It's very disappointing to see Signal in the list of "Winners". I'd have expected Mozilla to do some real research before recommending something. It looks like

It's very disappointing to see Signal in the list of "Winners". I'd have expected Mozilla to do some real research before recommending something. It looks like they based their review off of Signal's privacy policy which hasn't been updated and has been outright lying about what they collect and how for years. Signal started collecting names, phone numbers, photos, and most importantly contacts and is now keeping that data in the cloud, but they refuse to update their privacy policy to detail that. Mozilla thinks that Signal only collects your phone number, and optionally your name and photo but that simply isn't true. If you include your name and photo in your profile Signal collects that data without asking and there is no way to stop them from collecting your contacts. Mozilla also claims that the data Signal collects can't be seen by anyone but that's a very open question considering how they're storing the data (SGX) and how it's protected (a simple PIN). See: https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... Most telling to me though is how Signal communicated the change to collecting this data (which was extremely evasive and resulted in a lot of confusion and misunderstandings) and their refusal to update their privacy policy - the very first line of which reads: "Signal is designed to never collect or store any sensitive information.", but if I were a whistleblower or a human right's activist I'd absolutely consider a list of everyone I was contacting using Signal to be "sensitive information" and Signal is designed to collect that data and keep it forever in the cloud. Signal promotes their app to the types of people whose freedom and lives depend on their communications being secure so I think lying to those same people about Signal's data collection practices is sickening, but I suspect that doing it so obviously may also be the folks behind Signal doing everything they can to warn people away. That would also explain some of Signal's other recent questionable actions like adding weird crypto stuff and removing one of their most popular features: the ability to use the app for both secure communication and unsecured SMS/MMS. I'm sure that Mozilla means well with this project, but I guess this is just a reminder to do your own homework and not take people's recommendations at face value, especially when you're dealing with highly sensitive data.