Using Signal Without Giving Your Phone Number
Encrypted messaging apps like Signal, as well as WhatsApp and Viber, use your phone number as your main username. This means that if I want to chat with someone on these apps, I have to give them my phone number.
But we may have many reasons — both practical and principled — not to share our number with someone. These digits are personal.
Ideally, apps like Signal would allow us to use something besides our phone number as the main identifier we share with others. For example, a few competing encrypted messengers, such as Wire, allow users to choose a username.
This is a big deal. It means that users don’t need to choose between strong encryption, and protecting other personal information.
So let’s talk about a workaround.
Getting a second number
If you want to withhold your personal phone number, the good news is that you can use a secondary phone number to register for these apps.
For example, on Signal you register a phone number during startup.
You might think you have to use your mobile number, but you can really use any number you have access to.
Here’s the catch: You need to have persistent access to the number. If someone else gets access to it, they can use it to re-register Signal, and you will lose access. The new owner of the phone number can quickly become the new owner of your Signal number.
If you use an alternative number, you also need to keep it.
Here are a few options to help you access an additional long-term number:
- Second SIM. You can register your app with an alternative SIM card, which will give you a new phone number. This second SIM must be kept active with regular account payments, or you will lose the number. To learn more, read this post by Jillian York of the Electronic Frontier Foundation. Note: While in many countries this can be reasonably cheap, in the United States, this typically means purchasing a bundled data and phone plan, which can be expensive.
- Google Voice. If you’re in the U.S. and don’t mind using your existing phone number to sign up, you can use a free Google Voice number. This is easy to set up.
- Twilio. Twilio is a web-based voice and text messaging service. Compared to paying for a traditional phone plan, it’s a relatively inexpensive way to set up a phone number with coverage in dozens of countries. Upon signup, Twilio asks you to put $20 into your account. After that, you pay a monthly fee for your phone number and the cost of exchanging messages — typically one or two cents. Twilio’s fees vary by country. For example, in the U.S., U.K., and Canada, the cost of a phone number is $1 each month, but in other countries, it may be more. Check out the cost in your country.
Let’s explore how to use Google Voice and Twilio for registering apps that require a phone number.
Setting up Google Voice
To sign up for Google Voice, visit voice.google.com, and log in with a Google account. At the bottom of the screen click “Choose Number” and follow the instructions.
Enter a phone number you can use for verification. After receiving a text message with a verification code, enter it to complete your registration. That’s it!
You can now use this number to register on Signal or WhatsApp. When you register with your new number, you will be asked to enter a verification code. You should receive the code in Google Voice and your Gmail inbox.
Once you’ve received the code, punch it into your messaging app to complete your registration.
Setting up Twilio
It takes a little more work, but for an inexpensive secondary phone number, Twilio is a great choice.
To get started, go to twilio.com. At the top, click “sign up.”
Fill out your details, you’ll be asked to verify your phone number.
After entering your number, you should receive a message or call. Punch the verification code into Twilio to complete your signup.
Twilio pays their bills with subscriptions. To get a phone number, we need to upgrade the account by paying a small monthly fee. Once you’re logged into Twilio, click “Upgrade” at the top of the screen.
To keep your phone number active, you need $20 in your account. Fill out your payment information, and add at least $20.
It’s time to choose your new number. Click “Buy a phone number” at the bottom.
From here, search for a number that best suits you. You can choose some parts of the number, including the area code.
Finally, we can forward voice or text messages from our Twilio number to our primary phone number. This lets us receive our Signal verification messages on our phone.
Using the menu on the far left of the screen, navigate to “All Products and Services” > “Runtime” > “TwiML Bins” (or let me link you to TwiML Bins).
Click the plus sign to create a new “bin,” which will automatically forward your messages and calls to your primary number. Replace the current code with the snippets below. You’ll need to replace “your phone number” with a number you’d like to use to receive your forwarded messages.
For text messages:
<?xml version="1.0" encoding="UTF-8"?>
<Response>
<Message to="YOUR PHONE NUMBER">
{{From}}: {{Body}}
</Message>
</Response>For voice calls:
<?xml version="1.0" encoding="UTF-8"?>
<Response>
<Dial>
YOUR PHONE NUMBER
</Dial>
</Response>
Get creative with your names. Give it a totally crazy name, like “my voice forwarding.”
Finally, to receive our verification messages on our phone, we need to activate voice and message forwarding. Navigate to “All Products & Services” > “Phone Numbers” > “Manage Numbers” > “Active Numbers” (or click here).
Click on your Twilio phone number. Change the “A call comes in” field from “Webbook” to “TwiML” and switch to your custom voice forwarding settings by selecting the appropriate bin name (e.g., “my voice forwarding”). Do the same for the messaging settings.
Now you’re ready to use your Twilio number to register for Signal. You will receive your verification codes on the number you used for forwarding. While iOS devices should work with voice and text messages, registration on Signal and WhatsApp on Android is more reliable with voice calls.
One more thing: muting in Twilio
Because each message costs money, after you’ve set up your number and registered for Signal or other apps, it might be worthwhile to silence incoming messages on your Twilio account.
To turn off incoming calls and messages, navigate to “Manage Numbers” > “Active Numbers” (or go straight there). From this page, click on your phone number to change the settings. Remove the web addresses from the “A call comes in” and “A message comes in” fields. Without these fields active, you won’t receive calls or messages.
That’s all! If you want to receive calls and messages, you can always turn this back on later.
Locking down your account
Now that we have a our new number set up, lock the account down.
It’s not unusual for people to reuse their passwords. Attackers count on it.
Whenever there is a large-scale breach, attackers love to try out breached usernames and passwords on multiple websites, probing for additional accounts they can log into. By preventing attackers from reusing your login details, assigning different passwords on each website minimizes damage from breaches.
Consider using a unique password on your Google or Twilio account.
I like to use password managers to keep track of unique passwords, but you may choose to manage unique passwords differently.
You also want to set up two-factor authentication. What does this mean?
When logging in, you can require a second piece of information — a second factor, beyond the password. Typically this second piece of information is a code sent to your mobile device through text messages, or to an app, such as Google Authenticator or Authy. To better protect your account, consider setting up two-factor authentication on Google and Twilio.
If you want to learn more, read up on techniques for defending accounts against common attacks. And enjoy your new number!
Thanks to Harlo Holmes at the Freedom of the Press Foundation for her invaluable contributions to this article.
Last updated September 18, 2017. This article originally appeared in Source.
