Are phone numbers fundamentally a privacy weakness in secure messaging?

With the recent reports about account takeovers affecting encrypted messaging apps, it seems the attacks aren’t targeting encryption itself, but the identity layer around it—things like account recovery, SIM swapping, and device compromise.

A common pattern is that many secure messengers still rely on phone numbers as the primary identifier. That introduces dependency on telecom infrastructure, which comes with its own risks: SIM swapping, linking accounts to real-world identity, and potential location exposure. Even with strong end-to-end encryption, this feels like a structural weak point.

It raises the question of whether phone-number-based identity is fundamentally at odds with strong privacy models. Some newer approaches are starting to move away from this by using email-based registration and username systems instead. For example, I came across a platform called SafeMeet that follows this model—no phone number required, just email and usernames.

Not saying that’s the solution, but it’s an interesting design direction, especially considering how many recent attacks rely on taking over phone-number-linked accounts.

Curious what people here think:

• Is removing phone numbers a meaningful improvement for privacy?
• Or does it just shift the problem elsewhere (e.g., account recovery, spam, identity verification)?