Why I'm Concerned About Signal

The last month's been an odd turn of events for Signal's treatment of security researchers...what does it mean for Signal messenger? Despite it being my favorite messenger, it's hard for me to ignore some of these events from an overall solid service.

We cannot provide our content without our Patrons, huge thanks to:
BRIGHTSIDE Clark Ente Larry Richard Afonso Brad JohnnyO kevin 'love your content' Poaclu x

0:00 Setting things up
0:30 Our sponsor: Notesnook ❤️
1:30 What happened with Signal?
3:14 So what's *actually* the issue?
7:19 Takeaways for you and what you should do.
#signal #message #techlore

[techlore]

Also please please leave your thoughts below on the situation, really curious to hear! You all had some great takes on my last video

[glyslay]

Ghosting then blocking a experience security researcher is a giant red flag for a Signal company.

[RealGigaMind]

This problem is present in whatsapp as well as telegram.

[vicinityfpv]

This has been a ridiculous oversight for many years.
Anyone without full disk encryption is at risk of having ALL their messages stolen. It's also noteworthy that any user must also trust their conversation partner to ALSO have good physical security, because messages could be stolen from two sides!
What's even more annoying: You cannot change the default directory where the user data is stored! At least brave has a flag that allows you to set the path for user data to a different directory (like a container). No such option for Signal. HUGE oversight. It's actually embarrassing how sloppy this is.

[Omnifarious]

I can't see any way around the endpoint security problem other than having to provide a password to Signal every time you start it. This is in great conflict with their ease-of-use requirement that's a core of why it's so easy to get people to use Signal.

Briar does this, and it's a huge pain.

I can see having this as an optional feature that people can turn on. And perhaps that's what they ought to do. Maybe they can think of something more clever than I can. But I would be really surprised if they could, and very eager to see what it was if they did. They did surprise me on just how cleverly they managed the handle issue.

[killbotprime]

If you sit still in the dark and say "Moxie Marlinspike" 7 times, he'll materialize and unf00k this situation. It is known.

[jordank]

If they did fix it, it was super on the DL. To those on Mac, go into your Keychain and (if running the Signal Beta), you SHOULD see Signal's "safe storage" in the Keychain.

[gmabber]

SimpleX looks like a good Signal replacement in the future.

[cjjkdce]

"The local security threats on your machine" attitude reminds me of Windows, where Microsoft doesn't care that anyone with physical access can just work around the login since ever.

[Ktnmdl]

Bro, pls make 2024 best messengers comparison pls!

[janice-ldpf]

Kudos for acknowledging your sponsorship. You definitely didn't do that in your last videos for DeleteMe and Synology.

[DavidIstre]

I'm still using Signal, and, like you said, this vulnerability was *known* since 2018, which means those for whom this vulnerability was relevant to their threat model could take steps to mitigate the risk. In other words, Signal didn't hide this vulnerability or try to do some kind of coverup. But, I agree their response hurt people's trust and raises questions about what direction they're going.

My solution has been to compartmentalize based on needs. I use Signal and Telegram for different purposes. I identify what my needs are and patch things together.

Thankfully my security needs are not as demanding as they were some years ago, but, this is why I didn't use Signal on desktop when this was discovered because my security needs couldn't tolerate that vulnerability.

[Wooperplus]

The problem with the people working at Signal is that they're incredibly arrogant and have been this way for years.

It's a strange hostility that really makes no sense.

[gerowen]

If they did roll out a fix, either it's not retroactive or it doesn't include all data. I just went and thru the local data store for desktop Signal on my laptop and foundunencrypted copies of image attachments from messages.

[Faeanxrchy]

This is concerning, so I appreciate you bringing this up and sharing your thoughts. Thanks, Henry.

[rocvan]

Thanks for the attention to this topic.

[billb]

If Signal isn't concerned about "local" security threats on my machine, then whey can't I export my messages to a local file. At that point it would be my problem to protect them. All I wan't Signal to do is provide point to point security. Let me manage my messages once they get to my computer.

[dunar]

You forgot that they keep using an insecure ssl version

[redeyesdrogon]

This is a unfortunate situation on what happened to Signal. A big breach of trust to their community. Going to be interesting on what people do/migrate over to (if people do at all). Great video, and a great level-headed response! Thank you

[IHLWonk]

Meredith is more concerned about collecting awards for herself as an activist against AI, than actually doing anything of significance with Signal.