38 ms·

> insecurely storing user data in the cloud > insecurely storing user data in the cloud What data are they storing insecurely? Signal has claimed [0] that th

> insecurely storing user data in the cloud > insecurely storing user data in the cloud What data are they storing insecurely? Signal has claimed [0] that the only two pieces of information they store are two integers, "Last connection date" and "Account Creation date". Has that changed? [0]: https://signal.org/bigbrother/cd-california-grand-jury/ https://signal.org/bigbrother/cd-california-grand-jury/

autoexec 4y ago
Yes it changed a while ago. They are now storing exactly the kinds of information they loved to brag about being able to say they couldn't hand over because it wasn't being kept in the first place. Specifically, they now keep your name, your phone number, your photo, and worst of all a complete listing of everyone you have been contacting using Signal and all of it is kept in the cloud. The community was upset and wanted this to be optional since many didn't want any of their data saved in the cloud (https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-...) but they were ignored. Security concerns were raised very early (https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...) and to their credit Signal did make it possible to create pins longer than 4 characters, but they still called them pins (which in most people's mind is a 4 digit number) still allowed short/simple pins, and in the end everyone's data is still sitting forever in a leaky SGX enclave and can still be brute forced. If you are a signal user and you had no idea this data collection was happening that should tell you everything you need to know about how trustworthy Signal is. The truth is they went out of their way to be confusing about all of this leading to tons of people having the wrong idea. (for example see this whole thread, but especially the point made by this guy about their communications https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...) My guess is that some three letter agency showed up and forced them to start collecting data. It'd explain why they collected the data, refused to make it optional, were so unclear in communications rolling it out, and why they seem to be trying to scare away their own users ever since. At this point I consider the fact that the very first sentence of their privacy policy has been a lie since 2020 to be a huge dead canary. It's not like people haven't asked them to update it (https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...)

autoexec 4y ago

Yes it changed a while ago. They are now storing exactly the kinds of information they loved to brag about being able to say they couldn't hand over because it wasn't being kept in the first place. Specifically, they now keep your name, your phone number, your photo, and worst of all a complete listing of everyone you have been contacting using Signal and all of it is kept in the cloud. The community was upset and wanted this to be optional since many didn't want any of their data saved in the cloud (https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 https://community.signalusers.org/t/dont-want-pin-dont-want-...) but they were ignored. Security concerns were raised very early (https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu...) and to their credit Signal did make it possible to create pins longer than 4 characters, but they still called them pins (which in most people's mind is a 4 digit number) still allowed short/simple pins, and in the end everyone's data is still sitting forever in a leaky SGX enclave and can still be brute forced. If you are a signal user and you had no idea this data collection was happening that should tell you everything you need to know about how trustworthy Signal is. The truth is they went out of their way to be confusing about all of this leading to tons of people having the wrong idea. (for example see this whole thread, but especially the point made by this guy about their communications https://old.reddit.com/r/signal/comments/htmzrr/psa_disabling_pins_will_now_upload_nothing_to_the/fyjy7a5/ https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...) My guess is that some three letter agency showed up and forced them to start collecting data. It'd explain why they collected the data, refused to make it optional, were so unclear in communications rolling it out, and why they seem to be trying to scare away their own users ever since. At this point I consider the fact that the very first sentence of their privacy policy has been a lie since 2020 to be a huge dead canary. It's not like people haven't asked them to update it (https://community.signalusers.org/t/can-signal-please-update-its-privacy-policy/15323 https://community.signalusers.org/t/can-signal-please-update...)