1

Premise

Signal is armed with measures to instil a sense of privacy in users by preventing undisclosed screenshotting and screencasting message threads, and by enabling the sender to set their text, audio and video-based messages to disappear at a set time.

However, text-based messages appear not only in the message thread, like in Wickr or other messaging protocols, but, to a varying degree, a preview of them in the chats’ list as well. The chat list, with any messages shown in preview, may be screenshot or screencast without a system notification presented to the sender of the breach of security implied in the choice of using disappearing messages.

Depending on different factors (size of screen, orientation, system font size settings etc.), anywhere between ~50 (i.e. Pro size iPhone screens with default font size) up to several hundreds of characters (macOS) are displayed without the security measure to notify the sender of screenshotting or screencasting done by the user in receipt.

In fact, the messages although displayed are not considered displayed for purposes of the self-delete timer hence a message may remain on display beyond the time set by the sender, and may permit a full chain of custody of the message itself until and unless the sender deleted them.

Additionally, message previews outside of the app may also appear on the Lock Screen, the Notification Center or in the form of Banners elsewhere that do not seem to be prevented on the sender side.

Question

Is there any elegant and secure way a sender can prevent all such insecure disclosure on the receiving devices of the addressee account?

Research

Although one may choose to work around the issue by including filler text or random characters in excess of the previewable portion of a message; however, it would be both impractical and a lack of assurances of security given defining the theoretical maximum of characters displayed may prove an elusive objective.

While it appears that Signal no longer has the feature available on iOS, Android still has the option labelled “Screen security”

“to prevent people from taking screenshots of your chat, and it is one of the most robust features you might’ve ever seen[; t]he feature is called “screen security[” w]hen enabled, the signal logo will appear to hide your chats in the recent menu with a blue privacy screen[; i]t will also protect anyone from reading your conversations from the recent app menu[; o]ne syllable [(sic!)] they have will block a screenshot in the AP and also in the recent list[; i]f you want to turn off the feature at some point, you just have to follow the same steps to disable it.”

source: https://www.quora.com/What-is-the-screen-security-feature-in-Signal-Messenger

Improve this question
5
  • 12
    "Signal is armed with measures to instill a sense of a privacy in users by preventing undisclosed screenshooting and screencasting message threads" -- this is not accurate. Signal has an option to block screenshots on your device only. The intention of this feature is to make it more difficult for a malicious app on your phone from obtaining a screenshot, and does nothing to prevent other people from taking screenshots, much less undisclosed ones (Signal doesn't notify when someone takes a screenshot).
    – Herohtar
    Jan 6 at 16:26
  • 9
    Why quote Quora instead of the official documentation? “On Android, this will also prevent screenshots of Signal on your own Android device” seems pretty clear (emphasis is mine). The Quora blurb adds just enough ambiguity to misconstrue what the feature does without actually stating anything else.
    – Relaxed
    Jan 6 at 17:15
  • 4
    Re: your edit. The iOS version never had that feature, as it is not supported by the operating system. The "Screen security" option in the Android client is not to prevent "people" from taking screenshots because it does not apply to anyone but your own device, and if someone else were to take your phone, they could disable the option in 2 seconds and take screenshots anyway. The point of the feature is that it prevents you from taking screenshots accidentally or prevents other apps on your phone from triggering screenshots of your Signal client.
    – Herohtar
    Jan 6 at 17:45
  • It wouldn't make sense for Signal to support such a feature without clearly announcing it. They're security and privacy focused.
    – vidarlo
    Jan 6 at 18:07
  • 3
    You asked "Is there any elegant and secure way a sender can prevent all such unsecure disclosure on the receiving devices of the addressee account?" and the answer is no. The premise of your question is wrong as people pointed out, it is not possible for you to fully control what someone does with the data you send them because the recipient can do anything they want with their own device. What's the point of asking this question if you're not willing to learn from the answers and correct your misconceptions?
    – eesiraed
    Jan 6 at 23:45

2 Answers 2

Reset to default
23

Signal's feature is aimed at restricting unintentional disclosure. The client itself is open source, so no one can stop me from creating a client that doesn't honor the time restrictions or similar.

So in short, if you rely on strict enforcing of the timeout for messages, then Signal is not the right product for you.

Once you've sent a message, you cannot control what happens to it, no more than you can make water less wet.

Is there any elegant and secure way a sender can prevent all such unsecure disclosure on the receiving devices of the addressee account?

No, there isn't as long as the receiving device is under the control of the attacker in your scenario. Signal aims at securing messages during transit, and they rightfully recognize that you should not attempt to stop someone from taking a screenshot of a message if they want. Sure; they provide means to block it on android, but it's a setting that the user can change.

Furthermore, Signal is open source. I can download the source from GitHub, and remove the timeout functionality if I want. Even if it was not open source, it would probably be possible to remove it from the binaries if desired.

The features you request would not be meaningful security. It'd be courtesy nods.

If you do not trust your recipient enough to send them messages, then you should not send them messages. You should not rely on Wickr, Signal, or any other application to restrict them sharing the messages, because that will only come back to burn you at a later stage.

Improve this answer
7
  • “[N]o more than you can make water less wet.” Thanks for the infantilizing remark. Like Wickr, Signal could permit the sender that their messages not be displayed anywhere outside the message thread of the recipient — this would establish a meaningful foundation for the screenshot and screencast notifications to the sender; otherwise, what’s the point? The interpretation that “it seems Signal is designed to prevent unintentional disclosure” is also flawed implying that it rests on perfect trust between sender and recipient, the screenshot notifications would not have been implemented.
    – Raiden Snaker
    Jan 6 at 1:31
  • 13
    It's up to the user to set up such feature. And note that Signal also has a desktop edition, where the application has no control over what happens to the screen. So if you think Signal protects against the recipient deliberately leaking or screenshotting things, then no. Furthermore, I've never seen screen shots notifications in signal, and can't find it documented either. Their app is open source, so it's trivial to rremove such things as well.
    – vidarlo
    Jan 6 at 7:06
  • 13
    Signal's timeout is a social cue to the recipient, and also a tool to protect against data loss at a later stage - but not to protect you against the recipient of the messages deliberately storing them. Because you do not have control over the messages after they're sent. They're digital bytes. Digital information is inherently trivial to copy.
    – vidarlo
    Jan 6 at 7:08
  • 2
    @RaidenSnaker Which chain of custody?
    – vidarlo
    Jan 7 at 9:27
  • 1
    Why is there so much emphasis on the technical feasibility protecting digital data, APIs for detecting screen shots, etc.? It doesn't matter. You can trivially photograph a phone screen with another camera, phone or heck, even a photocopier. If a person's eyeballs can see your message, there's no feasible way to make sure nothing else can also see it.
    – Alexander
    Jan 8 at 20:47
9

It's not currently possible for a sender to prevent all unsecured disclosure of their messages on the receiving device of the recipient. While Signal does have features in place to help protect the privacy of its users, there are still some limitations to what can be done. For example, as you mentioned, message previews may appear on the lock screen or in the notification center, and there is currently no way for the sender to prevent this from happening.

Additionally, it is always possible for a recipient to take a screenshot or screencast of a message thread, even if the sender has enabled disappearing messages. Even if there were settings that allow the sender to suppress notifications, the recipient can arbitrarily process and save the message. This applies regardless of which messaging service is used.

The best thing a sender can do to protect the privacy of their messages is to be mindful of this and to communicate with their recipients about their expectations for keeping their messages private.

Improve this answer
14
  • 3
    This is security through obscurity you're arguing for. Has Netflix DRM stopped a single of their movies from appearing at ThePirateBay? No.
    – vidarlo
    Jan 6 at 7:10
  • 8
    @RaidenSnaker The very first argument you rightfully bring up destroys the entire premise of the question. You are concerned that I will take a photo of the screen and even go as far as to suggest using front camera to detect whether I am trying to do so? Well, thanks for a massive and totally unnecessary privacy invasion, guess I will just set up a telephoto camera or sandbox an Android OS on a desktop pretending it's a phone, allowing me full access to everything, with you being none the wiser...
    – Lodinn
    Jan 6 at 9:41
  • 9
    Streaming services make it harder for the least motivated people to circumvent the protections, and that is good enough for them. You are advocating for something wildly out of proportion, hurting regular users on many levels, to achieve precisely nothing with a strong adversary. All the information you share is reproducible by default, even the spoken word. If you have a specific use case and a threat model in mind, you could play it out, but it is not clear from your question why would you have an exchange with a potential adversary and thus, what measure of protection could be sensible.
    – Lodinn
    Jan 6 at 9:45
  • 2
    @RaidenSnaker You are mistaken. Signal does not notify that someone has taken a screenshot, in any situation.
    – Herohtar
    Jan 6 at 16:32
  • 2
    @RaidenSnaker the underlying issue here is that in order to receive and decrypt the messages, your device already has the keys - either on disk or in memory. If I have root on the device, I have everything. I'll grant you that the protections you're talking about would raise the bar of difficulty for the average Signal user, but it's not going to save you or your messages from a determined recipient who knows what they're doing. Let's be honest, even if you could have all the things you want, I just whip out my camera and take a picture of my phone. ggez
    – Blackhawk
    Jan 6 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.