Large-scale Abuse of Contact Discovery in Mobile Messengers [pdf]
The associated paper [1] summarises the information revealed by Signal succinctly:The Signal messenger is primarily focused on user privacy, and thus exposes almost no information about users through the contact discovery service. The only information available about registered users is their ability to receive voice and  video  calls.  It  is  also  possible  to  retrieve  the  encrypted profile picture of registered users through a separate API call,if they have set any. However, user name and avatar can only be decrypted if the user has consented to this explicitly for the user requesting the information and has exchanged at least one message with them.So Signal comes out excellently from this, yet is mentioned in the title. However, the paper does find that Telegram reveals to the world, in real time, exactly how many Telegram users have a particular phone number in their address book...Can we change the title from the (click baiting) university press release to one which more accurately reflects the content of the paper?[1] https://encrypto.de/papers/HWSDS21.pdf