How to Install Signal

Lesson Content

Ice Breaker

Ask, "Did you ever use a secret language or codes as a kid to pass messages to your friends?"

Invite learners to describe what they did. Some examples could include Pig Latin or other kinds of codes, lemon juice ink, or other kinds of “invisible” writing, etc.

Warmup

Ask, "Why might someone want to protect their digital communications? What groups or people may be interested in protecting their communications from telephone providers, law enforcement, governments, etc.?"

Answers may include:

• Journalists
• Lawyers
• Human rights defenders, activists, and dissidents
• LGBTQ youth
• Academic researchers
• People traveling overseas (Signal uses data, not minutes)

Follow up with, "How can someone better protect their digital communications?"

Allow for ideas, and then lead the discussion towards end-to-end encrypted communications. Participants should have presumably reviewed that module/topic already. This should be a refresher.

Knowledge Share: Introducing Signal

Introduce the topic with, "An example of a tool that allows for end-to-end encrypted conversation is Signal. We’re going to learn how to download the app on your phone today."

Take this opportunity to review learning objectives with your audience, and then share the following points:

• Signal is a free and open source mobile app developed by Open Whisper Systems that employs end-to-end encryption on iOS, Android, and desktop.
• Signal uses telephone numbers as contacts and can send end-to-end encrypted phone calls, texts, video calls, and files between Signal users using data or wi-fi. This means Signal users don’t incur SMS and MMS fees, but both parties to the conversation must have Internet access on their mobile devices.
• If you download it and allow access to your contacts, you may be surprised to find some of your friends already using it.
• It’s more secure than making regular phone calls and sending standard SMS messages.
• If you’re in a country that monitors people’s communications, though, the government might be looking for Signal traffic. If you’re concerned about this, talk to trusted colleagues and activists and check recent news.

• Signal’s privacy policy is short and concise. Unlike WhatsApp, Signal doesn’t store any message metadata. (Pause here to define metadata.) The closest piece of information to metadata that the Signal server stores is the last time each user connected to the server, and the precision of this information is reduced to the day, rather than the hour, minute, and second.

Ask your audience if there are any questions before moving on.

Install

1. Break the group up into small groups (maximum five people in each) and tell them they’ll be doing a step-by-step install. Where possible, pair Android users with other Android users and iOS users with other iOS users.

Tip: Use install cards. Give users a green card, a yellow card, and a red card. They should display the green card when they’ve completed a step and no help is needed, the yellow card if they’re working on a step, and the red card if they’re stuck and have questions.

2. Prompt learners to visit either the Google Play Store or Apple App Store, search for “Signal,” and download the app.

Pause here to ensure everyone has successfully downloaded the app.

3. See How to: Use Signal on iOS and How to: Use Signal on Android to continue with the app set-up. Pause after each step to ensure everyone has completed each step. Stop when you get to the “Using Signal” section.

Knowledge Share: Fingerprints and Safety Numbers

Introduce the topic with, "Before we try to send a message through the app, we need to verify the identity of the person with whom we’re communicating."

Remind students of the “verifying fingerprints” section in end-to-end encrypted communications module/topic. If necessary, review the concept with an activity or slides.

End-to-end encrypted applications often have ways to verify your friend’s identity. As a reminder, a fingerprint is a short mathematical representation of your encryption keys that looks like gibberish. You can use fingerprints to verify that you are communicating with the intended person, and that your messages aren’t tampered with.

Signal uses something a little different called a “safety number.” In Signal’s case, the safety number is a mathematical representation of the conversation session between you and your recipient (half your unique public key, half their unique public key). Each half of the safety number is persistent until that person reinstalls Signal (thus creating a new cryptographic identity).

The safety number is a powerful way to check the security of your communication with a friend, and to protect against something called a “man-in-the-middle” or “machine-in-the-middle” attack. However, you should know that safety numbers can change for innocent reasons as well, like your contact getting a new phone, reinstalling Signal, or configuring Signal to a new device.

If you know you are getting a new phone, you can notify your friends that your safety number with them will change. Some ways you can do this are by sending a Signal message before getting your new phone, posting a general announcement on an HTTPS-encrypted site, telling them in person, and so on. That way, they know not to be surprised that your device information has changed.

Pause here for a break before doing the next activity. Tell learners they’ll be verifying their safety number with a partner (or the trainer) after the break. Make yourself available for questions.

Activity: Verifying Safety Numbers

Have people find a partner. Tell them they will be exchanging phone numbers with this partner. The trainer or helpers should be available to partner with those who feel uncomfortable giving their phone number to a stranger. Make your phone number or burner phone number available on the board or projector.

Tip: Use install cards.

1. Have students exchange phone numbers with their partners. They should do this by creating a new contact in their phone and entering their partner’s number into their contact list.

Pause and check to ensure everyone has successfully added a contact.

2. See instructions under “How to Verify Your Contacts” in the How to: Use Signal on iOS and How to: Use Signal on Android guides to continue with this activity. Pause after each step to ensure everyone has completed each step. Stop when you get to the “Using Signal” section.

For advanced learners: Learners who have easily exchanged their safety number with one other person should find others in the room to exchange a safety number with while the trainer helps those who are having difficulty.

3. Once people have successfully checked their safety number with someone else, have them display their green signal card.
4. Bring the group back together once everyone has completed the task.

Ask your audience if there are any questions before moving on.

Activity: Sending an End-to-End Encrypted Message

Introduce this next activity with, "Now that you’ve verified the identity of the person you’re communicating with, you’re ready to send an end-to-end encrypted message." Have learners find their partners. (And remember: in some cases, the partner may be the trainer or the helper.)

Tip: Use install cards and reference the “How to Send an Encrypted Message” section of the Signal guides.

1. Have everyone open Signal on their phone and tap the compose icon in the upper-right corner of the screen.

Pause to ensure everyone knows where this is located on their phone.

2. Walk through the step-by-step instructions in “How to Send an Encrypted Message” section on the Signal guides.

3. When students have successfully sent an encrypted message to their partner, have them display their green signal card.

Optional Closing Activity

Write down a list of three contacts whom you will help to install Signal after this training.