(Note: Android users can access Signal’s Settings menu either by tapping their profile icon or selecting the menu under the three dots in the upper-right corner, then tapping Settings. iOS users will need to tap their profile icon and then Settings to access the full menu.)
On Android, you can make Signal your default messaging app by going to Settings > Apps & notifications > Advanced > Default Apps > SMS app, and picking Signal. Just remember that not everyone you text has it installed and that an iOS user you’re texting with might check their Signal app less often than they do iMessage. (iOS still doesn’t let you change the default messaging app, sorry!)
Once you’ve registered your Signal account, you can pick a username if you decide to do so. (For maximizing your privacy, WIRED recommends that you do.) Simply go to Settings and tap on your Profile at the top of the settings page. Select the @ field and set your username, which must be unique and include two or more numbers at the end. You can change your username at anytime.
A benefit of having a Signal username is that you can choose to prevent other Signal users from seeing your phone number, and you can prevent people from finding you on Signal if they already know your number. To enable these options, go to Settings > Privacy > Phone Number and select Nobody under Who Can See My Number and/or Who Can Find Me By Number.
One of the most critical settings to enable is profile PINs, which will make it easier for you to keep your account data even when you transfer devices and to protect your contact lists, profile information, settings, and more. You can set one up when you join or head to Privacy > Signal PIN in your app settings to set or change yours anytime. The introduction of PINs was controversial among cryptography hard-liners, who questioned whether the so-called Secure Value Recovery they were tied to introduced potential vulnerabilities. It didn’t help that Signal had at first made the PINs mandatory. You can opt out now by going to the Create PIN screen and tapping Select more, then Disable PIN. Just remember that if you do so, you won’t be able to bring your contacts with you to a new device, and sensitive account information may be more vulnerable.
Lastly, once you have your PIN set up, enable Registration Lock by going to Settings > Account and toggling on Registration Lock. With this feature enabled, attackers won’t be able to take over your account and register it to a new device in the way they did through the Twilio hack mentioned above.
Protect Your Screen
It’s important to make sure that what happens in Signal stays in Signal. This means keeping people from seeing what you’re doing there from a lock screen or when switching apps. There’s not much point in having an app for sensitive messages if they just pop up on your display whenever you receive one.
To turn off Signal lock screen notifications on iOS, go to your phone’s Settings > Notifications, then scroll down and tap Signal > Show Previews > Never. On Android, the process is similar. From your home screen, head to Settings, then Apps & Notifications, where you can turn off all notifications. If you need more granular control, you can find that in the Signal app itself, where the steps are the same no matter what platform you’re on. Tap your profile, then Notifications, then Show, where you can choose whether to display the name, content, and actions for an incoming text; just the name; or nothing at all. You can also mute notifications for a specific conversation for a set amount of time by tapping on a message thread, then the contact header, and then Mute. You can silence a contact’s notifications for an hour, a day, a week, or a year.
