2022-05-31 11:48
by Dr. Martin Shelton-Principal Researcher at Freedom of the Press Foundation
If you use Signal, the secure messaging app, you may have thought about a second account so you don’t have to give out your personal phone number. The good news is you don’t need another phone plan to use a second Signal account, and you may be able to set it up on a range of devices.
We’ll walk you through how to get a secondary phone number, how to choose the best device for it and also review some safety considerations for using the messaging app.
If you haven’t tried Signal, check out our guide to get started.
You can register a Signal account with any phone number you have ongoing control over as long as no one else has registered it. It doesn’t have to be your personal phone number — there are a few ways to get a second phone number.
For those in the United States, the easiest way to set up a secondary number is with Google Voice. (Your Signal messages are only on Signal’s servers, not Google’s servers.) Go to voice.google.com and log in with a Google account. From here you can claim a number, following the verification and registration prompts.
In most countries you can visit a phone store and purchase an inexpensive SIM card to get another number. Read this post by Jillian York of the Electronic Frontier Foundation to learn how. You can also use a service called Twilio to purchase a phone number for as little as $1 a month, though it requires following some more complex instructions. Learn how.
Use this new number to register your Signal account to a new device.
Signal registration message received in Google Voice. Source: OpenNews
The question now is, where will you install this second Signal app?
It’s possible to download Signal on numerous devices, and sometimes you can even install two Signal apps on the same device. For example, many newer Samsung Galaxy devices support a feature called Secure Folder, which will allow you to have a secondary Signal installation on the same device. However, this is not available on all smartphones. Likewise, there are apps for creating secondary app “clones,” but we can’t speak to how secure they are. The most reliable option is to use a secondary device.
You can set up Signal on all of the following devices, using Wi-Fi (no phone plan needed):
Whichever type of secondary mobile device you use, we recommend using a device you can keep long-term. While there is a Signal desktop app, it must be linked to the mobile app, so you should hold onto your mobile device.
If you use a smartphone or an iPod, the registration process is already familiar to you. The only difference is that you’ll now set up Signal with a secondary phone number.
One note on the iPad: By default Signal will invite you to link your iPad to your existing Signal account. That’s not what we want this time. Instead, click the icon at the top right corner, circled in red in the image above, to set up a new Signal number. From here you can register with your iPad just as you would with a phone.
If you have any trouble installing, ensure your device is fully updated. Signal will only work on newer versions of Android and iOS.
Before using Signal Desktop on your computer, you must first have the Signal app set up on your phone.
You can run two accounts simultaneously on Signal Desktop — the official version, and the beta version. Each of these will allow you to receive your Signal messages in a separate window, each with a separate account. From Signal.org you can download and install both the official desktop version here and the desktop beta version here.
Note that the Signal team says the beta version is for those “who do not mind discontinuity in service”. Like other beta software, it may occasionally break.
After they are installed, follow the instructions to “Link your phone to Signal Desktop” by scanning the QR code with your secondary mobile device. If you have another unused Signal Desktop installation and you’ve set up your secondary mobile device, you can repeat this process with your second Signal Desktop app.
Now you can run two Signal accounts on one desktop device.
Note that the desktop application is more limited than the mobile version, and will not allow you to control all of your Signal settings on its own. You will want to keep hold of the secondary mobile device you used to install Signal to access these settings.
While creating a second number might help you protect your personal phone number from new contacts, remember that Signal is not designed for true anonymity. For example, whether it’s through Google Voice, Twilio or a traditional phone company, your phone service provider can often tie your phone number to you. Think of this second number as a username you can hand out, but it does not necessarily protect your identity.
Continued access to your phone number ensures that no one else can register Signal with this number. Enable Registration Lock to prevent someone else from taking over the account, by requiring a PIN.
iPhone users: Click Settings > Account > Registration Lock > Enabled
Android users: Click Settings > Account > Registration Lock > Enabled
From now on, the Signal app will occasionally send you a prompt to re-enter your PIN to ensure you’ll remember it, and you will need this code if you attempt to move your Signal account to a new device. Consider writing this number down or keep it somewhere safe, such as a physical notebook or a password manager.
No amount of end-to-end encryption will protect you from someone just picking up your phone and reading the messages. Whichever devices you use, enable a strong screen lock password.
iPhone users: Settings app > Face / Touch ID & Passcode
Android users: Settings app > Security > Screen lock (this might be slightly different, depending which device you have)
Even with a passcode enabled, many devices do not encrypt your data on your device. This means if your device is ever lost, stolen or seized (say, at a border checkpoint), anyone who has the device can still copy your data. The good news is that it’s easy to prevent this by enabling disk encryption. Consider turning on disk encryption for all of the devices where you use Signal.
Likewise, if any of your Signal devices are compromised with malware an attacker might have remote access to your infected device. The best defense is to install updates for your apps and devices as soon as they are available. These updates contain valuable patches to security vulnerabilities that are regularly discovered by security researchers.
If you are purchasing an Android device to create a secondary Signal account, this is also why we strongly recommend getting a newer device. On many devices, Android only guarantees two years of security updates after a device’s release date. If you go this route, be sure to purchase a recently released device.
