Username Privacy
- Unlike other messaging apps, Signal cannot easily see or produce the usernames of given accounts.
- Usernames in Signal are protected using a custom Ristretto 25519 hashing algorithm and zero-knowledge proofs.
Signal president Meredith Whittaker and VP Udbhav Tiwari presented this talk at 39C3, explaining how the growing deployment of agentic AI in operating systems and browsers threatens to undermine even the strongest privacy guarantees.
Drawing on Signal’s work as a privacy-first messenger, they showed how features like Microsoft Recall can bypass application-level protections such as end-to-end encryption, while also outlining practical steps to defend user privacy, developer agency, and personal autonomy.
Recorded in December 2025.
In addition to other group attributes that are end-to-end encrypted (such as group names, group descriptions, and group avatars), the Signal service also doesn’t have access to any information about which accounts are part of a group, which accounts are admins in a group, which accounts can add new people to a group, which accounts can approve requests to join a group, or which accounts can send messages in a group.