Embed Notice

@feld @Avitus @VeroniqueB99 @adbenitez @SrRochardBunson

Looking at the server side code, Signal stores the phone number with the account id.

So if the cops were able to decrypt my phone app's database, enumerate all the account ids in my Signal's contacts/messages, they could submit a warrent to Signal a gain access to all the phone numbers associated with those account ids.

The phone number has been my biggest complaint about Signal.

https://github.com/signalapp/Signal-Server/blob/09b50383d77b8b8ec56ab1b74b022db8019cfec6/service/src/main/java/org/whispersystems/textsecuregcm/storage/Accounts.java#L120