Multiple Russia-aligned threat actors actively targeting Signal Messenger

My Signal experience: ex gf in college asks what app I’m using to text. Tell her it’s Signal, E2EE, messages are only stored on her phone and nobody else can read them. She says cool and downloads the app. Four months later her phone breaks.

“Hey subjectsigma I got my new phone today. Where are all my messages?”

“… Do you have your old phone? That’s the only place they are.”

“No? Last time I got a new phone WhatsApp moved my messages over, and WA is E2EE so I thought it worked the same way.”

“Nope if you don’t have a backup or your old phone they’re gone. Sorry.”

“This is bullshit. Why does anyone use Signal. I can’t believe it deleted all my messages. I’m uninstalling it. Etc etc.”

We have a long way to go, my friend.

Can you elaborate? I'm semi-familiar with the Signal protocol but I'm not sure what you are referring to here.

If you're a signal user and didn't know about this already, that should tell you everything you need to know about signal.

See https://community.signalusers.org/t/proper-secure-value-secu...

Then read the first line of their terms and privacy policy page which says: "Signal is designed to never collect or store any sensitive information." (https://signal.org/legal/)

Signal loves to brag about the times when the government came to them asking for information only to get turned away because Signal never collected any data in the first place. They still brag about it. It hasn't actually been true for years though. Now they're collecting the exact info the government was asking for and they're protecting that data with a not-very-secure/likely backdoored enclave on the server side, and (even worse) a pin on the client side.

It’s not bad. It just IS.

the only people that think it is bad are people who have a different opinion and feel attacked for whatever reason. I find it telling when people accuse others of virtue signaling because it is almost always someone who is jealous or insecure attacking said signaler.

The article says they phish people into linking adversarial devices to their Signal:

> [...] threat actors have resorted to crafting malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance. If successful, future messages will be delivered synchronously to both the victim and the threat actor in real-time, [...]