alt Hacker NewsIf you're a signal user and didn't know about this already, that should tell you everything you need to know about signal.
See https://community.signalusers.org/t/proper-secure-value-secu...
Then read the first line of their terms and privacy policy page which says: "Signal is designed to never collect or store any sensitive information." (https://signal.org/legal/)
Signal loves to brag about the times when the government came to them asking for information only to get turned away because Signal never collected any data in the first place. They still brag about it. It hasn't actually been true for years though. Now they're collecting the exact info the government was asking for and they're protecting that data with a not-very-secure/likely backdoored enclave on the server side, and (even worse) a pin on the client side.
Replies
I wanted to add that there is the cease and desist case against Signal-FOSS fork that tried to implement an open server, too.
In my opinion Briar is where it's at, but because there's no data collection it's pain to do a handshake or manage contacts.
Also signals spam folder isn't open source on server side. They literally have code that reads your messages and checks if spam or not and you cant see what it does or how it's written.
Couple this with signal being the preferred messaging app for 5 eyes countries as advised by their 3 letter agencies and well if you think those agencies are going to be advising a comms form they can't track, trace or read you obviously don't understand what they do.
Sounds quite fishy :( . Any specific proofs in addition to all what have been said so far? I've checked the links, they don't really prove anything...
I see a link to a forum where an anonymous participant says
“Since a recent version of Signal data of all Signal users is uploaded to Signal’s servers. This includes your profile name and photo, and a list of all your Signal-contacts.”
They then link to a Signal blog (2019) explaining technical measures they were testing to provide verifiably tamperproof remote storage.
https://signal.org/blog/secure-value-recovery/
I’m not equipped to assess the cryptographic integrity of their claims, but 1) it sounds like you’re saying that they deployed this technology at scale, and 2) do you have a basis to suggest it’s “not-very-secure or likely backdoored,” in response to their apparently thoughtful and transparent engineering to ensure otherwise?