I genuinely do not understand people who have deep fried opinions about Signal needing a goddamn phone number in 2025.

Many privacy nerds were outraged when you needed to give out a phone number to other people in order to talk with them. I was one of those nerds. They fixed that with the usernames rollout.

As a mobile phone app, Signal uses your phone number to bootstrap your enrollment into the protocol. This is literally the path of least resistance as an SMS replacement app, for most users.

If you want to know whether Signal can obtain enough metadata to target users that have enrolled, the answer is complicated.

The way profiles are encrypted, and how sealed sender works, makes any targeting seem infeasible. (Your profile key rotates, at mininum, when you block someone.)

Signal currently does not have IP addresses, etc. stored. If this changes in the future, it will not be retroactive. If you're worried about that, Molly boasts Tor support. Maybe that's fine. I haven't audited Molly, and won't.

The people who tut-tut over the phone number requirement never articulate anything resembling a coherent threat model.

They also are quick to recommend alternatives with inferior cryptography.

Some days I just want to grab them by the shoulders and scream "SHUT THE FUCK UP YOU ARE HURTING PEOPLE" directly into their ears.

"But if my threat model is Mossad, Signal could be forced to-"

No. Stop it. Your threat model isn't fucking Mossad--who could probably pwn half of the entire XMPP ecosystem with a single libxml2 zero-day. (Also maybe Matrix?)

"But my self-hosting"

Irrelevant.

"But jurisdiction"

You think Swiss privacy law will stop the CIA from doing another CryptoAG?

They probably have 10-20 of those floating around already. Private "no log" VPNs are an attractive target for that.

@soatok

"But signal is centralised, that makes it insecure"

Dude, you can't even differentiate reliability/availability from security (and while we're at it, security *for what*), why should we believe a single word?

Oh, and it also seems a requirement to use at least 50 hashtags.

I sometimes wonder if those people are part of a botnet or something

@newhinton @soatok if being ignorant were a botnet, it would be the only one in the world because there wouldn’t be room for any others