

https://signal.org/blog/building-faster-oram/

https://signal.org/blog/signal-private-group-system/

ddtaylor 5 days ago

In past instances where Signal has complied with warrants, such as the 2021 and 2024 Santa Clara County cases, the records they provided included phone numbers to identify the specific accounts for which data was available. This was necessary to specify which requested accounts (identified by phone numbers in the warrants) had associated metadata, such as account creation timestamps and last connection dates.

Reply View 6 replies

OneDeuxTriSeiGo 5 days ago

Yep however that only exposes a value of "last time the user registered/verified their account via phone number activation" and "last day the app connected to the signal servers".
There isn't really anything you can do with that information. The first value is already accessible via other methods (since the phone companies carry those records and will comply with warrants). And for pretty much anyone with signal installed that second value is going to essentially always be the day the search occurred.
And like another user mentioned, the most recent of those warrants is from the day before they moved to username based identification so it is unclear whether the same amount of data is still extractable.

Reply View | 2 replies
- ddtaylor 5 days ago
  
  I would think being able to subpoena records for all active signal users would be a cause for concern.
  Ironically enough Reddit seems to have a pretty good take on this: https://www.reddit.com/r/law/comments/1qogc2g/comment/o21aeh...
  I was genuinely surprised when I went to Reddit and saw that as the most voted comment on the story.
  
  Reply View | 1 reply
  
  OneDeuxTriSeiGo 5 days ago
  
  I think that's a fair assessment on their part however it's worth noting that your phone number does not serve as your account ID. It can be used to look up an account but there are caveats to that.
  The lookups go through a secure enclave, the system is architected to limit the number of lookups that can be done, and the system has some fairly extensive anti-exfiltration cryptographic fuckery running inside the secure enclave to further limit the extent to which accounts can be efficiently looked up.
  And of course you can also remove your phone number from contact discovery (but not from the acct entirely) but I'm not sure how that interacts with lookup for subpoenas. If they use the same system that contact discovery uses, it may be an undocumented way to exclude your account from subpoena responses.
  The rest of what they say however is pretty spot on. The priority for signal is privacy, not anonymity. They try to optimise anonymity when they can but they do give up a little anonymity in exchange for anti-spam and user-friendliness.
  So of course the ending notes of "use a VPN, configure the settings to maximise anonymity, and maybe even get a secondary phone number to use with it" are all perfectly reasonable suggestions.
  
  Reply View | 0 replies
smeej 5 days ago

This was before Signal switched to a username system.

Reply View | 2 replies
- ddtaylor 5 days ago
  
  Others mention you must still register with a phone, although you can remove it from your account after you go through the username stuff? Usually HN is pretty good about identifying that the default path is the path and that opt-out like behavior of this means very little for mass usage.
  
  Reply View | 1 reply
  
  OneDeuxTriSeiGo 5 days ago
  
  It's not that you can remove it from your account entirely. Your account is still linked to that number. It's that you can remove the number from contact discovery.
  And re: defaults the default behavior on signal is that your phone number is hidden from other users but it can be used to do contact discovery. Notably though you can turn contact discovery off (albeit few people do).
  
  Reply View | 0 replies

gruez 5 days ago

Which of those links actually say that your phone number is private from Signal? If anything, this passage makes it sound like it's the reverse, because they specifically call out usernames not being stored in plaintext, but not phone numbers.

>We have also worked to ensure that keeping your phone number private from the people you speak with doesn’t necessitate giving more personal information to Signal. Your username is not stored in plaintext, meaning that Signal cannot easily see or produce the usernames of given accounts.