Done with Signal? Not so fast

Seth Rosenblatt -

In one revealing nugget of the Mueller Report, the Special Counsel says Trump administration officials used end-to-end encrypted messaging to conceal and delete communications that should be part of the public record. And just after the redacted report’s release on Thursday, The Guardian published another story regarding politicians using encrypted messaging.

In this case, the popular Signal messaging app didn’t adequately disguise the identity of a Washington state representative who had threatened violence against some of his constituents in a private encrypted chat. Because the politician’s phone number remained visible in the app, a Guardian reporter was able to identify him.

The story alleges that Matt Shea, a Republican representing Spokane Valley, had conversations with “right-wing figures” about spying on, intimidating, and violently attacking “perceived political enemies.” Shea is known for supporting the criminalization of abortion, the elimination of gun laws, and the split of eastern Washington into a new state called Liberty State. While Shea used an alias in the chat—“Verum Bellator,” which means “true warrior” in Latin—it did not conceal his phone number.

READ MORE ON SIGNAL AND ENCRYPTED MESSAGING

Primer: Why people are flocking to messaging app Signal
Beyond Signal: How Trump staffers could encrypt and archive
Can we abandon email for secure messaging? Not so fast
Want end-to-end encryption? Use these apps
Organizing a protest? Consider using encrypted apps
Why weakening encryption can hurt you

Signal isn’t the only end-to-end encrypted app in town, of course. Facebook’s WhatsApp, which uses Signal’s encryption protocol but has a different set of features and privacy policy; Threema; and Wire, to name a few, all hide the phone number of the user.

While Signal faces various ongoing usability concerns, privacy complaints against it are rare, except for one. Despite its dedication to protecting user privacy through technology, the app leaves its users’ phone numbers exposed. And because of its reliance on phone numbers as primary identifiers, deleting Signal from a phone doesn’t necessarily guarantee that Signal is deleting the user.

It’s a counterintuitive problem for a world that has grown dependent on apps. You want to use a service, you install the app, and then register with it. When you’ve decided to move on to a different service, you might delete the app and never think of it again.

Moving on from Signal isn’t as straightforward.

Because Signal ties itself to a user’s phone number, uninstalling the app can impair a phone’s ability to receive standard, insecure text messages from other Signal users. If you don’t deregister your phone number from Signal, messages between you and other Signal users will not reach their intended recipient because the service will intercept them. That is, unless the former user follows the steps below.

Switching from Signal to another end-to-end encrypted messaging service (or none at all) is a personal choice, and for many users, number-as-identifier isn’t a problem. Fortunately, if you choose to move away from Signal, and you want to receive text messages normally, Signal’s developers have made it simple to disconnect your phone number from the app.

Deregister Signal on an Android

  1. In the Signal app, tap on the three dots in the upper-right corner to access the menu.
  2. Choose Settings, then Advanced.
  3. Tap ‘Signal messages and calls’ to slide the indicator off, and choose “OK.”

Deregister Signal on an iPhone

  1. In the Signal app, go to the gear icon to access Settings.
  2. Tap the red button to Delete Account.
  3. Then tap Proceed

Deregister Signal on a desktop

  1. In the Signal app, go to the Preferences menu. On Windows and Linux, it will be under File. On a Mac, it will be under Signal.
  2. Choose Clear Data, and then Delete All Data.

Already uninstalled Signal?

If you’ve already uninstalled Signal but haven’t yet deregistered your phone number, you can do so by using Signal’s Unregister form. However, this service requires you to still have access to the phone number you registered with Signal.