So 2021 is nearing it’s end, any update on registration other than with a phone number?
For me it’s not about the cost of a phone number, but that you can’t get an anonymous phone number in a lot of contries. So it’s not only about preventing spam sadly, but also about preventing true anonym secure messaging.
This is the only blocker keeping me from using Signal.
Phone number registration isn’t going away. But there is dormant code for usernames and hiding phone numbers waiting to be turned on.
Most of the code for usernames is being finalized recently. So it might actually come out this year.
While this is true, and the Signal team did hint at usernames being available by the end of the year, usernames in their current form will not replace phone numbers for registration, so this feature request will be unaffected for the time being.
@Matombo Also see this post.
Hello,
To weigh in, and give some arguments in favor of having alternatives to the use of ‘phone numbers’.
- Although in many countries there are some concerns regarding surveillance, in other countries it can be outright dangerous. Recently Signal confirmed the issue regarding spam, and the need to do something about this. Most will think of this as a nuisance, but a country like China can utilize this ‘spam’ approach to unearth which of its citizens is using Signal, as all phone numbers are registered. Obviously bots can be reported, but as it could be done by the government, they effectively have infinite phone-numbers and thus bots at their disposal. Having people found out, can lead to a visit by the police, and thus handing over the contact details within Signal putting possibly others at risk.
– They might even go to great lengths to find out phone numbers of citizens living abroad to let them know they are being watched as indicated by for example Freedom House.
- Issue 2 is not nearly as dire, but makes having to use a phone number more annoying, if you travel or move countries reasonably often. Since phone numbers that aren’t being used after some time are often freed up, sometimes within 90 days, this could lead to someone trying to register on the same number perhaps?
I do understand the difficulty of for example using an email address to sign up, as those are easier to mass produce for spam. Perhaps a more elaborate verification process could be used for email signups (find the real link in the email verification, ‘captcha’, type code exactly in the verification screen… etc.) to limit the amount of bots created. In some countries SMS verification messages might also not arrive at all as they are being scanned before delivery and thus intercepted/blocked. Hence, the people that would benefit the most from Signal might be unable to use it. (Yes, they might want to consider other privacy/security focused apps as well, but I think we can all agree that in this case more secure/private options are better than less)
As for the person signing up, this could be a benefit, as a “throw-away” account can be made, or using a service like simple login, hence, increasing the anonymity level, which make some people more comfortable, and other people more secure/safe.
Anyway, thank you for this read.
2 months later
The phone number requirement helps prevent spam, so it’s unlikely there will be an option to register without one.
Odd thing to try preventing spam in a way that compromises user anonymity and therefore also safety, while there’d be many more efficient options out there to tackle the problem of spam without those safety tradeoffs.
Phone number registration is a very low barrier to entry for people that otherwise don’t care about privacy or aren’t tech-savvy. It’s much easier for me to tell elderly relatives to download Signal and register their phone number than to walk them through setting up something like Element.
Signal was never designed for anonymity, but usernames + hiding phone numbers gets close.
What alternative method of registration do you propose? Email? That would probably turn Signal into one giant E2EE spam network.
I also use Threema which does not use phone number or mail for registration. And I did not receive any spam on it (so far at least). Why do you think we would get spammed on Signal if we would get rid of it in Signal?
Because there’s no email or phone registration 
.
Threema has a different problem: it costs money for the consumer app and that has resulted in a much smaller user base. I signed up for Threema years ago and have never sent nor received a single message on it. It’s just as well because I find the UI ugly and dated.
I said spam would be a problem if they replaced phone number registration with email registration.
If they do it like Threema then spam might not be a problem at all. But they’d have to completely rebuild the registration process to remove the phone number requirement. There’s also the danger of over-complicating the on-boarding process. Threema’s is fairly simple, but Signal’s is still simpler.
There is a simple solution: user that signed up by email can’t directly write to user signed up by phone number, their message goes into something like a “waiting queue”, like facebook messenger does.
No reason to fix something that isn’t broken. Maybe they’ll add email as an option in the future or go the way of Threema and have no registration, but right now the registration process is really simple and works consistently, and that’s good for adoption.
So your idea is that requiring phone number is good?
Who says it isn’t broken? If they think paying for a phone number keeps spammers at bay they can very well accept money to provide registrations without any third party identifiers.
But the difference there is phone numbers usually don’t incur a cost for the majority of users – they already have one, so they just use it, but spammers have to spend money to get additional phone numbers to register with. If you just make registrations cost, then everyone has to pay. Unless they just add the paid no-phone-number registration as an optional thing, but then they have to support two registration systems.
Yes, when you already have usernames it doesn’t matter to anyone but you and the server that there is a phone number behind it. Right now server loses money for every phone verification code and user loses money paying some random telco/voip company. It is a win-win situation when you can offer paid registration without phone#. There is already a badge system where they can offer something to someone who is paying.
19 days later
Split this topic on Feb 20, 2022
A post was merged into an existing topic: Allow Signal Desktop to do verification with a plain old flip phone?
4 months later
One hell of a database being built by insisting on it being phone number-tied, since 99.9% of phone numbers are registered to a real person with billing and address details. Of course, that’s not to say it’s the reason the insistence on phone numbers was adopted by Signal. Wire, Telegram, hundred others, can work without phone number. Always makes me chuckle at how the SINGLE BEST and MOST secure messaging app on earth, is tied to phone numbers, making every user targettable, IF that list was ever compromised/bought/takenbyforce.
Oh no they have my phone number!
The reason for this is very simple and has been mentioned many times: Most “normal” WhatsApp users don’t want to ask people for their Threema ID or their Conversations User Name. They want to open their messenger and have people they know showing up automatically. If that is not the case, most “normal” people will simply uninstall the Messenger because they can’t contact anyone with it.
Signal wants to bring secure, encrypted messaging to the masses, therefore they have to offer contact discovery that is as convenient to use as WhatsApp’s.
If Signal would allow registration without any phone number, tech savvy people wouldn’t have a problem, but all their “normal” friends would. I think such a step could very easily make Signal unusable for a lot of people. Also, it could cause people to get left out of conversations because they don’t show up in the contact list, even if they have Signal installed, which is also bad.
and can you tell us when do you think there will be an option to hide the number in the groups? because by now for usernames we have given up
I don’t understand the entire discussion.
You can create a messenger, based on phone numbers, or you can create one, which is completely based on usernames or ID and does not require any phone number at all.
Both products exist.
For any reason, Signal chose phone numbers. They could change that, would be no big deal. But actually, since this thread is going on for more than 4 years now, I guess they won’t do it.
So all who find it important to use a messenger without registering with a phone number - just chose one of the products that offer this feature.
I guess there could be a way to have some options like “hide my phonenumber” or something like that. As far as I know telegram had an option which prevented people from adding you simply by your phone number or was it Line-Messenger? I am not sure anymore but I know I saw such option when I used one of these Messengers.
As Kerli said:
I agree on that fully. If they really wanted to protect the privacy of the users in that specific point they would allready implement it long time ago - but since it’s not I can surely conclude they don’t give a s
Signal tries to reach the masses not the tech pro’s and nerds - so I agree with the statement of Wopfi which makes sense.
So everyone has to consider what is important and what not and move accordingly or should I say chose your messenger app accordingly to your needs.
So let’s hope they will one make it better 
Usernames are coming and a lot of work has gone into it recently. A bit of patience will do a lot of good.
By that, do you mean they are working on removing phone number requirement?
Yes, I have heard the explanations. Unfortunately, they don’t do quite enough to completely remove any suspicions I have. Yes, they want it for ‘the masses’. Why? Altruism? Signal was created as a not-for-profit, so I guess it can only be altruism. I don’t believe in unicorns sadly, so I have to wonder if there is a MAHOOSIVE business being built here, that or an equally mahoosive database which could ‘one day’ change direction dramatically. I am not suggesting it, this is just my worst fear and whilst it’s unlikely, I just wouldn’t be surprised. There are immensely powerful forces at work in the world to force every human to submit to the mass surveillance, tracking, and who knows what next… behavioural/political/opinion modification?!
Call me a cynic, I won’t deny it for a second. Especially when most things I have been cynical about in life have turned out to be realistic outcomes, always called theories until they are not longer theoretical.
Apple spent millions brainwashing the world that they are the “privacy” option. Mega money spent on marketing campaigns, one sign with one word 100 foot wide “Privacy” alongside the Apple logo.
Today, now that a few gazillion are hooked (and trapped in most cases, me included professionally anyway), they are not just NOT the privacy option, they do a deal where Google (the monolithical enemy of privacy and free expression) pay Apple 80-100 BILLION DOLLARS. For what? Oh, ya know, just to hardcode Google/YouTube apps into all Apple devices. Hmm, you really care about promoting privacy Apple, yes, I believe you. 
I certainly hope for the best. I just don’t have blind faith that I have a right to expect it.
I don’t think usernames will come in a way, that most people in this thread wish.
I think they are going to add usernames in some way, but still keep the phone number as main identifier.
This would mean:
You register with your number 4711, and afterwards you choose “John4” as username.
People could then write a message to 4711, which would remain the main qualifier, or to “John4”, if a person would not like to hand over his phone number.
Since this thread here is about the registration process, I think this wouldn’t be a solution.
In case I’m right, I believe this mix of phone numbers and usernames would be the worst possible decision, because all the insecurities about SMS and phone numbers would remain.
I don’t believe they will remove phone numbers completely.
What are you referring to?
Then don’t have blind faith in it lol. Read the source code.
Actually, SMS is a fundamentally insecure way to communicate.
If you define “everyone” as a group, consisting of your mobile provider, any skilled hacker, police and other authorities, including in other countries, it’s pretty safe to say, that everyone can read your SMS, intercept your SMS, manipulate your SMS.
And this can lead to situations like the following:
You know a person John, which you haven’t seen for years, but from time to time, every few months, you write each other an e-mail.
Suddenly, you see John appearing as new contact in your Signal app.
You write him: Hey John, you here? Yes, just installed Signal.
And you start talking to each other…
What John might not know, is, that the police believes he deals with drugs, and decided to register John’s phone number on a police smartphone, to gather information. John might not even know about Signal.
You don’t know about all that either, and since you never meet John, you will not find out for weeks or months.
So you might talk to the police, while thinking you talk to John.
This is possible, because the registration process of Signal is based on phone numbers. And objectively, this is a very very bad way to do a registration.
I use Signal. I use Whatsapp.
Currently I don’t Telegram or any other of the thousand apps out there, which are all based on phone numbers.
I have no idea, if anyone else has registered my phone number on Telegram, or on any other app. I could find out, by downloading all of them, and try.
But this shows:
In a world, where you cannot trust your mobile provider or any authorities, register for any service with your mobile phone number is a very bad idea.
This is exactly why contact verification exists. I’m not referring to drug deals though.
OK - I hope you are right and one day (before I retired or WW3 breaks out) I will see it happen lol
But to be honest some things make no sense what the developers are doing like implementing GIFs but there is till to day no option to stop those f
Animations for menues? Why? Does it improve security? privacy? speed? improve battery life because the cpu/gpu has to calculate all those fancy things?
There are a lot of things…trust me if I wanted there would be an entire page (or more) but this off topic and I don’t want to mix things up.
regarding the phonenumber etc. the best and simple solutions would (from the very first beginning of singal):
- registration via e-mail
→ People can chose if they want to use real or fake mails. Both have valid cons and pros.
- You can activate that people can add/see you by your phonenumber or with your username or whatever.
→ With a small information for the user that phonenumbers is recommended for everyday joe. it’s user friendly and if someone is nerdy and wants more privacy and controll of his account he can opt for only adding by something else and he has to make sure that people who want to contact him have the “whatever” to get in contact with him.
Simple. Easy. Quick. If I would know how to code I would fork signal or create my own app implement it and people would be happy and signal would after a while obey after they lose a lot of users to me then you would implement it too 
even though this is sarcasm and should be taken with humor but it’s sad that such simple solution is not implemented but nonsense like menue animations etc. are getting more attention.
this rise a very solid concern from users who have the bad feeling that some entity behind the scene forces signal to this route instead using common sense.
let’s drink tea and see what will happen…
You have to realize that different developers in general have different specialties. Different features are developed in tandem by different devs. Just because we aren’t seeing a particular feature doesn’t mean time is being wasted. It’s worked on then pushes to github whenever the public clients can benefit from it.
OK. In theory it sounds good in reality I see the outcome.
May be that could be a weak point of singal developement? Who knows. I just see the outcome. When you go to a restaurant do you see all the people who are involed for you food? no! and you don’t care. Important is the outcome because that’s what is visible.
Don’t get me wrong here. I don’t just rant for no reason or try to make signal bad. I use it and recommend it (even with it’s flaws!) - because I see it is in its core some way better than whatsapp and telegram … but (and it’s a gigantic but lol pun intended) we the users have the right to complain and bring up constructive criticism.
This is pretty standard in the industry.
That’s pretty much how Threema and Matrix handle things. And it leads to exactly the problems I described above. If discovery by phone number is not the default, hardly anyone would activate it. Security conscious people because they want to share as little data as possible and “normal” users because they just want to chat and don’t like to make extra steps when installing a new App (people complained in this forum that even Signal’s current installation process is to complicated). This would lead to the same problem that even Signal had in the past: When someone opens the App it looks like nobody uses it. And a Messenger where you can’t message anyone is no use. So a lot of people tell other people that the App is useless.
I tried Threema before I even knew Signal. And I’m still using it today. Only 4 of my contacts show up in it. Either because the others don’t use it or because they use E-Mail addresses I don’t know. Either way it is pretty much useless. I also tried Matrix where I had 0 contacts. Possibly for the same reasons. This is not the way a messenger for daily use should work. Sure, I would prefer to sign up anonymously, but it’s more important that i can talk to my colleagues, family, friends and people I randomly meet securely without any additional steps.
Edit: PS: On Signal, 100% of my conversations in the past 7 days were Signal messages. So obviously, everyone I regularly communicate with is on Signal. That is a big difference to Threema and Matrix.
After thinking about it - I just decided to edit out my post. It’s getting OT and that’s not good. But I just edited not deleted it.
I don’t get it, why a registration process with external identifiers is necessary.
I would prefer one of the two solutions:
- On registration, you get an unique ID, which is given to you by the system. This ID is your identifier. No need for a phone number, no need for any e-mail.
Examples: Session is doing it like this, and Threema can also be used like this (you don’t need e-mail or phone number for Threema registration, but you can add them, if you like).
- On registration, you have to chose a username, and then a password. Just like chosing an e-mail address at any e-mail provider. This username is then your main identifier. Wickr Me is doing this I think.
If you don’t use an identifier known to your friends when registering, how should your friends contact you without asking you for your cryptic ID.
That is the great advantage of your phone number. All the people who want to communicate with you already have it. Only a few will have your e-mail and no one will have some random ID generated by the App, without manually entering it.
It the “empty contact list” problem once again.
Well, if you want to call someone by phone, you call his phone number. If you write someone an e-mail, you need his e-mail address (phone numbers do not work here), and if you contact someone on a messenger, which is based on IDs, your friends have to know this ID. That is not so complicated.
Have you read even one of my other posts?
2 months later
Even if 1900 numbers out of perhaps a few hundred million are nothing earth-shattering, the data theft at Twilio can be used once again to talk about this topic.
What are the arguments against abolishing the obligation to provide a phone number when registering?
Is it just the simple unique identification of users?
And the ease of adding new contacts?
Apps like Threema, Session, Matrix and many others manage without a phone number.
Of course, they don’t have as large a user base as Signal, but it still seems to work without any problems.
You can still voluntarily enter your phone number / email etc. and be found via it (as Threema does).
How is Signal’s unique user identification?
Is an ID generated from the phone number or is everything done via the number itself?
9 days later
Split this topic on Aug 25, 2022
5 posts were split to a new topic: Using Signal to send messages from a server
9 months later
Hopefully Signal won’t lose ground on WA and registration without phone number will soon be implemented with Signal:
WhatsApp could soon let you text users without having their number — https://www.xda-developers.com/whatsapp-username-development
That WA feature isn’t about signing up without a phone number, but about contacting people via usernames - something that is also a FR in Signal that is being actively developed as we speak.
Probably you are right although the news article does not state it explicitly. But the next step might come and registration without phone number may get possible for WA.
I really hope Signal can introduce registration without phone number sooner than later. Other messengers like Wire or Threema had this implemented for a long time.
2 months later
can signal please go out of its way to not require me to register with a data point that is trivial to use for identifying users (phone numbers) or at least give me the choice
Users taught the idea that Signal takes a lot of effort to not collect data on its users. The less signal knows about you, the better. Noble in my opinion. We trust signal enough to use the service and app’s, but still want to operate under a risk adverse posture. Makes sense.
That same logic however applies to users communicating with one another. Sometimes the people we communicate with we barely know. Sometimes the person you once trusted, you no longer trust. It’s good to take that same risk adverse posture described between signal and its users and give the same luxury for user user relationships.
- Usernames in Signal
- Can Signal protect against communicating with adversaries? Will username protect phone number in this case?
I’m in support of that as well. Another option in the meantime though is to get a burner number that’s not tied to your identity in order to just use with Signal.
What is the risk with using a phone number within Signal with trusted people? Could you explain please?
Being contacted outside of Signal and be tied to something you can’t easily change without updating a whole universe of settings
And when the number eventually gets reassigned to somebody else you will lose control of your reset info and whoever has the number can lock you out of your own account
You can keep the burner number. In netherlands you can buy a prepaid for €5 that lasts forever if you make every 6 months a paid call or sent an sms, thats €0,20 every 6 months
A phone number would also geo locate you since each country has a unique set of starting digits.
sIgNaL iS nOt sUpPoSeD 2 bE aNoNyMoUs
No, but it could at least try.
I’m sorry, where exactly are people getting my number from the service? Tracking analysis? Reverse lookup? Can you explain how this proposed geolocation and how somebody would find the number in the first place would work?
1 month later
That’s the crux here is that you can ONLY use signal with trusted people. I like talking to people on the internet/internet friends but I don’t need them knowing my number. Especially when we’re dealing with creating a group for dozens if not hundreds of people.
I guess that’s why Session exists.
That’s something completely separate from a phone number being required to register, and will be taken care of as soon as usernames and phone number privacy are released.
3 months later
Session abandoned the Signal Protocol several years ago and created their own, which is a cyber security red flag, so their security and privacy are now dubious at best.
1 month later
security
So is signal desktop storing DB keys in plaintext last I checked, and not even using the system keystore, and not telling the user so.
And all these question and probing of “why, why do not want a number. Singal isn’t anonymous, isn’t for this isn’t for that”. It’s like an interrogation on each OP for each post in a feature request. It is the same thing over and over in threads again and again, by the roughly the same set of regulars. Why is that users have to fight for a feature?
It is just so frustrating overall.
Because you’re selfishly pissed off that Signal’s focus remains on the mission statement rather than on a shiny new toy for the already pretty full and organized enough box.
It’s not a new gripe, but it still annoys me each time that I see a barely veiled framing accusation that Signal’s on the path to falling.
It is more than a little laughably sad that the GIF button on the desktop side is still unimplemented… but you don’t see me hysterically posting about Meredith and the Signal team’s intentions or their reputations every damn day because of it.
It’s just an embarrassing miss out and a slight inconvenience.
But Signal is still my daily driver because it protects and encrypts mine and my chosen contacts’ communications while allowing us to be who we are on our terms. I can shake my head on occasion and still defend Signal on its merits at the same time.
You misunderstand.
The frustration isn’t the “whining” about the small fancy pretty “features”. I have neither cooked up conspiracies about the top head, nor was my message a thinly veiled whatever claiming signal is failing.
It’s some of the people here interrogating users who make posts, stamp it down into the ground, and sometimes basically say “I’m fine without it why do you need it”. But sure call me selfish. “I like it this way, and so should you. You are mistaken, this is good for you”. The amount of patronizing is just making mind boggling. If things are fine for you so be it more power to you let the fella make their request. If you don’t like it ignore it, report it, and move on.
Looks like you took it personally. You identify with the “regulators” I mention? Either way, all said and done the thread dies with the poster conceding defeat feeling like they are in the minority, and just using it as is.
1 month later
What is the red flag? I use session a lot so I’d love to know. I like how session uses tor? to obfuscate the IP address? Session is great for talking to people anonymously. Signal is anti anonymous and everything you say to anyone is tied back to a real world ID aka your phone unless you buy a burner phone.
1 month later
Signal requires a cell phone number as a login flaw
- The SIM operator can block text messages from its own Signal.
- The SIM operator and FBI can use your mobile phone number to log in. unless you set up TOTP
- If the SIM operator deletes your mobile phone number, your Signal will not be logged in if it is scrapped. .
The best solution.
- phone number + login password
- No SMS messages, including verification codes, will be sent to the cell phone number.
- Signal login does not require SMS verification code.
Using cell phone number SMS verification code, carriers block Signal without any difficulty.
Signal runs on the p2p Federal DApp network, strong censorship resistance.
No it can’t. Signal is operated on its own network. If you have the internet, you have Signal (yes, there are authoritarian exceptions. Don’t @ me).
Even if your account is taken over, there is no historical data that the person taking it over would see. Also, contacts etc. are protected by your Signal PIN, which has been around for several years.
This is incorrect. Signal has absolutely no reliance on the mobile carrier. It is operated on an independent network from the mobile carrier. Once you register a number on Signal’s network, it lives forever on Signal’s network until it’s deleted manually or deleted for inactivity (after a year, iirc). Re-registering becomes the problem if a mobile carrier deletes your number, but even that is easy to overcome by just getting another number and using the change number feature in Signal.
In China, SMS from Signal is blocked by the operator’s keyword censorship! I can’t receive Signal SMS using a proxy, I don’t know if it’s the same in Iran.
Unfortunately, the flip size of using SMS based registration is that non technical people from repressive countries are excluded from the network, and those people need encryption the most. It’s a hard tradeoff.
You will need to register using an online service that provides SMS unfortunately. Hopefully Signal can provide tools to register phone-numberless using a token or something you can purchase.
1 month later
As Signal now supports usernames, I’d like the option to abandon my gov’t co-opted tracking number (phone number) please! 
Does anyone know when this will happen?
