> As for [0]; even if no relevant metadata is collected today by whoever owns the servers, nothing stops the party providing the service from doing so tomorrow.

> As for [0]; even if no relevant metadata is collected today by whoever owns the servers, nothing stops the party providing the service from doing so tomorrow. This is a point I see bought up a LOT. I don't believe it to be useful however - proceeding down this rabbithole rapidly leads us to a place of advanced paranoia where we can't get anything useful done. Once you start assuming actual malice on the part of the software developer, even open-source code with the ability to run your own service doesn't protect you - there's multiple ways backdoors can be inserted in sufficiently subtle ways it's extremely unlikely they will be spotted before it's far too late for you. > using strongly identifying codes (phone numbers) as the required identifier — i.e., it is nearly impossible to create a throw-away accoun Identifiers are only valuable if there is something to link that identifier to. Account creation time and last active time are very unlikely to be valuable to your adversary (for any definition of "your adversary" you had a chance at defending against in the first place). In other words, as long as the only data they have is your phone number, then that's not helpful. All that is is a record of a) this phone number exists (which is not secret) and b) this phone number uses signal (which isn't a secret either to any even mildly motiviated attacker).