How To Use Signal Without Giving Out Your Phone Number Using a Chromebook and an Old Phone

A tricky aspect of working in journalism is trying to figure out how people can contact you securely, and doing so in a way that doesn’t put you at risk.

In the past, I’ve posted a PGP key so people who knew how to use it could send me encrypted messages. But there are a lot of problems with PGP, and the world has largely moved on to using the encrypted messaging app Signal. The only problem is that Signal uses your phone number as an identifier, and there are many reasons you might want to keep your personal mobile number private.

In September 2017, there were multiple blog posts written about how to use Signal without giving out your phone number. They’re great instructional guides written by digital security experts, but none of them did exactly what I wanted.

One option was to buy a separate SIM card, but I didn’t want to buy a separate phone and data plan to be able to use it.

Another involved using Google Voice (or Twilio, at the time) to create a secondary account, and to have those messages rerouted to Signal. That’s a nice way to avoid giving your personal number out, and respond from that secondary account. But since I already have a Signal account on my phone, I wouldn’t be able to respond from an alternate number. What I really wanted to do was to find a way to both send and receive messages from a Signal account that wasn’t associated with my number.

A third option involves getting a secondary Signal app, which is possible on Android but not on iOS. Of course, you could always buy a separate phone, but Android phones only receive security updates for a few years, and an iPhone, which is supported for longer, costs a lot more. While there are instructions for using Signal desktop with your phone number, I wanted to be able to have two separate Signal accounts: one on my personal phone with my phone number (that I don’t want to give out publicly), and a separate Signal desktop for the Signal account associated with a number I can share publicly. It’s not currently possible to run two copies of Signal desktop on one machine at the same time (unless you’re running VMs or Qubes or something, or running a beta desktop version along with your ordinary desktop versions—all things I didn’t want to do).

I was speaking to Jonathan Rudenberg about this and they had the brilliant idea of picking up a cheap Chromebook for this purpose. It’s brilliant because you can get one for around $325, and many are supported through 2029 or longer. (Check to see how long it’s supported on this page, and make sure it is also on this list of Chrome OS systems supporting Linux.) It’s also a little more isolated, which is nice. If you’re concerned that your very public number might get compromised, it makes sense to keep it separated from your everyday phone or laptop.

In addition to a Chromebook, you’ll need an old phone to register for Signal and link it to your Chromebook. I used an old Android I had laying around. I wiped it, updated it, and made sure it didn’t have a SIM card.

Now that you have all of your components, here’s how to set everything up:

1. First, set up a new Gmail account on your Chromebook. You’ll need to use the Gmail password to log into your computer, so make sure to use a password you’ll remember and save it in a password manager.
2. For additional protection on that new Gmail account, set up APP (Advanced Protection Program). You’ll need a couple of security keys, such as YubiKey. I use a 5Ci and a Nano, and got it to stop spitting out random codes every time I accidentally touched it by following these instructions.
3. Next, set up a Google Voice number associated with that account. That’s the number you’ll be giving out. (Yes, you have to give Google a mobile number for this. Note that you can only use Google Voice in the U.S. and Canada.) Signal will send an SMS with a verification code to that number, which you’ll need to type into the app to register your account.
4. Optional: I was a little concerned that someone might accidentally leave a message on Google Voice rather than using Signal, so I took the extra precaution of recording a busy signal as my Google Voice greeting. (Like everything else in this post, this was also Jonathan’s idea.) You’ll need to play this a couple times for the full length of the outgoing greeting.
5. Signal Desktop only works with Linux, Windows and MacOS. Before you can install it on your Chromebook, you’ll need to make sure your Chromebook is up-to-date and turn on Linux. Go to ChromeOS Settings and search for “Linux”, and then click “turn on” for Linux development environment. You’ll be able to add your username, and eventually you’ll get a Linux command-line terminal.
6. Now it’s time to install the Signal software signing key. In that terminal, type this:

wget -O- https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add -

WGet retrieves content from web servers, and APT stands for advanced package tool. Here, apt-key is used to manage the list of keys used by apt to authenticate packages. It lets commands process from the standard input (in this case, wget's standard output), rather than a file.

7. Next, add the Signal repository to your list of repositories by typing:

echo 'deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main' | sudo tee -a /etc/apt/sources.list.d/signal-xenial.list

8. After that, update your package database and install Signal. (You may need to answer “y” to several questions.) Type:

sudo apt update && sudo apt dist-upgrade -y && sudo apt install signal-desktop -y

Sudo stands for “super user do” and it lets you have root privileges in Linux (not ChromeOS, which is its own secure environment). That means you can read and write files on the Linux system, install and remove software, upgrade the OS, change the system configuration, and so forth.

9. Once you have Signal on your desktop, you’ll need to couple Signal with your phone. Open Linux apps in ChromeOS by pulling it up using the search menu at the bottom left corner of the screen. Open Signal on a phone and when prompted for a phone number, punch in your Google Voice number. Then type in the code sent to that number. If it times out, that’s okay, just let it time out a few times and it’ll work eventually.

After linking the Chromebook Signal install, you can turn your phone off and stash it somewhere. You won’t need it unless you wipe your Chromebook and want to re-pair without resetting your Signal key. You can also remove the Play Store on your Chromebook and turn Bluetooth off: you won’t need either. Also, avoid browsing or installing extensions on this machine.

Even with all of these precautions, be aware that there are still risks around vulnerabilities in Signal desktop, phones getting seized, and probably other things you haven’t thought of.

For example, disappearing messages aren’t reliably fully deleted, so it’s a good idea to powerwash periodically to remove our message history. You can do that by following these instructions. Note that you’ll need to set up Linux and install Signal Desktop again after powerwashing.

Voilà! There are still a few limitations (video calls are out), but now you have a dedicated Signal number you can give out publicly, put in your sig file, add to your Twitter bio and slap on some business cards.

Special thanks to Ryan Rix, Jonathan Rudenberg, and Martin Shelton for feedback on earlier drafts of this piece.