Signal hardened username lookup defenses after reports of spam probes against public usernames.
Signal is choking spammy username lookups without killing the username feature. After reports of probing against public handles, the app and servers get tougher rate limits and related defenses. Update the client; part of the protection only works when both sides agree.
What did not change
Usernames remain optional. Phone-number privacy features that already shipped are still there. Signal is not forcing everyone into a public handle. It is making enumeration harder for the people who chose one.
A public username is still a public handle. Better rate limits reduce industrial scraping. They do not make a billboard private. Review who can find you in Settings if you turned a username on for convenience.
What you should do this week
Update Signal. If you use a username, skim the privacy controls again. If you only adopted usernames to hide your number, confirm number privacy is configured the way you think it is. Spam pressure moves; settings deserve a second look after every hardening note.
Signal’s reputation rests on boring vigilance. This update is boring in the right way. Install it and keep your handle hygiene intentional.
For high-risk users
Journalists and activists should treat usernames as public identities even with better rate limits. Prefer QR or in-person safety numbers for first contact when stakes are high. Rotate usernames if harassment campaigns start enumerating patterns. Signal improved the armor. Threat models that assume a handle is secret were wrong before and remain wrong now.
Group invite hygiene
Prefer invite links with expiration for large groups, and avoid posting usernames in public bios if you only wanted friends to find you. Usernames shared on Instagram effectively become business cards. Rate limits slow strangers; they do not erase a handle you painted on a billboard. Signal can harden lookups. You still choose how widely the name is advertised.