> Verification happens when a user registers a new number or changes the number on their existing account.

Doesn't verification also occur when you re-install the app? Between that and how hard Signal makes device <-> device upgrade transfers I wouldn't be surprised if most messages were for existing users.

My wife and me recently bought new phones and had no trouble transferring Signal whatsoever.

Signal's SMS registration codes expire after a few minutes, so you wouldn't even need to know the duration of the incident. Let's be conservative and say the codes expire after 5 minutes (it's probably shorter), then Signal is registering 380 devices a minute.

My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise:

> During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code. The attacker no longer has this access, and the attack has been shut down by Twilio.

At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate.

It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system:

> 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed.

We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.

380 devices / minute would imply Signal is adding 547,200 users / day, or 199,728,000 users / year. That seems way too high. Granted some could be multiple devices per user, but still...

200M users/yr does not sound unrealistic to me given the network effects of Signal. I'm certainly not suggesting that's the actual rate - but I'd be willing to believe it's within an order of magnitude.

Here's an article from last year mentioning 50M+ downloads in 10 days. https://webcache.googleusercontent.com/search?q=cache:hsVnnQ...

> Here's an article from last year mentioning 50M+ downloads in 10 days.

That was a period in which WhatsApp had just announced their new ToS, indicating that the data about their users was to be merged with Facebook's. Consequently, many users became aware of the enormous privacy issues with all Facebook/Meta products, and abandoned WhatsApp for other services, mostly Signal and Telegram.

I doubt that this period can be used to interpolate the Signal growth for the rest of the year, although the network effect has probably resulted in a much higher growth rate than before the WhatsApp exodus.

Edit: a Tweet from Elon Musk ("use Signal") most probably contributed a lot to that raise in awareness, and the one-time surge of increased growth for Signal.

If by some you mean... quite a lot?

I've registered dozens of devices, since the account pairing expires after five minutes (ok, slight exaggeration).

i found this site with data about users and downloads https://www.businessofapps.com/data/signal-statistics/

That sounds right.

It would also include re-registrations, fwiw.

Interesting idea. The number could also be an attempt to cover up their actual intention of targeting specific users.

Among the 1,900 phone numbers, the attacker explicitly searched for three numbers, and we’ve received a report from one of those three users that their account was re-registered.

> This info gives us an interesting opportunity to estimate the rate at which Signal is adding new users. They've been very tight-lipped (understandably) about their usage stats but anecdotally they seem to be an increasingly common presence on my friends' phones, even the non-techies.

I am assuming US or Germany.

I can't remember which thing it was exactly but there was a huge privacy scare in the US at some point which got people to switch in droves to Signal. Maybe the WhatsApp T&C change?

German's have always been more privacy-aware (hence they have a much bigger cash payment culture than almost anywhere else in North-West Europe) and it seems like a steady trickle is switching over.

But for example here in The Netherlands, I'd say 99% of people is on WhatsApp, 10% is on Telegram, and 0.1% is on privacy-focussed messaging services.

You might be in a different bubble than I am in :)

Netherlands here. 80 contacts on my phone. 20 on Signal, of which 10 are quite normal people. Almost all 80 are on Whatsapp. No idea about Telegram.

Belgium here. I don't have WhatsApp, Messenger, or any social network account.

I only use Signal. Most of my contacts are on Signal (meaning people from work or close friends/family). I would say ballpark 85%+. My shrink and MD are on Signal. I'm lucky enough to work for an organisation that promote and emphasis privacy and security. I'm also quite a good evangelist to my family and few friends ;-)

Once I step out of that circle/bubble of people, I realize how peculiar my situation is, mind you. I have 2 teenagers and sometimes I have to communicate with "regular" people. EDIT : in that case, I use regular email, SMS or phone calls. WhatsApp is widely used in Belgium, as is Messenger. My wife tried to remove WhatsApp at some point, but that made her social life too difficult.

Are you aware you are by far, far far far, irregular?