Questions tagged [signal]

A protocol (as well as an app implementing it) for end-to-end encrypted instant messaging.

Filter by
Sorted by
Tagged with
1 vote
2 answers
168 views

Does Signal store mobile phone numbers server-side in plain text?

Does Signal (the company) keep or ever have mobile phone numbers in plaintext (on any form of server-side storage)? I searched the web and couldn't find an official statement/documentation/answer/code/...
Adam Monsen's user avatar
0 votes
0 answers
61 views

How does Signal protocol work? Message queue is somehow disappeared after requested?

Signal claims they only know when users created their account and when users last connected to the server, but what about the message queue waiting for users devices to come online? I don't know how ...
Maxfield's user avatar
  • 127
1 vote
0 answers
15 views

How do end-to-end encryption (E2EE) IM apps implementing push notifications? [duplicate]

Say WhatsApp and Signal on Android devices, how do they keep the E2EE not be broken? Some answers claimed that WhatsApp uses VoIP background mode on iOS to make the push notification invoke the app to ...
Xiangyi Meng's user avatar
1 vote
2 answers
5k views

Signal — Can message previews of the messages you send be disabled in the chats’ list of your addressee?

Premise Signal is armed with measures to instil a sense of privacy in users by preventing undisclosed screenshotting and screencasting message threads, and by enabling the sender to set their text, ...
Raiden Snaker's user avatar
0 votes
0 answers
142 views

How long does Signal keep the keys for out-of-order messages?

I was reading the Signal protocol on how it handles out-of-order messages. What if those messages never arrived, does Signal keep the keys forever or are the keys deleted as soon as a new session is ...
user2600798's user avatar
7 votes
2 answers
420 views

In a synchronous environment, does Signal offer any security benefits that can’t be achieved with a modern version of TLS?

The Signal protocol utilizes the double ratchet algorithm to achieve end-to-end encryption with forward secrecy and future secrecy (aka break-in recovery). Forward secrecy ensures that if any of the ...
weaver's user avatar
  • 351
0 votes
1 answer
111 views

Is it possible to snoop on documents/media while uploading them on a Desktop app?

Websites often enforce HTTPS to prevent snooping of sensitive input. Is there something equivalent while uploading files from local disk onto a desktop app, say the desktop version of Signal? When I ...
Train Heartnet's user avatar
12 votes
1 answer
9k views

Signal messaging app / How does sync on connected devices work?

I would like to know how paired devices get synced together in Signal messaging app. So this is what they say on their website Signal messages, pictures, files, and other contents are stored locally ...
gnogno's user avatar
  • 123
0 votes
3 answers
807 views

What can my Telco / ISP learn from my Signal (secure messaging app) communications?

To preface this question, I use Signal messaging app for voice, video and text. I understand that the content of all these messages are encrypted and no-one but the sender and recipient can see/hear ...
Shae's user avatar
  • 53
2 votes
2 answers
2k views

Telegram, Signal, WhatsApp: chats encrypted in local storage on mobile devices?

I wonder if the chat content's are encrypted in local storage on mobile devices (iOS, Android). I hardly found any reliable information about this topic. My thought is about somebody stealing my ...
Abid's user avatar
  • 123
1 vote
2 answers
378 views

Known flaws in Signal app's security

Are there any known exploits in Signal's encryption protocol that could lead to messages being decrypted, or any other compromising information being released?
psitae's user avatar
  • 131
0 votes
2 answers
723 views

Is the video/audio traffic from WebRTC TURN relay servers encrypted end-to-end? As with the applications Signal and Jitsi Meet

Today I found a video on YouTube that surprised me (https://www.youtube.com/watch?v=Pkc3sE6iKV4). It is by Rob Braxman, a privacy advocate with a lot of expertise. He talks about all kinds of video ...
user avatar
3 votes
0 answers
241 views

What secure mobile messaging app is publicly known to be the most frustrating for state intelligence to read? [closed]

I imagine like either leaked or otherwise published official memos on efforts and signals intelligence programs to intercept and crack different types of communications either lamenting or chronicling ...
Jackie FJA's user avatar
5 votes
1 answer
2k views

Can WhatsApp, Signal or Telegram be hacked through a SIM SWAP attack?

In Cuba the telecoms/ISP monopoly, Etecsa, works with the political police to spy on dissidents, journalists and others. A common attack in Cuba is therefore SIM Swapping which is easy for them. It is ...
Pedro's user avatar
  • 51
42 votes
2 answers
32k views

Why is there no web client for Signal?

I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure. ...
SeyyedKhandon's user avatar
1 vote
1 answer
3k views

In Signal Messenger what is the purpose of verifying a safety number?

I've read the official page on safety numbers but they are still unclear to me. Without verification, there still is end to end encryption, so what difference does it make? Is it that a phone number ...
northerner's user avatar
0 votes
1 answer
228 views

If Signal database leaks, can somebody bruteforce access into my contact's chat history?

Recently Signal started forcing users to create a pin. I'm curious about the feature - doesn't it make Signal less secure if their database gets compromised? In other words, suppose that I'm chatting ...
d33tah's user avatar
  • 6,534
5 votes
4 answers
2k views

Why do people use "burner phones" rather than Signal or similar solutions?

Why do people use burner phones rather than Signal or similar? I would imagine that if you are high value target the police or intelligence service would simply eavesdrop every phone call passing the ...
d-b's user avatar
  • 499
3 votes
3 answers
3k views

Signal: contact people, or have people contact me, without revealing phone number?

Is it possible to use Signal without revealing my phone number to others? I'm personally using the Signal app on Android, but of course it applies to all versions, desktop and mobile. With Telegram ...
RocketNuts's user avatar
1 vote
0 answers
107 views

Meaning of unacknowledged pre key messages

I've recently tried to work with the Signal protocol, but the documentation isn't great. I've come across a problem where the messages being sent include the pre key because the client has ...
devgianlu's user avatar
  • 121
2 votes
3 answers
975 views

Are Whatsapp and Signal truly secure and user-privacy friendly?

I have been learning the famous "SIGNAL MESSAGING PROTOCOL", Its brilliantly designed and perfectly secure , but I doubt on its implementations Famous messenger services like Whatsapp and Signal ...
Chidhambararajan NRM's user avatar
5 votes
1 answer
390 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
Marinos An's user avatar
1 vote
1 answer
783 views

How to use Username/Password in Signal Protocol

I am trying to create a communication app from scratch (more like an html parsed messaging app) using the Signal protocol. While I do have lot to of programming experience, I am a crypto novice and ...
Jishan's user avatar
  • 193
11 votes
1 answer
538 views

Private messaging for protesters

Hello I am a protester in Hong Kong. Many protesters use telegram group. I have heard recently from the News that a group admin was tricked by the police to unlock their phone (police cannot force ...
hkprotester's user avatar
1 vote
0 answers
199 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
Fabio's user avatar
  • 121
3 votes
2 answers
440 views

Can a data requester get the sender when "Sealed sender" is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
Nightscape's user avatar
5 votes
1 answer
732 views

How was IronChat compromised?

How was IronChat compromised? https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html Dutch police have ...
Chloe's user avatar
  • 1,758
2 votes
1 answer
845 views

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

On Signal's blog they mention that keys for accessing your profile are exchanged normally with your contacts using the Signal Protocol just like messages are (implying they are already contacts and ...
aroooo's user avatar
  • 125
18 votes
3 answers
4k views

Why iterate 5200 times when computing Safety Numbers in Signal?

Safety numbers in Signal are derived from a hash of the conversation's users public keys and their phone numbers. Safety number are used to ensure that the conversation was not MITM-ed. When ...
bgd223's user avatar
  • 353
5 votes
1 answer
928 views

Can Signal encrypted voice calls be listened into by other apps?

Signal App (by Open Whisper) provides encrypted voice calls allowing two people to communicate via a data connection with secure encryption (assuming no MiTM attack). Given that Signal App uses the ...
Shae's user avatar
  • 53
54 votes
3 answers
30k views

Is Signal still more secure than WhatsApp?

WhatsApp has "recently" deployed end-to-end encryption using the Signal protocol, which is of course also being used by Signal itself. The related white paper (PDF). Now this raises the question: Is ...
SEJPM's user avatar
  • 9,720