65 votes
Accepted

Is Signal still more secure than WhatsApp?

There are still a couple of security functions, which may matter to you, which Signal does better than WhatsApp. Client-Side Fanout When you use a group chat in WhatsApp, you send your message to the ...
SEJPM's user avatar
  • 9,770
42 votes

Why is there no web client for Signal?

Yes HTTPS is used. The thread doesn't say that the web app will be completely insecure, instead it says This effectively reduces the security of your end-to-end encrypted communication to that of ...
nobody's user avatar
  • 11.6k
23 votes

Signal — Can message previews of the messages you send be disabled in the chats’ list of your addressee?

Signal's feature is aimed at restricting unintentional disclosure. The client itself is open source, so no one can stop me from creating a client that doesn't honor the time restrictions or similar. ...
vidarlo's user avatar
  • 16.1k
21 votes

Is Signal still more secure than WhatsApp?

Disclaimer: this is a non-technical contribution (an addition to the already-given answer). Some content may be subjective, possibly speculative. I believe that when evaluating/comparing information ...
Marcin K's user avatar
  • 331
17 votes

Why iterate 5200 times when computing Safety Numbers in Signal?

The comment isn't explained very well, but I believe I've determined the math behind it. The safety number is 60 base 10 digits, but it's created in two 30 digit halves: one based on your phone number ...
AndrolGenhald's user avatar
14 votes
Accepted

Signal messaging app / How does sync on connected devices work?

Signal Multi-device Support Each linked device in multi-device treats each other as a different recipient. Encrypted messages are kept on server until they are received by the recipients. For each ...
defalt's user avatar
  • 6,861
9 votes

Signal — Can message previews of the messages you send be disabled in the chats’ list of your addressee?

It's not currently possible for a sender to prevent all unsecured disclosure of their messages on the receiving device of the recipient. While Signal does have features in place to help protect the ...
reflexiv's user avatar
8 votes

Why do people use "burner phones" rather than Signal or similar solutions?

People do use Signal, and even less secure systems like Whatsapp, to do the kind of communication that has traditionally relied on burner phones. Let's dispense with the spy fantasies first, though: ...
Therac's user avatar
  • 2,660
7 votes

Can WhatsApp, Signal or Telegram be hacked through a SIM SWAP attack?

I can only tell about WhatsApp because I do not use or specifically know about the others. Basically, with a SIM swap attack, an adversary can get future messages intended for the target, but not ...
Marcel's user avatar
  • 4,094
7 votes

In a synchronous environment, does Signal offer any security benefits that can’t be achieved with a modern version of TLS?

No, except to the extent that you think Signal provides better key authentication mechanisms than TLS (or vice versa). The main weak point in TLS key authentication is probably the Public Key ...
CBHacking's user avatar
  • 48.4k
6 votes

Private messaging for protesters

This is hard to answer, because, depending on how hard an entity might push, anyone might still give away information/unlock his/her phone under a threat. However: To mitigate accidental unlocks, you ...
Marcel's user avatar
  • 4,094
6 votes

Why iterate 5200 times when computing Safety Numbers in Signal?

The safety number is a derivation of the stable identifier and the public key of a user. Safety numbers are computed for both people in a conversation. The real important code is this snipit byte[] ...
Daisetsu's user avatar
  • 5,130
5 votes

Known flaws in Signal app's security

No, there are no known public flaw in Signal at the time of writing of this answer. Source: there was only one CVE for Signal (for Android), in 2018. The only one listed (fixed in version 4.25.0 the ...
A. Hersean's user avatar
  • 10.6k
5 votes

Why do people use "burner phones" rather than Signal or similar solutions?

Best practice would be to use a burner android phone along with Signal or another encrypted communications app with an outgoing firewall blocking everything else. Remove all unneeded apps especially ...
8vtwo's user avatar
  • 410
5 votes
Accepted

Can a data requester get the sender when "Sealed sender" is enabled in Signal?

In the blog post about the new feature, Signal says: Message contents are end-to-end encrypted with the Signal Protocol as normal, but the “envelope” containing the sender certificate as well as ...
vidarlo's user avatar
  • 16.1k
5 votes

Signal: contact people, or have people contact me, without revealing phone number?

The addresses in Signal is the phone number. It's specifically designed to use the phone number to address message, to be a drop in replacement for SMS, and offer opportunistic encryption for text ...
vidarlo's user avatar
  • 16.1k
5 votes

Are Whatsapp and Signal truly secure and user-privacy friendly?

WhatsApp has a known security design loophole. The private keys are indeed stored on the user's device. When you install WA on device B, you will be taking ownership of your account again. At this ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
5 votes

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource?

They do have reservations: WhatsApp does still provide end-to-end encryption, which ensures that a message is turned into a secret message by its original sender, and decoded only by its final ...
vidarlo's user avatar
  • 16.1k
5 votes

In a synchronous environment, does Signal offer any security benefits that can’t be achieved with a modern version of TLS?

The main difference is that signal is an end to end protocol: client1 <-> server <-> client2, while TLS is intended to be a point to point protocol client <-> server. So if you only ...
Serge Ballesta's user avatar
4 votes

Can a data requester get the sender when "Sealed sender" is enabled in Signal?

Hiding who is sending the message is indeed the intent of the feature. In many cases it should be effective, but as they note in their blog post, there are still improvements to be done: These ...
AndrolGenhald's user avatar
4 votes

Signal: contact people, or have people contact me, without revealing phone number?

Usenames entered beta in February 2024 Announcement: https://signal.org/blog/phone-number-privacy-usernames/ Finally!!! Related threads on the de-facto official forum Consider giving them a like. This ...
Ciro Santilli OurBigBook.com's user avatar
4 votes
Accepted

Can Signal encrypted voice calls be listened into by other apps?

At the moment Currently, the best way is to kill apps in the background that have microphone permissions, which is a bit of an ugly hack, and if you do not kill the apps fast enough they will be able ...
jrtapsell's user avatar
  • 3,197
4 votes

What can my Telco / ISP learn from my Signal (secure messaging app) communications?

Client's traffic to Signal server is also protected with TLS. ISPs cannot obtain meaningful data if you are doing text messaging only. However, based on traffic patterns, they can figure out when you ...
defalt's user avatar
  • 6,861
3 votes
Accepted

Telegram, Signal, WhatsApp: chats encrypted in local storage on mobile devices?

I've android device and I don't use telegram. I cannot confirm about telegram and iOS. Signal encrypts its internal message database with AES-256-CBC mode using SQLCipher. Encryption key and IV for ...
defalt's user avatar
  • 6,861
3 votes
Accepted

How was IronChat compromised?

TL;DR There is currently no Public Information how exactly messages were read, but it all points to a faulty Implementation of the Software and bad UI Design. There was not a Problem with the OTR, ...
Serverfrog's user avatar
3 votes
Accepted

Signal Protocol: How is identity exchanged if a key exchange hasn't happened yet?

Here are some specs if you want to look into it further, especially X3DH. Basically (and this is a simplification), the server stores a number of "prekeys" for each device, which are the public ...
AndrolGenhald's user avatar
2 votes

Why iterate 5200 times when computing Safety Numbers in Signal?

These comments in the source code are wrong. Developer did not really understand what he wrote. Here is his comment: The higher the iteration count, the higher the security level This statement ...
mentallurg's user avatar
  • 12.4k
2 votes

What can my Telco / ISP learn from my Signal (secure messaging app) communications?

My question is, what else can my ISP see? Particularly, is there anything in the metadata that they have access to that would let them know who I am communicating with (or which IP address I am ...
vidarlo's user avatar
  • 16.1k
2 votes

Known flaws in Signal app's security

It's not so much a flaw but more an expected and documented but nonetheless surprising behavior: since Signal uses the phone number as an ID, it is possible to identify whether a Signal account tied ...
2 votes

Why do people use "burner phones" rather than Signal or similar solutions?

The main point of a burner phone is not the privacy of the communications, but to avoid to tie a phone number to an identity. So that when an accomplice is busted by the police and its phone contacts ...
A. Hersean's user avatar
  • 10.6k

Only top scored, non community-wiki answers of a minimum length are eligible