Signal Security Checklist

A lot of community organizing happens in unvetted groups on Signal where you don't know how much you can trust everyone in the group. These groups can be infiltrated by right-wing adversaries and law enforcement.

Using a fake name prevents someone from finding your real identity through a Google Search.

Using a photo that isn't your face prevents someone from finding your social profiles based on an image match or facial recognition.

Both steps help defend you against doxxing and online harassment.

Remind people in your groups to do this as well. Security is a team sport.

The best upgrade everyone can make to their use of Signal is to make sure that disappearing messages are enabled by default. Most activists we talk to haven't enabled this by default. (And most people forget to enable it manually for each new thread.)

This keeps you safe and other people safe. We don't know who's phone will be seized by law enforcement. Even if we believe we're talking about perfectly legal things, the government can find ways to twist our words to attempt to make a case against us for our dissent

There are two things to track related to disappearing messages:

1. First, change your default so any thread you make has this feature enabled.

2. Second, make sure it is enabled for threads that other people start: if someone else starts the thread, it may not have disappearing messages enabled. You may need to enable it.

Choosing your disappearing message time: How long you set your disappearing times depends on the sensitivity of your messages. A question you might ask yourself is "if someone's device was confiscated or hacked, how important is it that these messages are not accessible?"

• For chatting about low-risk things with friends, you might choose 4 weeks.

• For standard political organizing, you might choose 1 week.

• For a direct action, you might set it to 1 day or 1 hour or 5 minutes, so the messages are gone before the action starts.

If your phone is confiscated by law enforcement, one of the biggest risks is exposing your entire network. Even if people aren't using their real name on their Signal account, there is still a unique ID behind every Signal username. And the cops can use this to correlate someone's identity across many seized devices.

You need to both leave AND delete the group:

• If you only leave the group, old messages stay on your phone as well as the history of who was in the group.

• If you only delete the group, new messages will still come through and the thread re-appears.

Security hygiene tips:

• Set a recurring remind to clean up your Signal thread every 3 months.

• Make sure you take note of which groups you are leaving and who you can ask to re-add you after the action.

Note: If you find this process very annoying and cumbersome (because it is!), that's another good reason to use a secondary phone for actions. That phone would only ever be in the one or two groups needed to pull of the action that day.

A highly-motivated attacker could try to take over your cell phone number through something called "SIM Swapping" or by trying to call your service provider and initiate a phone number "port" to a new provider. They could then use your phone number to register a Signal account and start receiving messages meant for you.

These are advanced attacks that don't happen to most folks. Still, it is easy to protect your Signal account.

You can protect yourself by enabling registration lock on Signal. It prevents someone from hijacking your account even if they steal your phone number. No one will be able to register a new Signal account on your number until your account has been inactive for 7 days.

If you forget your PIN, you will have to wait 7 days before you can create a new account (and your contacts will not be recovered). More on PINs & registration lock.

On Android, the default keyboard can log what you type.

There have been an increasing number of fake messages from "Signal Support" that are attempting to hijack your account.

Use these examples below to keep an eye out for fake signal messages.

Remember: Signal will never ask you send them your PIN or verification code. It will only be asked of you when you are installing the app for the first time on a device.

Read more about Signal scams/phishing.

Here are some examples of scam messages: