I can only give you my feeling. There are 2 issues. One is security of the message itself. Can someone other than the key holder read the message? Do you ha

I can only give you my feeling. There are 2 issues. One is security of the message itself. Can someone other than the key holder read the message? Do you have forward security (i.e. if I expose earlier messages do new messages become readable as well)? Is any of the meta data exposed? Can a third person collect information about the message apart from the message itself? Generally Signal looks good as far as I can tell from those perspectives. Where it runs into problem is with authentication and protecting users from third parties collecting information about which people are exchanging information with each other. Signal makes the assumption that you don't mind that the person you are communicating with knows who you are. This makes it unacceptable for certain dissidents. The key you use to identify yourself allows the government (or almost anyone, really) to find out your name and your address. All people in a conversation know who all the people participating in the conversation are. So even if the target of your conversation doesn't mind being identified, you may have third parties who make introductions. Those third parties must be identified with Signal. This allows a potential attacker to build up profiles of who is associating with whom. At one point Moxie was discussing the idea of a protocol which would allow parties to introduce one another without having to reveal their identities. As far as I know this hasn't been implemented yet (but I haven't been keeping track of development). Additionally, as far as I can tell, Signal can potentially know which people are talking to which other people. Now, in the source code for their server, it doesn't, but there is actually no way to know that they are really using that source code in production unmodified. The lack of federation means that there is no way to mitigate this risk (To be fair, I completely understand their point on federation, but again I find it disingenuous that all discussion of federation is thrown out of the window as being too difficult to implement -- without any acknowledgement that we still have a problem that we need to address!) I don't think any of these issues are in dispute. The answer is simply: Signal does not intend to solve these problems. Their goal is to provide end to end encryption in the context of how you would use SMS. If that doesn't fit your purposes, then Signal will not work for you. I honestly feel that people are being a bit disingenuous. There are plenty of situations where email is a great medium for exchanging information. To say that "Email can not be secured" and that you should go to a messaging format is not exactly telling the whole story. There are applications where email can be secured "enough". There are applications where SMS messaging can be secured "enough". There are applications where neither is good enough. And yet, the argument against email is taken to the nth degree (the fact that you can take the contents of an encrypted email and send it unencrypted is purportedly a serious security flaw, while the fact that I can take the contents of Signal message and do the same thing is apparently not). However, like I said, I don't think tptacek is trying to be disingenuous. He honestly does like Signal and it honestly does improve security in the average case. He doesn't care that it doesn't do the things that it doesn't do because he thinks those things are less important. It's fair. He's an expert and certainly his opinions reasonably carry a lot of weight. You don't have to unthinkingly accept those opinions, though.