Reviewing the Cryptography Used by Signal
Reviewing the Cryptography Used by Signal
https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/
A very good, extensive and interesting read on cryptography, centered around Signal (my daily driver), from the same guy who has previously analyzed Telegram and Session.
I was sceptical until I saw that they had a fursona. This must be an expert!
Soatok's post about matrix opens with this:
Please keep in mind that this website is a furry blog, first and foremost, that sometimes happens to cover security and cryptography topics.
the need for a telefon number is still a deal breaker. And having to "relock" the phonenumber every week in the app if u used someone elses number (so they cant do account takeover) sound just like a trap
I agree needing a phone number is a dealbreaker, the reasoning I've seen is:
- It's a core dependency on Signal, and replacing it would require a major overhaul.
- Serves as an Anti-spam feature
- Helps with contact discovery among common users
My opinion?
- 1st statement makes sense but maybe it's somewhat incorrect.
- 2nd statement is true, Signal has had an increasingly amount of spam since they added "username accounts" linked to number, I can tell myself.
- 3rd is true, I discovered two guys I knew used it and it was nice. When SMS on signal was still around, I suppose having a phone number also made more sense.
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
Now it's up to privacy oriented users like many here to think about ways of getting a burner phone number for his without their name on it.
But I still agree with your point, they could work on better or more private ways of using Signal.
In general, signal has proved they store no data besides the phone number itself, and in court they have only been able to give phone numbers.
My problem with signal is actually this, because it's only part of the story.
Let's say the FBI suspects you of doing something horrible, like say you played baby shark in public. They have good cause to believe you're a Signal user, so they get a judge to authorize a subpoena based on your phone number, and Signal complies - and, yes, all they're doing is confirming to the FBI that you have an account with them.
Now they're going to go after you with 'We know you have a secret messaging app you use, Signal, and we know you used it to plan playing baby shark at the mall last Tuesday.'
And so, if you're not really clear on how all of this works, it's a fantastic wedge to try to pry actual incriminating information from you. Or, hell, you let them look at the app on your phone negating the whole damn encrypted part in the first place, because you're sure they already know.
Properly secure messengers shouldn't be tied to that level of PII, because, well, cops can still try to use it to bludgeon you.
Maybe a little paranoid, but I've decided to embrace some of the paranoia since not doing so means you have to trust in the rules and policies that the law puts in place and well, uh.....
That's why I'm on Briar instead.