Reviewing the Cryptography Used by Signal
Reviewing the Cryptography Used by Signal - Dhole Moments
https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/
A very good, extensive and interesting read on cryptography, centered around Signal (my daily driver), from the same guy who has previously analyzed Telegram and Session.
the need for a telefon number is still a deal breaker. And having to "relock" the phonenumber every week in the app if u used someone elses number (so they cant do account takeover) sound just like a trap
I agree needing a phone number is a dealbreaker, the reasoning I've seen is:
My opinion?
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
Now it's up to privacy oriented users like many here to think about ways of getting a burner phone number for his without their name on it.
But I still agree with your point, they could work on better or more private ways of using Signal.
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
My problem with signal is actually this, because it's only part of the story.
Let's say the FBI suspects you of doing something horrible, like say you played baby shark in public. They have good cause to believe you're a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they're doing is confirming to the FBI that you have an account with them.
Now they're going to go after you with 'We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.'
And so, if you're not really clear on how all of this works, it's a fantastic wedge to try to pry actual incriminating information from you. Or, hell, you let them look at the app on your phone negating the whole damn encrypted part in the first place, because you're sure they already know.
Properly secure messengers shouldn't be tied to that level of PII, because, well, cops can still try to use it to bludgeon you.
Maybe a little paranoid, but I've decided to embrace some of the paranoia since not doing so means you have to trust in the rules and policies that the law puts in place and well, uh.....
Now they're going to go after you with 'We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.'
This does nothing for their case. They don’t know if you planned the crime on Signal. And, this is on non-issue if you:
If you fail those two basic principles of dealing with the police, you’ve screwed yourself anyway. Accusing you of using Signal carries no weight in a court and likely wouldn’t be admissible unless they already had evidence of the contents of the messages.
I love this comment was deleted
I deleted it and resposted it in the proper place in this same thread - I accidentally responded to the wrong person.
Edit: omg, hahaha
They have no data of you to share with the FBI. No list of your contacts, no list of your groups, no data of stickers you use, basically nothing. That's what's great about Signal.
I suggest that you read their transparency reports to see what I mean. They share redacted version of their communications with the govts: https://signal.org/bigbrother/santa-clara-county/
They have good cause to believe you’re a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they’re doing is confirming to the FBI that you have an account with them.
Literally all they need to do is have their own phone with Signal installed, and then create an address book listing with the Suspects phone number on it.
Next time Signal syncs, it will pop up “Suspect is on Signal!”.
Subpoena-ing the Signal Foundation is not required.
But it proves nothing, and if you are in a jurisdiction where the police can demand your phone or you are stupid enough to hand it over when they can’t, that’s not on Signal.
Fitting username.
That's why I'm on Briar instead.
