Twilio incident: What Signal users need to know
support.signal.org
Twilio incident: What Signal users need to know
1–10 of 512 posts
Re: Twilio incident: What Signal users need to know
#2"...Twilio, the company that provides Signal with phone number verification services..."
Perhaps this is why Twilio (and Twilio-issued) VoIP numbers work so well for Signal when I don't want to use the number issued by my cellular carrier? Kinda hard to SIM-swap me if you don't know my real phone number.
Re: Twilio incident: What Signal users need to know
#3Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal.
...eh, who am I kidding?
Re: Twilio incident: What Signal users need to know
#4>Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered.
I wonder if this was a curious attacker trying to see what they could do with their access, or a targeted attack.
Re: Twilio incident: What Signal users need to know
#5Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
Re: Twilio incident: What Signal users need to know
#6Re: Twilio incident: What Signal users need to know
#7Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
Re: Twilio incident: What Signal users need to know
#8Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
Give people the option to pay. I would gladly pay $100 one time fee if it meant I could avoid having a phone number associated. https://jmp.chat is a great work around but I would rather just have an email address or ideally nothing but a receipt directly associated with my signal account.
Re: Twilio incident: What Signal users need to know
#9Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
How do you deal with spam without requiring a phone number to register?
One option could be to not be able to send unsolicited messages in the first place. Make it required for everyone to "accept interaction" before messages can actually be sent between two parties. Add in rate limiting so you can only have N open "invitations" and spamming should be very limited.
Re: Twilio incident: What Signal users need to know
#10Maybe this will make Signal re-think their hard requirement of a phone number to register for Signal. ...eh, who am I kidding?
which is a curious thing to me as the phone number i created a Signal account with is no longer my phone number. what happens if the person currently assigned that number tries to join Signal and what happens to me if they do?
It's unsafe. They could lock you out from your Signal account and impersonate you. Someone who does not know you changed your number, forgot about it or does not think about this could then send a message to the person who has your old phone number thinking it's you at the other end. Most people don't bother with the warning about the security number having changed. I also personally assume that the phone number of a contact in Signal is theirs and that I can send an SMS or call them with this phone number. This not being true is at best confusing even if you are not locked out.
It'd also be nice to let the current user of your old number to be able to join Signal without issues.
I'd say don't play with fire and migrate as soon as possible before having issues.
You probably could follow https://support.signal.org/hc/en-us/articles/360007062012-Ch...
Then the people with who you discussed on Signal will be notified of your number change. If you can't follow this, better decide to handle it the best way you can instead of having to deal with this when you have lost access.