Max "Buzzworthy" EddyFeb 4

Because I am often the most paranoid person among my friends and family, I've been asked a lot of questions about @signalapp as of late. Here's the gist:

Yes, it's safe to use. But there are some easy strategies to make it even safer.

https://www.nytimes.com/wirecutter/reviews/signal-secure-messaging-app/

Why Signal Is Still Our Favorite Secure Messaging App (And Why No Messaging App Is Perfectly Secure)

Signal’s approach to end-to-end encryption makes it especially safe for sending messages. We have some tips on how to use it, and why no messaging app is perfect.

Wirecutter: Reviews for the Real World
Show threadMax "Buzzworthy" EddyFeb 4

Some additional things I'll tack on:

Personally, I don't love having multiple devices attached to a Signal account. Especially desktop computers.

Multiple devices means multiple opportunities for someone to gain access, and having some of those devices be PCs opens you up to whole other classes of malware that could potentially nab your messages.

Runa Sandvik pointed out how it seems like biometric access on a work computer may have given the FBI access to a WaPo journalist's Signal messages. https://x.com/runasand/status/2017659019251343763?s=20

Multiple clients is great for convenience, but some friction can be a good thing.

Runa Sandvik (@runasand) on X

The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it. https://t.co/YqLahtQihR

X (formerly Twitter)
Show threadMax "Buzzworthy" Eddy

As a counter example, it seems like investigators may have been stymied by an iPhone's lockdown mode.

https://www.404media.co/fbi-couldnt-get-into-wapo-reporters-iphone-because-it-had-lockdown-mode-enabled/

I want to stress that this is a very incomplete picture; there could be tools and strategies in use that we can't see. But based on what we know, limiting devices and how those devices can be accessed seems like a good strategy.

FBI Couldn’t Get into WaPo Reporter’s iPhone Because It Had Lockdown Mode Enabled

Lockdown Mode is a sometimes overlooked feature of Apple devices that broadly make them harder to hack. A court record indicates the feature might be effective at stopping third parties unlocking someone's device. At least for now.

404 Media
Feb 4 at 6:20pmWeb
Show threadMax "Buzzworthy" EddyFeb 4

I mention in the article that malware could potentially access Signal messages. This is an area where I don't know a lot of specifics, but one thing did pop up recently that I thought was interesting.

NYT and 404Media have reported on new tools purchased by DHS. From NYT:

"One of the tools, which was built by Paragon, an Israeli technology company, lets people take control of phones or remotely hack into them to read messages or track locations."

https://www.nytimes.com/2026/01/30/technology/tech-ice-facial-recognition-palantir.html

Would this include Signal messages? Is this actually in use and working as described? I don't know, but it demonstrates that there are more exotic threats to mobile device privacy.

The Tech Arsenal That ICE Has Deployed in Minneapolis

Agents use facial recognition, social media monitoring and other tech tools not only to identify undocumented immigrants but also to track protesters, current and former officials said.

The New York Times
Show threadMax "Buzzworthy" EddyFeb 4

Also, just to brag, but I've been using Signal since before it was Signal. Back then it was two apps: RedPhone and TextSecure. I covered my first Black Hat for PCMag with a stock Nexus 5 that only had those apps on it and a prepaid SIM I bought in cash.

Ah, a simpler time.

Show threadKlaus Vink SlottFeb 4
@maxeddy
For tracking the phone location it seems that they don't need to hack anything, it's a built-in feature:
https://infosec.exchange/@bontchev/116005467076780286
VessOnSecurity (@[email protected])

"Your Phone Silently Sends GPS to Your Carrier — Here's How": https://fumics.in/posts/2026-02-01-phone-gps-carrier-tracking (Well, not mine. Mine still uses 3G.)

Infosec Exchange