5 ms·

This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about th

by g_sch 4y ago

This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies. As far as I can tell, Signal uses Twilio only to send SMS for phone number verification. Verification happens when a user registers a new number or changes the number on their existing account. The rate at which Signal is adding new users could be calculated by: 1900 * (proportion of new registrants among SMS recipients) / (length of Twilio incident) You could probably make some common-sense assumptions about the first variable. But I can't find any publicly available info on when Twilio was first compromised. Their press release only mentions that they discovered the intrusion on August 4, which is presumably close to the end date of the incident. Does anyone know what the estimated start of the incident might be?

gsdofthewoods 4y ago
Signal's SMS registration codes expire after a few minutes, so you wouldn't even need to know the duration of the incident. Let's be conservative and say the codes expire after 5 minutes (it's probably shorter), then Signal is registering 380 devices a minute.
- g_sch 4y ago
  My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise: > During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code. The attacker no longer has this access, and the attack has been shut down by Twilio.
  - sgc 4y ago
    At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate. It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system: > 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed. We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.
- vgel 4y ago
  380 devices / minute would imply Signal is adding 547,200 users / day, or 199,728,000 users / year. That seems way too high. Granted some could be multiple devices per user, but still...
  - tobyjsullivan 4y ago
    200M users/yr does not sound unrealistic to me given the network effects of Signal. I'm certainly not suggesting that's the actual rate - but I'd be willing to believe it's within an order of magnitude. Here's an article from last year mentioning 50M+ downloads in 10 days. https://webcache.googleusercontent.com/search?q=cache:hsVnnQUgNpAJ:https://www.bloomberg.com/news/articles/2021-05-28/signal-app-is-surging-in-popularity-and-hitting-growing-pains&cd=1&hl=en&ct=clnk&gl=ca https://webcache.googleusercontent.com/search?q=cache:hsVnnQ...
    - carschno 4y ago
      > Here's an article from last year mentioning 50M+ downloads in 10 days. That was a period in which WhatsApp had just announced their new ToS, indicating that the data about their users was to be merged with Facebook's. Consequently, many users became aware of the enormous privacy issues with all Facebook/Meta products, and abandoned WhatsApp for other services, mostly Signal and Telegram. I doubt that this period can be used to interpolate the Signal growth for the rest of the year, although the network effect has probably resulted in a much higher growth rate than before the WhatsApp exodus. Edit: a Tweet from Elon Musk ("use Signal") most probably contributed a lot to that raise in awareness, and the one-time surge of increased growth for Signal.
  - junofan 4y ago
    That sounds right.
  - williamscales 4y ago
    It would also include re-registrations, fwiw.
  - alfrede81 4y ago
jorvi 4y ago
> This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies. I am assuming US or Germany. I can't remember which thing it was exactly but there was a huge privacy scare in the US at some point which got people to switch in droves to Signal. Maybe the WhatsApp T&C change? German's have always been more privacy-aware (hence they have a much bigger cash payment culture than almost anywhere else in North-West Europe) and it seems like a steady trickle is switching over. But for example here in The Netherlands, I'd say 99% of people is on WhatsApp, 10% is on Telegram, and 0.1% is on privacy-focussed messaging services.
- mpol 4y ago
  You might be in a different bubble than I am in :) Netherlands here. 80 contacts on my phone. 20 on Signal, of which 10 are quite normal people. Almost all 80 are on Whatsapp. No idea about Telegram.
  - jorvi 4y ago
    Are you aware you are by far, far far far, irregular?
  - SnowVivid 4y ago
    Belgium here. I don't have WhatsApp, Messenger, or any social network account. I only use Signal. Most of my contacts are on Signal (meaning people from work or close friends/family). I would say ballpark 85%+. My shrink and MD are on Signal. I'm lucky enough to work for an organisation that promote and emphasis privacy and security. I'm also quite a good evangelist to my family and few friends ;-) Once I step out of that circle/bubble of people, I realize how peculiar my situation is, mind you. I have 2 teenagers and sometimes I have to communicate with "regular" people. EDIT : in that case, I use regular email, SMS or phone calls. WhatsApp is widely used in Belgium, as is Messenger. My wife tried to remove WhatsApp at some point, but that made her social life too difficult.
zamadatix 4y ago
> Verification happens when a user registers a new number or changes the number on their existing account. Doesn't verification also occur when you re-install the app? Between that and how hard Signal makes device <-> device upgrade transfers I wouldn't be surprised if most messages were for existing users.
- chopin 4y ago
  My wife and me recently bought new phones and had no trouble transferring Signal whatsoever.
sandgiant 4y ago
Interesting idea. The number could also be an attempt to cover up their actual intention of targeting specific users. Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered.

by g_sch 4y ago

gsdofthewoods 4y ago

Signal's SMS registration codes expire after a few minutes, so you wouldn't even need to know the duration of the incident. Let's be conservative and say the codes expire after 5 minutes (it's probably shorter), then Signal is registering 380 devices a minute.

g_sch 4y ago
My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise: > During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code. The attacker no longer has this access, and the attack has been shut down by Twilio.
- sgc 4y ago
  At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate. It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system: > 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed. We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.
vgel 4y ago
380 devices / minute would imply Signal is adding 547,200 users / day, or 199,728,000 users / year. That seems way too high. Granted some could be multiple devices per user, but still...
- tobyjsullivan 4y ago
  200M users/yr does not sound unrealistic to me given the network effects of Signal. I'm certainly not suggesting that's the actual rate - but I'd be willing to believe it's within an order of magnitude. Here's an article from last year mentioning 50M+ downloads in 10 days. https://webcache.googleusercontent.com/search?q=cache:hsVnnQUgNpAJ:https://www.bloomberg.com/news/articles/2021-05-28/signal-app-is-surging-in-popularity-and-hitting-growing-pains&cd=1&hl=en&ct=clnk&gl=ca https://webcache.googleusercontent.com/search?q=cache:hsVnnQ...
  - carschno 4y ago
    > Here's an article from last year mentioning 50M+ downloads in 10 days. That was a period in which WhatsApp had just announced their new ToS, indicating that the data about their users was to be merged with Facebook's. Consequently, many users became aware of the enormous privacy issues with all Facebook/Meta products, and abandoned WhatsApp for other services, mostly Signal and Telegram. I doubt that this period can be used to interpolate the Signal growth for the rest of the year, although the network effect has probably resulted in a much higher growth rate than before the WhatsApp exodus. Edit: a Tweet from Elon Musk ("use Signal") most probably contributed a lot to that raise in awareness, and the one-time surge of increased growth for Signal.
- junofan 4y ago
  That sounds right.
- williamscales 4y ago
  It would also include re-registrations, fwiw.
- alfrede81 4y ago

jorvi 4y ago

> This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies. I am assuming US or Germany. I can't remember which thing it was exactly but there was a huge privacy scare in the US at some point which got people to switch in droves to Signal. Maybe the WhatsApp T&C change? German's have always been more privacy-aware (hence they have a much bigger cash payment culture than almost anywhere else in North-West Europe) and it seems like a steady trickle is switching over. But for example here in The Netherlands, I'd say 99% of people is on WhatsApp, 10% is on Telegram, and 0.1% is on privacy-focussed messaging services.

mpol 4y ago
You might be in a different bubble than I am in :) Netherlands here. 80 contacts on my phone. 20 on Signal, of which 10 are quite normal people. Almost all 80 are on Whatsapp. No idea about Telegram.
- jorvi 4y ago
  Are you aware you are by far, far far far, irregular?
- SnowVivid 4y ago
  Belgium here. I don't have WhatsApp, Messenger, or any social network account. I only use Signal. Most of my contacts are on Signal (meaning people from work or close friends/family). I would say ballpark 85%+. My shrink and MD are on Signal. I'm lucky enough to work for an organisation that promote and emphasis privacy and security. I'm also quite a good evangelist to my family and few friends ;-) Once I step out of that circle/bubble of people, I realize how peculiar my situation is, mind you. I have 2 teenagers and sometimes I have to communicate with "regular" people. EDIT : in that case, I use regular email, SMS or phone calls. WhatsApp is widely used in Belgium, as is Messenger. My wife tried to remove WhatsApp at some point, but that made her social life too difficult.

zamadatix 4y ago

> Verification happens when a user registers a new number or changes the number on their existing account. Doesn't verification also occur when you re-install the app? Between that and how hard Signal makes device <-> device upgrade transfers I wouldn't be surprised if most messages were for existing users.

chopin 4y ago
My wife and me recently bought new phones and had no trouble transferring Signal whatsoever.

sandgiant 4y ago

Interesting idea. The number could also be an attempt to cover up their actual intention of targeting specific users. Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered.