It's unsafe. They could lock you out from your Signal account and impersonate you. Someone who does not know you changed your number, forgot about it or does not think about this could then send a message to the person who has your old phone number thinking it's you at the other end. Most people don't bother with the warning about the security number having changed. I also personally assume that the phone number of a contact in Signal is theirs and that I can send an SMS or call them with this phone number. This not being true is at best confusing even if you are not locked out.

It'd also be nice to let the current user of your old number to be able to join Signal without issues.

I'd say don't play with fire and migrate as soon as possible before having issues.

You probably could follow https://support.signal.org/hc/en-us/articles/360007062012-Ch...

Then the people with who you discussed on Signal will be notified of your number change. If you can't follow this, better decide to handle it the best way you can instead of having to deal with this when you have lost access.

Thanks for the link. I have been way too lazy after having the new number for nearly a year. I just couldn't not do it after someone on the internet did the heavy lifting for me.

Happy to know I had a (hopefully) positive impact :-)

Yes, you get your Good Deed For the Day merit badge!

They mention it, use registration lock: https://support.signal.org/hc/en-us/articles/360007059792-Si...

Basically if someone tries to register to Signal with your phone number they'll need to enter that PIN Signal consistently reminds you of.

So if you have a phone number that someone else used to create an account, you can't use Signal?

Close, but not quite.

You see, if the other person didn't use registration lock, now you've got access to complete strangers account.

Problem solved!

Not exactly. Registering again will make an entirely new identity with different key pair. The new phone holder won't get access to your contacts or your message history. I believe your contacts will also know about signature change as well.

Fair enough. I was just making a bit of a joke. :)

Which is less scary than it sounds because a signal "account" is a phone number. Oh no your privacy!

If you view Signal as "a service that allows you to send E2E messages to phone numbers" then this is fine. Your friends will even get a message that says the chat has been rekeyed once the new person sets up Signal.

And if you're worried about government's compelling your cell carrier to turn over your phone number then rest assured that usernames wouldn't help you since they could just compel Signal to turn over your username. So much safer.

As long as the source of identity is something other than a private key that is owned and controlled by the user and devices must have their keys signed by that key to be considered valid it will be the same issue.

I was actually just trying to make a (poor attempt at a) joke. Honestly, I don't really know, or care, how Signal works.

I have no respect or interest in using any service which requires a cellphone to use it by fiat.

I don't really have any great concern about the government requesting my information, not because I "don't have anything to hide" or "because I'm too boring to care about" but simply because I don't care if they do. They will do what they will do. I will do what I will do. It's immaterial for me to worry and fret over the actions of someone else. Governments are simply a form of authority which protect those who pay up, and harm those who don't. It's neither my protector or my enemy, it's just a thing that demands money from me from time to time.

As far as secure communications are concerned, if someone is truly concerned about such things, the only reliable method I'm aware of is a one-time pad. [1] For most, such a system would be far too bulky and cumbersome to bother with, meaning that the communication itself is, in actuality, not worth securing to the highest degree. This, in turn, makes the thousands of digital alternatives "good enough" for all but nation-state threat actors. [2]

[1] https://en.wikipedia.org/wiki/One-time_pad

[2] https://nordvpn.com/blog/nation-state-threat-actors/

They'll create a new key and your contacts will be notified that your key has changed.