Why does Signal want a phone number to register if it's supposedly privacy first?
I remember a time when visiting a website that opens a javacript dialog box asking for your name so the message "hi
<name entered>
" could be displayed was baulked at.Why does signal want a phone number to register? Is there a better alternative?
So, you're going to get two schools of thought on this, and one of them is wrong. Horrendously wrong. For perspective, I was a certified CEHv7, so take that for what its worth.
There's a saying in security circles "security through obscurity isn't security," which is a saying from the 1850s and people continually attempt to apply the logic to today's standards and it's--frankly stupid--but just plain silly. It generally means that if you hide the key to your house under the floor mat, there's no point to having the lock, because it doesn't lend you any real security and that if you release the schematics to security protocols and/or devices (like locks), it makes them less secure. And in this specific context, it makes sense and is an accurate statement. Lots of people will make the argument that F/OSS is more secure because it's openly available and many will make the argument that it's less secure. But each argument is moot because it deals with software development and not your private data. lol.
When you apply the same logic to technology and private data it breaks down tremendously. This is the information age. With a persons phone number I can very likely find their home address or their general location. Registered cell phones will forever carry with them the city in which they were activated. So if I have your phone number, and know your name is John Smith, I can look up your number and see where it was activated. It'll tell me "Dallas, Texas" and now I'm not just looking for John Smith, I'm looking for John Smith in Dallas, Texas. With successive breakdowns like this I will eventually find your home address or at the very least your neighborhood.
The supposition made by Signal (and anyone who defends this model) is that generally anyone with your private number is supposed to have it and even if they do, there's not much they can do with it. But that's so incredibly wrong it's not even funny in 2025.
I've seen a great number of people in this thread post things like "privacy isn't anonymity and anonymity isn't security," which frankly I find gobstopping hilarious from a community that will break their neck to suggest everyone run VPNs to protect their online identity as a way to protect yourself from fingerprinting and ad tracking.
It frankly amazes me. Protecting your data, including your phone number is the same as protecting your home address and your private data through redirection from a VPN. I don't think many in this community would argue against using a VPN. But why they feel you should shotgun your phone number all over the internet is fucking stupid, IMO, or that you should only use a secure messaging protocol to speak to people you know, and not people you don't know. It's all just so...stupid.
They'll then continue to say that you should only use Signal to talk to people you know because "that's what its for!" as if protecting yourself via encryption from compete fucking strangers has no value all of a sudden. lol
You have to be very careful in this community because there are a significant number of armchair experts which simply parrot the things that they've read from others ad-nauseam without actually thinking about the basis of what they're saying.
OK. That's my rant. I'm ready for your downvote.
The only thing I'll tack onto this is that with the introduction of Signal usernames, you still have to give Signal your number to verify that at least on some level, you probably are a real person. As someone with 5 different phone numbers, probably doesn't stop spam as much as they'd hoped, but more than they feared, but at least now you don't have to give that Craigslist guy who uses Signal your phone number, just your username. Is that the best method? I dunno, but but it is something.
I was unaware of this change, and it's perfectly acceptable. No one has any ground to lambast Signal for requiring phone numbers to get an account. I think that's a perfectly reasonable spam mitigation technique. The issue is having to shotgun your phone number to every Howard and Susan that you want to use Signal to communicate with.
This was honestly the only thing holding me back from actually using Signal. I'll likely register for an account now.
Session is what you want. But you have to directly shares each others public keys to connect
To prevent spam and to allow people who already know each other's number to easily contact over signal. If you want an anonymous account use an online sms activation service paid with monero, personally I recommend smspool.net .
I think you can use a pay phone to sign up.
It's private but it's not anonymous. they know who is talking to who, but not what they are talking about.
Privacy ≠ Anonymity ≠ Security
I assume ease of use and spam prevention.
I think Signal tries to be at least somewhat attractive to the average person who wants more privacy than just using WhatsApp or whatever. Making it easy to message existing contacts helps a lot with adoption.
I think it's important to remember de difference between being private and being anonymous. Signal IS private. It's not anonymous. The same is true for many other apps/services.
Personally I like to be private. I don't really need to be anonymous.
Reduce spam bot accounts and other malware, as well as to allow for user discovery so you can find your contacts more easily. It's not designed to be an anonymous service, just a private one.
It’s not designed to be an anonymous service, just a private one.
I think this needs to be said a lot more often and a lot louder. Anonymous and private are NOT necessarily the same thing, nor should the expectation be that they are. Both have a purpose.
The amount of trolls in this thread that either try to spew false information intentionally or just have no idea what they are talking about is insane.
If you are worried about what data (including your phone number) law enforcement can recieve (if they have your specific user ID, which is not equal to your phone number) from the Signal company check this: https://propertyofthepeople.org/document-detail/?doc-id=21114562 Tldr: It's the date of registration and last time user was seen online. No other information, Signal just doesn't have any other and this is by design.
If you want to know more about how they accomplish that feat you can check out the sealed sender feature: https://nerdschalk.com/what-is-sealed-sender-in-signal-and-should-you-enable-it/
or the private contact discovery system: https://signal.org/blog/private-contact-discovery/
Also as Signal only requires a valid phone number for registration you might try some of these methods (not sure if they still work): https://theintercept.com/2024/07/16/signal-app-privacy-phone-number/
This shows they do not need our phone numbers but they still demand it.
Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.
No it doesn't. What is a need? It is for troll and spam and bot protection. How does the links show that there is no need for it?
edit: it's funny how people downvoting comments about signal's sealed sender being a farce never even attempt to explain what its threat model is supposed to be. (meaning: what attacks, with which adversary capabilities specifically, is it designed to prevent?)
Downvoted as you let them bait you. Escaping WhatsApp and Discord, anti-libre software, is more important.
it's being answered in the github thread you linked. Sorry that this is not enough for you but it's enough for most people: "For people who are concerned about this sort of thing, you can enable sealed sender indicators in the settings"
Privacy is not necessarily anonymity. Signal uses a phone number to prevent spam and DDOS attacks on their network. Session doesn't do this and got wrecked by DDOS attacks to the point where most of the major groups are pretty much dead.
Use Signal to talk to people you know. That's what it's for. You don't use it for anonymous chats.
Signal fills an incredibly important spot in a spectrum of privacy and usability where it's extremely usable without sacrificing very much privacy. Sure, to the most concerned privacy enthusits it's not the best, but it's a hell of a lot easier to convince friends and family to use Signal than something like Matrix.
Because it's centralized, I prefer SimpleX.
What an answers. Completely nonsense
From https://en.wikipedia.org/wiki/Signal_(software) :
In August 2022, Signal notified 1900 users that their data had been affected by the Twilio breach including user phone numbers and SMS verification codes.[105] At least one journalist had his account re-registered to a device he did not control as a result of the attack.[106] ...
This mandatory connection to a telephone number (a feature Signal shares with WhatsApp, KakaoTalk, and others) has been criticized as a "major issue" for privacy-conscious users who are not comfortable with giving out their private number.[142] A workaround is to use a secondary phone number.[142] The ability to choose a public, changeable username instead of sharing one's phone number was a widely-requested feature.[142][144][145] This feature was added to the beta version of Signal in February 2024.[146]
Using phone numbers as identifiers may also create security risks that arise from the possibility of an attacker taking over a phone number.[142] A similar vulnerability was used to attack at least one user in August 2022, though the attack was performed via the provider of Signal's SMS services, not any user's provider.[105] The threat of this attack can be mitigated by enabling Signal's Registration Lock feature, a form of two-factor authentication that requires the user to enter a PIN to register the phone number on a new device.[147]
They are overlapping areas, but they are "two completely different things". They overlap by sharing common goals, not by being interchangeable.
Anonymity to me means the message recipient can't tell who you are.
Right. And Signal doesn't provide that at all, it ties your private messages to your identity (phone number), it explicitly does not provide anonymity. In fact, it proudly advertises you as a signal user to other signal users that have your number saved. It allows you to post public status updates, it encourages you to save your first and last name on your account.
If a THIRD PARTY (the server operator) can ALSO tell who you are, that's a privacy failure, not just an anonymity one.
Okay? And? In this hypothetical world where Signal offered anonymity but still tied you to your number for other practical reasons, then you're be correct that it would be a privacy concern.
But they don't offer anonymity, they offer private conversations.
Our phone numbers are not private from them.
Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.
Because they're building a private, not anonymous, instant messenger. They've been very open about this.
Our phone numbers are not private from them.
Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.
Nothing "derailing" us. Not everyone has the same threat model. The messages are private and that's what's most important. Signal can only provide phone number and last connection time to the feds. If that's too much information for you, then you're not the target group and have a different threat model.
Offers the same privacy but is not centralised. it's peer to peer
Spam prevention
SimpleX
And it uses same tech as Signal.
However getting friends to join Simplex is complicated by two annoyances:
(1) It gets confused by an invite URL coming from facebook (it doesn't know to strip the appended Facebook tracking code - as trivial as it is).
(2) When the invite is via a QR code you must scan it with SimpleX not your native camera app. Invitees just give up.
Everything is a balancing act. Privacy, anonymity, and security aren't the same things. They're sometimes, and in some aspects always, difficult to achieve without compromising one of the other two.
When you add in the goal of quick, easy setup to make the service useful in the first place. Doesn't matter how good the service is at the trinity if nobody is willing to use it. Signal just errs on security first, privacy second, anonymity third.
Bots. If it makes you feel better, you can disable other people finding you via phone number and just give them your username. All messages are private.
But the police request the meta data of all messages from your phone number that the company has and they're required by law to give them it.
These are all the court orders Signal has complied to and details all the information they give up
https://signal.org/bigbrother/
TLDR; they only give the last time the account connected to Signal servers and the time of account registration or re-registration
You should go properly read the requests from law enforcement they have received and exactly what information it contains. It's public. Then evaluate if it matters for yur threat model. Security doesn't exist in a vaccum.
They can "request" it all day long. Signal doesn't store them beyond the time needed to deliver to the end user device, and while (temporarily) stored, it's encrypted in a way Signal's service cannot read.
Secret sender stops any real amount of information about messages being connected to you
Its encrypted
as I see it, Signal tried to fit that privacy gap for a standard centralised messenger, if you think about it, that might have made it easier to non-tech-savvy people to adopt it (even if it was as a request from a contact), decentralisation is not remotely appealing to them
Wrong, they care what it does, not how it works.
One of the design goals is that they don't have a user database, so governments etc can't knock down their door demanding anything. By using phone numbers your "contacts" are not on their servers but local on your phone.
That's WRONG they have a Database of every Phone number registered to them and metadata like the last time they logged in. You send all your contacts numbers to signal so they can respond who is also using Signal.
in the end of the day, the end user needs an id. this is perfect for the everyday user, but obviously if you are writing anti regime articles, you might want to look around for more anonim apps.
We have to assume we are all writing anti regime articles ... In the future
perfect for the everyday user
...because of course, they don't need privacy, do they now. "Nothing to hide" and all that jazz.
Signal is not perfect but we control its app, libre software. See SimpleX Chat.
Escaping WhatsApp and Discord, anti-libre software, is more important.
Why we need to defeat those first? We can go straight to SimpleX?
What SimpleX, Signal, or any app like this need first and foremost is traction, as new users generate more new users. One of Signal's goals is usability (usually achieved by being simple, as in no complexity for the end user). In my opinion SimpleX lacks that. This is the same reason Signal needs a phone number: populating your contact list with users already on the platform
You can go to Simplex (for sure a lot of people here already done it) but if only privacy nerds get to this place this is not a great solution. We (I'm talking about us using Lemmy and chatting on SimpleX) must convince people, starting by friends and family to stop using these fucking socials then at this point SimpleX will be considered as a viable alternative
Because the entire point of using communication programs is to communicate with people other than yourself.
Escaping WhatsApp and Discord, anti-libre software, is more important.
It's focused on ensuring there is no middleman between you and the other party, but it does not have a goal to provide anonymous messaging. Sadly.
THATS WRONG! Signal Server can just do a man in the middle as you try connecting to your contact for the first time. You need to verify the fingerprint manually which is not very obvious and present in the UI. In SimpleX.chat you automatically verify the fingerprint, as its the way to establish the chat to your contact and is included in the way you distribute the contact to you.
Signal IS the middleman.
If you want to be mainstream a) you can't have spammers, scammers, and all the other scum of the earth and b) finding your contacts in the app HAVE TO be plug and play. Literally no normie will bother adding with usernames or whatever.
finding your contacts
Wrong, it is not optional, does not stop spam and the worst way to try.
Do not let this derail us. Escaping to libre software is the best return on investment.
Do not let this derail us.
Nothing is derailing you personally. Why are you repeating this to others?
SimpleX is coming nicely along. Should be good to switch next year once they got their desktop apps polished up
Simplex has a bad user experience and needs a lot of work before it's ready for normies.
Last time I tried Simplex, the battery drain was unbelievable. Maybe I'll give it another go and see what happens, but I'm not optimistic.
Maybe I am being too simplistic here. But I have never received a spam message to my XMPP account and I don't know how a spammer would find it.
In a phone-based system a spammer can spam a list of numbers, or use contact lists that are easily shared via phone permissions. There are several low-effort discovery processes.
For e-mail, you get spam when you you input your personal e-mail into forms, websites, or post it publicly.
But for something like XMPP... It seems rather difficult to discover accounts effectively to spam them. And, if it is an actual problem, why not implement some kind of 'identity swap' that automatically transmits a new identity to approved contacts? A chat username does not need to be as static as an e-mail or a phone number for most people.
I just don't see 'spam' as such a difficult challenge in this context, and not enough in my view to balance out requesting a phone number. Perhaps a spammer can chip-in?
Ignore the comment saying signal is "end to end encrypted" "private" etc They are simply stuck in a delusional state where they try to convince themselves that signal is the best option so they can continue using it. Nothing is private if it isn't fully libre because you never know what the proprietary code is doing. The signal protocol itself has its source code released, and the encryption and security code is publicly available, but the signal Foundation has stated that it uses both free code and proprietary code. Their reason is UI, but it's hard to make sure whatever proprietary code is being used for because you simply can't see it. As GNU puts it: "You're walking in a pitch black cave". Jami is fully libre and is a GNU project. You don't even need any phone number!
Molly.im is a Signal Client fork with Security enhancements and the possibility to install a version with only free software.
Great, but it relies on signal's servers, so it's centralised. Also, Moly merely removes proprietary parts from Signal, but that’s a workaround (same thing for linux-libre kernel, it's free software, but just a workaround which is why I'm looking to help with HyprbolaBSD). I'm not coming here to say Molly isn't an improvement, but being centralised and relying on a non-tully-free program's servers is a huge red flag for me :)
You should have visited Signal's github page first, I dunno. Before talking. Made up a lot of stuff.
They do have proprietary code for that crypto wallet they have there, well hidden, and for, eh, phone number registration, but other than that module it's all released, I think.
The server and the client applications are FOSS. You can host it for yourself, patching out the domain names and registration parts the way you like it more.
They also have Google Play Libraries included for Push Notifications and Maps.
That’s not the full picture. That's exactly the problem I was highlighting. The issue isn't whether some of the code is "FOSS", it’s about whether all of it is. If even small parts remain proprietary (as you mentioned), then we can’t verify what those parts are doing. And those parts could theoretically significantly affect the data collection. Also, I didn't make up a lot of stuff. The Signal Foundation themselves have confirmed that certain UI and build components are not fully libre. As the GNU project puts it, if part of your system is closed, then you're trusting a black box, no matter how well-lit the rest of it is.
I didn't actually know the server code was published. It'd be cool if the client allowed multiple servers so you could talk to people on the "normal" master while also thing a private instance
thousands of threads on this topic since decades ago.
it's an eternal debate (since signal has no plans to change)
just read the history and join the rest of us waiting for them to change. using signal before that change is completely optional. go ahead and don't use it. no problem.
opening the discussion again is just tiring.
read the history
Is there a url for the history? Or for a good answer about the phone numbers? If the topic keeps recurring and the answers don't satisfy people, that suggests that there is no good answer, and that there are possibly misaligned interests between Signal and its users.
opening the discussion again is just tiring.
so tiring that i opened it and read it, then typed a long response.
Fuck haterz, these are valid questions and there no answers.
Signal did its job. I am waiting for simplex to mature.
Is there a quick explanation of what signal actually does? I don't understand the need for a phone number either. Jami doesn't ask for a phone number. It has other deficiencies that make me not want to use it, but those are technical rather than policy, more or less. Similarly, irc (I'm luddite enough to still be using it) doesn't ask for a phone number either. So this is all suspicious. There are a bunch of other things like this too (Element, Matrix, etc.) that I haven't looked into and tbh I don't understand why they exist.
Signal is a messenger service. You can expire messages after a certain amount of time.
They ask for a phone number to limit bots. I used my Google voice number and it worked fine. I like Telegram which banned me after a day of use for using Google Voice.
I get that Signal is a messaging system (not sure if "messenger service" has a specific meaning). What I don't understand is why I'd want to use it instead of any of the million others that are out there. I've never used Signal and don't have the slightest clue about how it operates, but apparently it tries to mess with the contact list on your phone? That sounds bad. I use Nextcloud Chat sometimes and its web design is ugly, but it works ok and you can self-host it fairly easily. It doesn't do anything with your phone contacts. Jami is distributed but (maybe unrelated) I often have trouble getting it to work at all.
It's not suspicious. It's been talked about for years. People know exactly what the phone number is used for. Easy discoverability, quick and seamless onboarding of new users by providing a way to bootstrap their social graph, and it being very similar to the process of the other biggest player that people just understand. And spam prevention. The phones are not leaked or used for anything else. The other alternatives exist and you are welcome to onboard the people you want onto them if you think it's simpler.
The code is open, if you don't trust other people and can't read the code to understand then hire someone you trust to validate the claims and assure you. But spreading FUD and saying it's suspicious is not productive to anyone.
I don't see where I'm spreading FUD. Ignoring a question and calling it FUD doesn't invalidate the question.
They implemented an alt method IIRC but you must go out of your way to search and find it. I just recall seeing a bunch of post headlines about using email or something like that a year or so back.
They send an initial SMS message that is a main expense and funded by some rich person and donations. I think that has some significance to encryption or something but I'm not sure of the details. I could be wrong on that one, it has been years since I read the details.
Your wrong, except the rich person part. That rich guy is the WhatsApp founder, who got the money by selling their users to Facebook.
Is it possible to use a voip based SMS for registration?
Those are a little easier to get anonymously then physical sim cards.
Too many steps.
Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.
you will still need a phone number to sign up for Signal
Session is an alternative that does not require, or request, your phone number (or any other identifying information). Honestly, I have no idea why Signal got popular and Sessions did not. As soon as Signal asked for my phone number that set off alarm bells for me and I’ve never really trusted it since.
According to privacyguides.org, Session is listed under this message:
These messengers do not have forward secrecy, and while they fulfill certain needs that our previous recommendations may not, we do not recommend them for long-term or sensitive communications. Any key compromise among message recipients would affect the confidentiality of all past communications.
Link: https://www.privacyguides.org/en/real-time-communication/#additional-options
I believe you can delete your phone number once you're up and running, but yeah that seems like an anti-feature.
I see an option to change it, not delete. It's still attached to a SIM card which requires identity verification in many states.
You're right. That is odd.
When anyone get a copy of your data, nothing will bring it back.
I'm sure that just sets the database column hide_phonenumber to TRUE.
Because they're lying. Corporations, governments, and just people in general tend to do that, ya'know.
Tried session? Anyone have comments on it? Nice to be able to skip the phone and easily use vpn, though I haven’t spent enough time on that.
Session is a Signal fork and they removed forward secrecy which makes them vulnerable to Key Compromise Impersonation attacks.
I think the people behind Session cares for their mission, and it might align with OP's, so maybe. Although I personally am not too fond of about all their choices.
The omission of Forward Secrecy for instance doesn't sit well with me. Each to their own though, and they do go into their reasoning on their blog: https://getsession.org/session-protocol-explained
Likewise their last audit from 2021, lists quite a handful of critical/moderate issues in their apps, hopefully they've fixet it. Afterall it's been a while since 2021. https://getsession.org/faq#security-audit
There is a lot of FUD here. It's just like anti-vaxxers claiming vaccines make you autistic or have microchips in them: they don't understand what they're talking about, have different threat models, and are paranoid.
Messages are private on signal and they cannot be connected to you through sealed sender. There have been multiple audits and even government requests for information which have returned only the phone number and last connection time.
Messages are private on signal and they cannot be connected to you through sealed sender.
No. Signal's sealed sender has an incoherent threat model and only protects against an honest server, and if the server is assumed to be honest then a "no logs" policy would be sufficient.
Sealed sender is complete security theater. And, just in case it is ever actually difficult for the server to infer who is who (eg, if there are many users behind the same NAT), the server can also simply turn it off and the client will silently fall back to "unsealed sender". 🤡
The fact that they go to this much dishonest effort to convince people that they "can't" exploit their massive centralized trove of activists' metadata is a pretty strong indicator of one answer to OP's question.
So, they do not need our phone numbers but they still demand it.
Despite this, escaping WhatsApp and Discord, anti-libre software, is more important.
Do not trust signal. Mosk advertised it on twitter.
Edit: I only got 11 downvotes yet, so i have to add:
Signal is not allowed in Russia, guess why. Telegram is. yes yes try harder. THINK mf
WhatsApp is obviously not recommended.
I’m not saying don’t use. I’m saying do not trust.
Because their founder (Marlinspike) is probably under a National Security Letter, maybe it's just that, maybe he's done some crimes they're also holding over him. If you look at his behavior it's that of someone very paranoid that they're going to be found out to be cooperating with the feds and get hit with charges for not upholding the bargain, someone straddling one or two big lies that have to be maintained to keep their life going. Very controlling of things they should be open about if they care about privacy as they claim. But exactly the behavior of someone under an NSL who's terrified of getting hit with charges for that and maybe other things but who is expected to front and run a purported privacy first messenger. The secrecy, the refusal to allow others to operate their own servers, the antagonism towards federation, the long periods without publishing source code updates.
This doesn't necessarily mean that signal message content is compromised, the NSA primarily scrapes metadata and would most care about knowing who is talking to who and to put real names to those people and building graphs of networks of people. Other things like what times they talk can be inferred from upstream taps on signals servers without their knowledge or cooperation via traffic observation and correlation especially when paired with the fourteen eyes global intercept network. With a phone number it's also a lot easier to pinpoint an exact device to hack using a cooperating (or hacked) telecom. Phone numbers can also be correlated to triangulated positions of devices, see who in a leftist protest network was A) heavily sending messages and B) attended that protest and left last and begin to infer things about structure and particular relationships.
And those saying it has to do with spam prevention, that's kind of nonsense. First I still get the occasional spam, second a phone number that can receive a confirmation text is something all these criminal organizations have access to which the average person doesn't. Third it's possible to prevent spam just by looking for people (especially new accounts under 120 days old) sending very small amounts of messages (1-3) to a very large amount of other users especially in a short amount of time. Third there's no reason to keep the phone number tied to the account, a confirmation text could be required with a promise to delete the phone number immediately after (would still be technically useful to the NSA though less useful for keeping track of people changing numbers or using a burner for this who might be higher value targets).
That is a pretty weird post that doesn't make much sense, but I remember meeting Moxie and asking him about Android security and being surprised at how defensive he was about it. Is Signal the app he was working on? That helps somewhat. I get them confused with each other.
The Signal app doesn't appear to be on F-droid, which is a bit discomforting.
I have never received spam on Signal.
I got one one time, been using it for years. Fuckin' weird to try on people who are privacy and security conscious. My guess is that they were attempting to see what numbers are using signal in the first place if someone responds with a "fuck off" then the spammer knows they use signal.
I have exactly once as did a couple of my friends from the same stranger.
Secret sender invalidates your metadata argument
My conspiracy theory brain goes:
Its funded by the government.
Yes, the messages themselves are encrypted, but they don't need that, they have access to all the useful metadata.
They can find everyone near the site of a protest (via cell tower data), then find their signal accounts, then see who they are contacting, potentially revealing who the the other protestors and protest organizers are.
And if you need access to the messages, they don't need to crack the encryption, they could just send pegasus to your phone (and they already have you phone number to do so), and they'll have access to every message.
Then they just find those other protestors, also send pegasus to their phones.
I mean, the Signal code is technically legit, they just used a side channel (zero day exploits) to gain access.
But this is just a theory, I don't have any evidence supporting this hypothesis.
They don't need Signal to do any of this though, so this doesn't seem like a very plausible theory.
True, they don't exact need signal. But the thing with exploits is that, once found, they would be patched and they can't use the same exploit again. So they can't just be sending everyone in the country Pegasus. That would make it easier for it to be detected.
So with Signal's help, they have a easier time to select a few targets. They can find out who is using Signal, and correlate that with other data like being near a protest site. Then they only need to target a few Signal users, instead of like sending Pegasus to 5000 protestors, they could find out that everyone is talking to this "John Smith" person, then send pegasus to that user and obtain a lot info And since its only few users being infected, its less likely for the fact that the conversations are comprpmised to be known.
I mean, without requiring phone numbers for Signal, they would have a harder time knowing who is using Signal, and they would end up having to infect all 5000 phones in the protest area, which mean now its much more likely for the spyware to be detected. With infecting just a few of the organizers, their spying can remain undetected for a long time.
As for everyone else not using Signal, they are likely to be using unencrypted messaging, so its not even necessary to infect their phones.
Seems like a lot of unnecessary steps there
This is what the UK police do with WhatsApp data. Even though they can't read the messages, they do use the connections of messages to suspicious characters as evidence including date and times, which also puts these other people in the spotlight, opening further investigations.
The UK police can also use 'stinger' devices that are "fake" mobile data towers to intercept mobile communications.
Your theory sounds legit