Building a messenger without phone numbers: the hard problems

Morse is a messenger designed to work without phone numbers, which normally provide account identity, friend discovery, a barrier to mass sign-ups, account recovery, and a way to recognize contacts. Its central argument is that these conveniences create privacy and security costs: numbers are persistent identifiers vulnerable to SIM swaps, and contact discovery can expose metadata even when message contents are end-to-end encrypted. The piece cites research that queried more than 100 million numbers per hour and confirmed billions of active WhatsApp accounts, illustrating why protecting message content alone does not protect users’ social metadata.

Morse replaces numbers with an eight-character ID and keys generated on the user’s phone; private keys stay there, and sign-in uses a cryptographic challenge rather than a password or text code. A separate inbox ID receives messages, without attaching the sender to stored messages. People connect by sharing an ID, optional username, or group link; first contact requires acceptance, and unauthorized messages do not trigger notifications. Spam controls combine paid accounts, rate limits, contact permissions, blocking, and reports that omit message content. Usernames are optional, profiles can remain private, and lookalike names are rejected. To avoid revealing whether a username exists, the system gives nonexistent names a plausible request key too. These choices trade automatic friend discovery and easy account recovery for reduced data collection and user control; connections require deliberate sharing, and account keys remain on the device.