Signal has started rolling out Signal Login, an optional registration method that allows users to create a Signal account without providing a phone number. The feature will be rolled out first on Android and will come to iOS later.
As we previously reported, Signal Login is not a free alternative registration method. Signal requires users who choose to register without a phone number to make a one-time payment. The price at launch is $2.99 / € 3.49, although this may vary by region and currency.
Signal knows the creation time of your account.
Google knows the timestamps of every transaction made through Play Services.
Law enforcement wants to deanonymize an account and subpoenas Signal for the creation time of the account, which Signal will provide them.
Law enforcement subpoenas Google for the records of all Play Services users who paid for Signal Login at that time, plus or minus a few minutes.
Law enforcement now has a shortlist of suspects. If Signal Login is paid for by 1 million users per year (unlikely) then that’s one user every 30 seconds on average. A 5 minute window of time will be a list of 10 individuals, identified by their payment details and Google account.
They could, for the time being, do account creation in bulk perhaps at infrequent intervals. Somewhat annoying for users, but would provide at least a bit more obscurity.
I’ve looked at unsealed records provided by the Signal Foundation, and they definitely have the account creation and last accessed date… But besides that, is there really any information authorities can glean from this? Or is it simply the issue that this leaves users at square one, if they’re trying to avoid connecting an identity (be it phone, or Google, which generally requires a phone) to it?
For me, I see this as a potential boon for simply having a second account without having to go through the rigmarole of maintaining an extra SIM card.