We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.
To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts.
To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN.
We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup.
While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone.
@signalapp@mastodon.world THERE IS *NO LEGITIMATE REASON* FOR #Signal TO DEMAND A #PhoneNumber (= #PII by circumstances if not mandatory doxxing to the governments aka. *"#KYC"*)… - so yes I [do blame Signal](https://infosec.space/@kkarhan/116200585213177913) because this attack vector is unique to #Signal's shittyness and would not exist with @monocles@monocles.social / #monoclesChat or even [`cock.li`](https://cock.li) of all places…
@kkarhan
This has always struck me as the strangest complaint about Signal.
You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
@lackthereof it's not a "strange complaint", but a massive problem, because it creates dependency on a proven insecure network that is more often than not controlled if not run by hostile actors…
@signalapp mandating #PhoneNumners is a huge red flag because at best any #PhoneNumber is pseudonymous like a #Shitcoin-Wallet and that any #privacy is broken the moment it has any (even remotely circumstantial) connection to someone.
Not to mention #Signal's #App is a huge shitshow…
@kkarhan@infosec.space This has always struck me as the strangest complaint about Signal. You don't need to distribute your phone number to actually communicate with other signal users. Presumably you want some form of 2fa, because losing your account would be bad. And you don't want to be tied to some cloud based email provider. And it's literally a phone app so every single user has the dependency.
@kkarhan
Email is, in practice, a privacy shit show equal to or greater than phone numbers. Either you self-host, which means you have an isp and a DNS provider at minimum who can reveal your identity on their whims, even if you lie on a whois record. Or you use one of the mega free providers with all their conflicts of interest and data mining. Or you use a paid provider which opens up all the payment chain to trace back to you on top of everything else
To get a phone number I can walk to the corner convenience store and, with cash payment and no ID, purchase a prepaid SIM card. I can pay cash to refill it every month.
@lackthereof no, it's not because unlike #Phones and #PhoneNumbers, #eMail is not necessarily traceable by circumstances.
Whereas with eMail (and any #asynchronous #communication) you don't have that requirement.
Signal
ExcelAnalytics
Kevin Karhan 
The Lack Thereof 
cock.li which natively supports @torproject / #Tor useage with an #OnionService, unless said provider explicitly prevents you from doing so, you can use not just Tor but also other techniques to make it extremely hard (not necessarily impossible, but at least unfeasible at scale!) to get tracked down.Or to put it simple:
So either way a phone number is just a horrible means of doing that.
OnionService which can only be shutdown effectively by sabotage aka. (more or less figurately) "unplugging" it.I mean, it's not as if I didn't gave @signalapp a fair chance.
So any #Messenger service that requires a #Phone Number for signup and/or useage is truly not a real replacement and inherently makes PROVEN WRONG assumptions [i.e. that it is legal and possible to obtain a phone number anonymously at someone's juristiction] about it's customers' ability to shield their privacy…
THIS is why I am going fucking ballistic on #TechPopulism aiming at #TechIlliterates because it's spreading a "false sense of #security" whilst completely disregarding absolute fundamentals when it comes to the underlying systems.
Your threat model is totally incoherent here and you talk like a cheap LLM
@lackthereof no it's not (because things are in fact intertwined) and I expect you to apologize for that!