Right now there are a lot of new eyes on Signal, and not all of them are familiar with secure messaging and its nuances. Which means there’s misinfo flying around that might drive people away from Signal and private communications. 1/
One piece of misinfo we need to address is the claim that there are ‘vulnerabilities’ in Signal. This isn’t accurate. Reporting on a Pentagon advisory memo appears to be at the heart of the misunderstanding: npr.org/2025/03/25/nx-s1-53398…. The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users. 2/
Phishing isn’t new, and it’s not a flaw in our encryption or any of Signal’s underlying technology. Phishing attacks are a constant threat for popular apps and websites. 3/
In order to help protect people from falling victim to sophisticated phishing attacks, Signal introduced new user flows and in-app warnings. This work has been completed for some time and is unrelated to any current events. If you’re interested in learning more, this WIRED article from February 19th (over a month ago) goes into more detail: wired.com/story/russia-signal-… 4/
Can't listen to audio right now, and Gemini can't find any articles that explain "user flows" and "warnings" in this context. Looking forward to tech blog posts. 🖖😊
Even if this is an UX improvement here, there should be a place resuming the identified problem and its impact, the vulnerable versions, the patched versions, the patch, etc.
Well made vulnerability improves confidence for the software because it shows maturity on the matter. It also avoid opportunistic attackers looking at the git log to identify and exploit bugs with fixes that aren't released yet
someone needs to explain that public servants should not be using encryption to evade retroactive scrutiny... the US President's + aide's devices should be backed up continuously and the device's keys time-unlocked every 4 years.
I wouldn't worry about that too much. By now it must be abundantly clear to everyone interested in securing their comms, that US national security institutes should no longer be considered a reliable source for infosec threat information in any way. Like everything else he touches, they are now a Trump weapon.
The biggest complaint I'm seeing is that Signal doesn't store conversations on its servers, so there's no way to recover them for transparency purposes. So is this true? Can chats, for example, from a Republican "National Security Team" who "accidentally added" a reporter to their chat be recovered for the Freedom of Information Act, or are those chats just gone forever? That’s why people are calling Signal an unsecured messaging app. Because officials are using it to bypass our laws.
A vulnerability to Signal isn't Signal's fault, but that of the platform. Your device might be compromised, your keyboard might. There is a reason why these discussions take place in a secure room, mobile devices left behind. It's not that Signal is doing a bad job, but the level of security required for this is beyond Signal's control.
This administration will blame everything except their own, failed OPSEC. Those of us who see through the nonsense, will continue to champion #Signal. If they can't understand a "To:" field, we're not taking their attribution that the tech was at fault. Keep up the great work! #poli #opsec
it is clear that a good tool was used by irresponsible people in a way that caused themselves harm.
It blows my mind that people will now try to blame the tool, ranging from "this hammer is bad because it hit me on the head", to "thats because it was the wrong hammer to use in the first place".
Sorry you ended up in a position in which, due to no fault of your own, you need to clarify and defend yourselves. We're helping set the record straight where we can too of course.
Of course a lot of new eyes are also checking y’all out since apparently our national security folks just said “fuck a SCIF, let’s throw it all into chat”
Wonder if the Secretary of Dranks Defense got phished and finessed out of those war plans…?
it's amusing to see the vote of confidence in Signal and the free advertising coming from that particular source. Presumably they use it for quite a bit of their secret off-the-record planning.
Signal is good. the only requirement I know of to be successful on Signal is do not be a shit-eating dipshit nazi who is so dumb as to add professional whistleblowers to your illegal federal defense communications/gossip chat.
recently in the UK there has been a change in the law, legalising cybercrime by forcing companies to introduce vulnerabilities within the encryption protocol. This is called the online safety bill. What is signal's stance on this?
personally I do not like signal I personally prefer zangi for my encrypted Communications I feel like it's a lot easier to use and it's certainly a lot faster
I wish my friends would use signal, but because it's hard to use on desktop with screenreaders it's unsuitable for my group. downloading attachments for example is impossible.
also in Belgian national media there's a professor from Antwerp spreading FUD about Signal ( vrt.be/vrtnws/nl/2025/03/25/si… )…
He’s calling it a "commercial app”. He claims intelligence services are able to attack if they want (somewhat credible I guess), and then proposes Threema as a better alternative, because the servers are in Switzerland (which sounds irrelevant to me in the context of e2ee without metadata).
the benefit of vast numbers of people hearing (probably for the first time ever) about Signal greatly exceeds the secondary issues *imho*.
Of course establishing ground truth and providing resources for those advocating for Signal is important, but the nature of the beast is that this will not reach large audiences, mostly those who are probably already able to understand the nuances.
IMO now is a more important time for Signal to emphasis the use of usernames v's phone numbers as a way to add and trust recipients. Similar to to the trust model of @threemaapp or #wire
Signal
Als Antwort auf Signal • • •teilten dies erneut
linuzifer, stux⚡ und Tim Chambers haben dies geteilt.
Signal
Als Antwort auf Signal • • •teilten dies erneut
Tim Chambers und stux⚡ haben dies geteilt.
Signal
Als Antwort auf Signal • • •wired.com/story/russia-signal-… 4/
Tim Chambers hat dies geteilt.
Erik Play2Learn
Als Antwort auf Signal • • •Daniel
Als Antwort auf Signal • • •Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger
Google Threat Intelligence Group (Google Cloud)Morten Grøftehauge
Als Antwort auf Signal • • •S1m
Als Antwort auf Signal • • •This is an example of how Signal should improve its vulnerability disclosure.
cf. the OWASP guide: cheatsheetseries.owasp.org/che…
Even if this is an UX improvement here, there should be a place resuming the identified problem and its impact, the vulnerable versions, the patched versions, the patch, etc.
Well made vulnerability improves confidence for the software because it shows maturity on the matter. It also avoid opportunistic attackers looking at the git log to identify and exploit bugs with fixes that aren't released yet
Vulnerability Disclosure - OWASP Cheat Sheet Series
cheatsheetseries.owasp.orgCyber-Ruffy
Als Antwort auf Signal • • •Andrew Singleton
Als Antwort auf Signal • • •If someone in the conversation shares that conversation... that's outside of the app's control.
Just like anything else. If there is physical access to the thing, it is not secure.
Devil
Als Antwort auf Signal • • •BananaCocoYuck
Als Antwort auf Signal • • •John Kavanagh
Als Antwort auf Signal • • •DoesThisNeedAGround?
Als Antwort auf Signal • • •Matv1
Als Antwort auf Signal • • •Paul Sutton
Als Antwort auf Signal • • •Problem Exists Between Chair And Keyboard
Evie. 😘
Als Antwort auf Signal • • •zeitverschreib [friendica]
Als Antwort auf Evie. 😘 • •@Evie. 😘
Messages in Signal are E2E encrypted. Even if they were stored, Signal would not be able to release them in any useful form.
@Signal
mögen das
Dataline und LorenAmelang mögen das.
RJ
Als Antwort auf Signal • • •Mark Gjøl
Als Antwort auf Signal • • •b00tl00ps
Als Antwort auf Signal • • •Sofa Lion
Als Antwort auf Signal • • •it is clear that a good tool was used by irresponsible people in a way that caused themselves harm.
It blows my mind that people will now try to blame the tool, ranging from "this hammer is bad because it hit me on the head", to "thats because it was the wrong hammer to use in the first place".
Sorry you ended up in a position in which, due to no fault of your own, you need to clarify and defend yourselves. We're helping set the record straight where we can too of course.
StarrWulfe 🌟🐺 (JLGatewood)
Als Antwort auf Signal • • •Of course a lot of new eyes are also checking y’all out since apparently our national security folks just said “fuck a SCIF, let’s throw it all into chat”
Wonder if the Secretary of Dranks Defense got phished and finessed out of those war plans…?
#pettyaf
jigglejungle
Als Antwort auf Signal • • •w7com
Als Antwort auf Signal • • •Gary Houston
Als Antwort auf Signal • • •okanogen VerminEnemyFromWithin
Als Antwort auf Signal • • •br00t4c
Als Antwort auf Signal • • •Raquel Shultz
Als Antwort auf Signal • • •Ham on Wry
Als Antwort auf Signal • • •Sadly everything trump touches whithers and dies.
Hope your business survives.
millennial falcon
Als Antwort auf Signal • • •Toon Lowette 🇪🇺 🇪🇸 🇧🇪
Als Antwort auf Signal • • •On the contrary, simple human stupidity was.
@signalapp
Mario
Als Antwort auf Signal • • •Bishop Properties LLC.
Als Antwort auf Signal • • •patricus
Als Antwort auf Signal • • •downloading attachments for example is impossible.
katzenberger 🇺🇦
Als Antwort auf Signal • • •#Signal was chosen because it protects against interception, doesn't store messages on their servers, and offers disappearing messages.
Precisely what an individual wants from a #messenger. The current news is more of an advertisement than a deterrent.
Kristof Van Landschoot
Als Antwort auf Signal • • •also in Belgian national media there's a professor from Antwerp spreading FUD about Signal ( vrt.be/vrtnws/nl/2025/03/25/si… )…
He’s calling it a "commercial app”. He claims intelligence services are able to attack if they want (somewhat credible I guess), and then proposes Threema as a better alternative, because the servers are in Switzerland (which sounds irrelevant to me in the context of e2ee without metadata).
Staatsgeheimen op Signal: waarom gebruiken toppolitici in VS de berichtenapp? En hoe (on)veilig is dat?
VRT NWS: nieuwsOpen Risk
Als Antwort auf Signal • • •the benefit of vast numbers of people hearing (probably for the first time ever) about Signal greatly exceeds the secondary issues *imho*.
Of course establishing ground truth and providing resources for those advocating for Signal is important, but the nature of the beast is that this will not reach large audiences, mostly those who are probably already able to understand the nuances.
So don't worry (too much), be happy ❤️
zulu 🇨🇭
Als Antwort auf Signal • • •Stephen Judge 🇮🇪🇪🇺
Als Antwort auf Signal • • •Tim Chambers hat dies geteilt.