8 ms·

Ask HN: Is Washington Post correct in saying Signal is unsecure?

• deleted 2y ago
  [deleted]
• kurtoid 2y ago
  I think the "unsecure" is relative - instead of something in-house, locally hosted, and up to the required standards for classified information
  • imjonse 2y ago
    Security/cryptographic strength are indeed relative, they depend on the 'threat model' being used.
• LinuxBender 2y ago
  Just guessing but perhaps what they meant was that Signal allows one to invite anyone into a chat thread whereas their actual in-house classified comms will not permit that without going through a massive chain of approvals and being assigned custom hardware.
  • EA-3167 2y ago
    That, and it's vulnerable to the usual sort of attacks that governments are capable of. If your threat model is "local cops" or "nosy people" then Signal seems very secure. If your threat model is "Enemies of the US" then honestly... nothing short of a SCIF is going to cut it.
    • LinuxBender 2y ago
      True and even a SCIF is not foolproof. From the 50's to the 90's the US and Soviet military played a lot of fun games one of which included typing up a classified document in a SCIF and the Russians met up with the contest judge with an exact replica of the document. There were thousands of such games. I learned about many of them in the military. Between those stories and the fact we bought transmitter parts from them during the cold war showed me that each nations military were never enemies, just the bureaucrats were.
• barotalomey 2y ago
  I think Signal is the only usable option for trusted fully e2e-encrypted messaging today. Even the military is using it in some countries.
  • vbekkerm 2y ago
    look into SimpleX
    • barotalomey 2y ago
      Since I never heard of it before, I looked it up. It's some website https://simplex.chat/ https://simplex.chat/ with some claims about privacy because they don't use user ID:s (uh). Do explain to me why anyone should trust this sus russian project [1] over the well regarded Signal? 1: https://find-and-update.company-information.service.gov.uk/officers/QAY5kEEu7CImMpxD4G8RknaXqjk/appointments https://find-and-update.company-information.service.gov.uk/o... (proof of russian natinality of Evgeny Poberezkin)
      • barotalomey 2y ago
        Had more look and learned that their privacy claim about no user ID:s is false, as they expose user IP:s: https://news.ycombinator.com/item?id=41381204 https://news.ycombinator.com/item?id=41381204
• crazygringo 2y ago
  Unsecure in terms of being vulnerable to state spying on cell phones. Not of network interception, but rather compromised phones where a foreign adversary can read all your phone's data. From this perspective, all phones are insecure. Classified government stuff isn't ever supposed to be on commercial smartphones in the first place. The kind of security Signal provides is sufficient for people who aren't active targets of foreign states.
  • organsnyder 2y ago
    I remember how big of a deal it was when Obama wanted to keep his Blackberry. I have a colleague that used to work for RIM, and he's alluded to work he did for that effort that he's still unable to discuss.
    • addandsubtract 2y ago
      Remember when Hillary used a private email server? Trump and MAGA were chanting to "Lock her up!"
      • revnode 2y ago
        Remember how she wasn't locked up? That set the precedent.
        • JadeNB 2y ago
          > Remember how she wasn't locked up? That set the precedent. Locking her up would have set a far worse precedent, and I think that the other norm-breaking behavior of the current administration does not support the idea that prior punishment of past administration members for insecure data management would have led this administration to more secure data practices.
        • rco8786 2y ago
          No better time than the present to establish a better precedent. Though more realistically, nobody needs to be going to jail in either case - but if there are zero consequences for anyone involved well, that's telling for a leader who frequently criticizes his opponents for not firing people when they do poorly.
• nonfamous 2y ago
  Also it’s not just the app — it’s the fact that the app is running on unsecured private devices in unsecured locations.
• input_sh 2y ago
  They're not saying it's not secure for normal conversation, but not up to the national security standards for such coversations. It not being a proper tool for the job is what makes it "unsecure".
  • shawnc 2y ago
    Yes, this. I was about to post my own comment and will instead reply and upvote yours. This strikes me as setting the conversation to be whether it's 'secure', and can then everyone can discuss that part - instead of the fact that's not where or how that conversation should have been happening at all.
• bananapub 2y ago
  come on dude. "unsecured" as in "not a secure comms system managed and approved by the NSA", which for the US government is normally considered a bad thing. for normal people who don't want the NSA to be managing their comms then Signal is approximately the best possible choice, along with not being a fucking idiot while using it.
  • organsnyder 2y ago
    The issue isn't the cryptographic strength—the issue is that it doesn't provide capabilities for an organization to manage it (such as preventing unknown parties from being added to group chats).
• bearjaws 2y ago
  Any system you can invite someone into willy nilly isn't really that secure. At least it doesn't give them the full chat history.
• givemeethekeys 2y ago
  It isn’t less secure than it was before the messaging scandal. What will reporters use moving forward? Facebook messenger? /s
• pavel_lishin 2y ago
  My understanding - largely based on this person's blog - is that Signal is the best secure messaging app that exists today: https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-competitor/ https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-sig...
  • opengears 2y ago
    no, simplex chat is https://simplex.chat/ https://simplex.chat/
    • y-curious 2y ago
      Ain't no one using a chat app named after a virus I have on my lips. But actually, I imagine there's significant friction to using a new "hyper-secure application" after the encrochat debacle.
    • random3 2y ago
      No, my RandomThingie is even *-er
  • tmiku 2y ago
    Soatok wrote a blog about this specific incident yesterday. Signal may have the most reliable E2EE, but that isn't the only security step required to secure the most sensitive information. https://soatok.blog/2025/03/25/the-practical-limitations-of-end-to-end-encryption/ https://soatok.blog/2025/03/25/the-practical-limitations-of-...
  • nradov 2y ago
    Nope. The US military has better (or at least more secure) messaging systems.
    • Ros23 2y ago
      ... based on Microsoft Lync :-) Yes, what a step forward.
• burningion 2y ago
  When you work for most public corporations, you aren't allowed to bring personal devices linked to company servers to specific countries. You need to bring a burner device instead, because you are perceived as a target for corporate espionage. This is like that, except the government and the type of people on the list are even better targets for their personal devices. The government has strict rules about secrecy and communication for military operations, and strong punishments for not following these protocols, because they can lead to a loss of life. This is a different sort of "unsecure". The platform itself may be "secure", but the device, being in public where someone could take a picture of military secrets, etc. isn't.
  • franktankbank 2y ago
    256 bit encryption can't secure kneecaps.
    • dehrmann 2y ago
      Or in this case, fat fingers.
    • foobarchu 2y ago
      My college advisor was fond of the term "rubber hose cryptanalysis"
      • fragmede 2y ago
        $5 wrench https://xkcd.com/538/ https://xkcd.com/538/
  • anon6362 2y ago
    It's called BYOD. Corporations have flirted with it for 10-15 years. The C-suite far too often is allowed privileges and exceptions like aristocracy that sacrifice and weaken the security of the organization. Also, even for corporate-managed devices, as an example, Meta has specific requirements and procedures for taking devices to and returning them from contentious places like mainland China.
• dymk 2y ago
  Well, unsecure in the sense that a reporter was mistakenly added to a group chat they certainly should not have been in. A secure app in this context would prevent random people from being added to secure areas.
  • exitb 2y ago
    Notably, it’s a common feature in a corporate environment, even though the stakes are typically much lower.
  • pavlov 2y ago
    A secure app in this context also couldn’t be loaded on any random smartphone and allow you to login with single-factor authentication.
  • BurningFrog 2y ago
    It's entirely possible that other "unsecure" people were on this and other chats without going public with it!
• aorloff 2y ago
  How could anyone know, unless they have contributed to Signal's repo ? Presumably within Signal, there are plenty of weak points. And certainly Signal's ability to modify their app as they please doesn't fit within the OPSEC guidelines. The question is: why would one of the most powerful militaries on the planet use a consumer app, regardless of its reputation ? And the answer is: because the Trump administration is compromised.
  • aerostable_slug 2y ago
    > And the answer is: because the Trump administration is compromised. By whom, exactly? Who benefits? Russia, somehow? It seems more likely that the administration officials fear being monitored and their conversations leaked by staffers, and they wanted to avoid official recordkeeping requirements. The former may have some merit (though I doubt anyone is going to leak plans to attack Houthis, regardless of their feelings about the Trump administration), the latter is likely illegal and deserving of investigation.
    • aorloff 2y ago
      Originally, I thought it was Russia. Lately I've been wondering if its Israel or Saudi Arabia
• WithinReason 2y ago
  The sentence applies the "unsecure" adjective directly to Signal as a "messaging platform", not to the phone itself or the wider context. Signal by itself is secure. No need to mince words here, the Washington Post is simply wrong.
  • ddejohn 2y ago
    puts on tinfoil hat The coverage of this story has felt a lot like it's being used as an excuse to trick people into believing that Signal is nOT a sECuRe mESsAGing APp to discourage regular people from using it.
  • SAI_Peregrinus 2y ago
    Signal allows you to add anyone to a conversation, without any requirement that they be vetted for security clearance, have a Common Access Card, or other centralized identity provider approval. Signal guarantees that you can't spoof the identity of a participant in a conversation (as long as you've verified their keys) but doesn't do anything to limit who you can add to a conversation. The cryptography is secure, but it's not intended for organizational use and doesn't support the sorts of centralized authentication that governments require. So it's not secure for those uses. The Washington Post is correct, but missing nuance.
• xoa 2y ago
  "Secure", particularly when used in the casual general public sense, is a pretty overloaded term. All real security is in the context of a specific threat profiles, and makes tradeoffs vs other required functionality. Signal is definitely "secure" in the sense of its core cryptography and design, and it's aimed to be of practical value to the global general public. But that requires being able to scale massively, making authentication more convenient and leaving more up to the users, who won't tend to have their own sophisticated centralized auth system, IT support, and constant life/safety critical stuff being thrown around. Signal provides tools that can be used for better assurance in who you're talking to but it doesn't simply take that out of users' hands entirely because for its use case that simply isn't feasible. For small vetted group top secret conversations by a sophisticated organization, it makes more sense to have something where inviting anyone who hasn't already been brought into the magic circle with physical interaction is simply impossible. If technically unsophisticated users are important, ideally one would have fully vetted tech support who will be monitoring all participants and doing the verification work for them. All managed via central systems and heavily walled off with multiple layers from crossing between high and low sides. If they want to talk to the general public, they should use physically different devices. Worse scaling, far more friction, but that's OK for top levels of a big organization in the context of extremely sensitive information. Signal is a tool and a decent one, but no tool is good for absolutely everything and trying to use a hammer as a saw isn't a defect in the hammer it's a problem with the user/organization trying to do something so foolish.
• dismalaf 2y ago
  No, they're wrong. Signal is considered extremely secure, which is why journalists and government uses it. Some people like to criticize anything Trump does, right or wrong. That being said, the Signal non-profit entity is located in the US, so probably subject to the same risks as WhatsApp and Messenger; namely US courts compelling them to share data.
  • dochtman 2y ago
    But the difference is that Signal has been architected from the start to retain much less (meta)data on the server, so that even if the Signal Foundation is compelled to share the data they have, that data will be extremely limited to the point of being mostly useless.
    • dismalaf 2y ago
      Thinking more in the sense of being forced to introduce a backdoor, weaken encryption, in the future which would give the US more data. Yes the encryption algorithm is theoretically very secure. Any entity that operates in the US has to abide by US laws, after all. Probably not a concern for US citizens since they're allowed due process but creates risk for non-Americans looking for a truly secure messenger, especially if they live in a place that is currently at odds with US policy (Canada, Europe).
  • vajrabum 2y ago
    There are laws about this sort of thing that have severe penalties attached. When I was in the Navy handling encryption gear I had to sign a paper that stated that I understood that compromise of the secrets I'd been entrusted with could lead to the death penalty. Are you saying that shouldn't be true? Or shouldn't be true for people above a certain level? Are you claiming that Signal running on consumer iPhone and Android devices where Pegasys and 0-days are for sale is secure? Are you claiming that it's secure to conduct classified business on a platform where you can add anyone to the conversation without the appropriate documented approvals?
    • dismalaf 2y ago
• shmatt 2y ago
  We publicly know about tools like Pegasus and competitors Predator, Hermit and I would confidently assume hundreds of other tools that dont publicly advertise themselves. (they all might be using the same handful of 0days for all we know) There are multiple public price lists for 0days, Crowdfense currently has iOS full Zero Click Full Chain listed as $5m-$7m And thats a long way to say - thats correct, its insecure. For the price of $7m any adverse of the US (or friendly country, who cares) can read all these government messages (who knows how many more Signal groups exist without the Atlantic editor) That would be the cheapest way to get US confidential information in the history of spy agencies. The NSA budget is $10B per year The assumption of anyone should be - everything in my iPhone and Android phone can be read for $7m. The conversations im having in front of my iPhone can be recorded for $7m. Then the only question left is - is the information worth more than that If the answer is yes, assume your phone is compromised and only talk near it / message using it, information you understand will become public
• emorning3 2y ago
  I wouldn't trust any form of symmetric encryption to secure anything. And I would bet that there used to be people in the govt that could have told you why.
  • SAI_Peregrinus 2y ago
    What would you trust that isn't symmetric encryption? And why not?
• tmiku 2y ago
  Soatok wrote a good blog post about this that was discussed yesterday: https://news.ycombinator.com/item?id=43471223 https://news.ycombinator.com/item?id=43471223 The Practical Limitations of End-to-End Encryption (41 points, 42 comments) The gist is that there are potential threats that any end-to-end encryption cannot fully protect against. Signal is a good provider of that encryption, but there are other considerations to protect highly confidential data, and Signal often lures non-technical users into disregarding those.
• mikequinlan 2y ago
  If it is know that secret agencies are using Signal, then it is almost certain that other agencies are working to exploit that. An obvious attack on Signal is to get one of your people a job working there, or to bribe/blackmail and existing employee, and have them install a backdoor or other exploitable code (maybe a secret weakening of the encryption?).
  • tommy_axle 2y ago
    That raises an interesting question. Are all of these agencies using the build from the Play/iOS stores or is there a build based on the audited public repo?
• nottorp 2y ago
  End to end encryption doesn't make the ends secure, just the channel between them. Not something the average Jane needs to worry about, but people discussing military action should. Edit: if Jane's phone gets hacked, they're going to swipe her credit cards and send messages to all her whatsapp contacts asking to borrow money urgently and here's a convenient Revolut link*. Not exfiltrate her Signal messages. * whatsapp thing is for real, the latest scam making the news around where I am.
• jeffbee 2y ago
  It's missing the point of the story to focus on this aspect. The characters involved in this event were not using Signal because they thought it was secure. They used Signal because they intended to break and knew they were breaking the law.
  • shawnc 2y ago
    Yes, thank you for saying so. I agree. And that's what should be being discussed everywhere.
  • AnimalMuppet 2y ago
    For this specific chat, what law were they breaking? (I'm not defending the Trump administration's law-keeping in general. I'm asking about this specific set of communications.)
    • ckemere 2y ago
      Record keeping rules.
    • jeffbee 2y ago
      https://www.archives.gov/about/laws/presidential-records.html https://www.archives.gov/about/laws/presidential-records.htm... The Vice President of the United States cannot use Signal "disappearing messages" to correspond with anyone for any purpose.
      • AnimalMuppet 2y ago
        Ah. Those rules. What you say is true. But if a technique makes it so that 1) they don't preserve a record for the future, and 2) they do leak (or risk leaking) information that can kill service people, I personally care more about #2. (Ironic that, in trying to not leak to future investigators/prosecutors, they increased the risk of leaking to foreign adversaries. Shows which threat they're focused on.)
• CSMastermind 2y ago
  Signal responded to this directly on X: https://x.com/signalapp/status/1904666111989166408 https://x.com/signalapp/status/1904666111989166408
  • derbOac 2y ago
    Also Bluesky: https://bsky.app/profile/did:plc:tovhrfml47r6u4idaitaxefk/post/3llaee27cbk24 https://bsky.app/profile/did:plc:tovhrfml47r6u4idaitaxefk/po...
• Jyaif 2y ago
  In this case, assuming you are using Signal on iOS, the app could very well decide to send all the decyphered messages of targeted users (users that say a certain thing, or users with a certain name) to a 3rd party server. If they wanted to be undetected in all cases, they could leak data via the timing of the network packets. And they could do all that without even knowing it, just by using a compromised toolchain. Long story short, unless the SW (the app, the OS, the toolchains) and the HW have been audited, you have no idea what's going on.
• modriano 2y ago
  For the threat profile of top leadership of the US government, yes, Signal is not secure. Signal runs on phones and phones can be compromised or lost, which can grant non-authorized individuals the ability to read the messages. Spyware like Pegasus [0] has been able to use zero-click exploits to penetrate target phones and read messages as though they were the phone's owner. The US has the best SigInt capacity in the world. The leaders of the US government know that phones are not secure against sophisticated adversaries and they know that we have very sophisticated adversaries. It's deeply troubling that so many of our leaders were so comfortable discussing Secret level plans in such a reckless and illegal way, and it's extremely likely that hostile adversaries have fly-on-the-wall level access to extremely sensitive US planning. [0] https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
  • JadeNB 2y ago
    > The US has the best SigInt capacity in the world. How can anyone, including the top SigInt people in the US, know that? It has surely always been part of the principles of good spycraft that, if you've got fantastic SigInt (or other -Int) capabilities, then the best way to take advantage of them might be to make sure that nobody else knows about them.
• chrisweekly 2y ago
  Nit: the word is "insecure", not "unsecure".
  • salgernon 2y ago
    Of “Небезопасный”?
• lmeyerov 2y ago
  The threat model for using signal is wider than what signal can audit internally: Audits of a signal deployment, vs signal software at some point in time, aren't just of the app, but also how it is installed, configured, patched, operated, monitored, etc. Likewise, it's the full system, like device, os, network. This stuff is supposed to run managed, especially at the level of the VP and secdef. Ex: Are they running signal patched from this week or 6 months ago, so a network attacker can leverage a software exploit to work around the crypto. Ex: Was an attacking payload sent through one of the chats while one of the people talking to the VP's + secdef's device was in Russia? With the unmonitored auto deletion, and on who knows what device/network, external + internal crimes audit trails are being intentionally, recklessly, and illegally deleted. Managed detection and response, and post-crime investigations, are hard when you can't see.
• openasocket 2y ago
  It is certainly insecure compared to the normal channels for sharing classified information. The US government maintains a network that is cut off from the rest of the internet (more or less, there’s some nuances). The only way to access it is through a SCIF room. So they aren’t just using encryption for sending data, they are also using physical layer security. You can’t hack what you can’t reach, after all.
• analog31 2y ago
  I wonder if its possible that an adversary added the reporter to the chat by controlling a compromised phone.
• derbOac 2y ago
  Just to reinforce what others are saying, security isn't a binary yes or no thing, it's on a continuum that has tradeoffs with usability, and where you want to be on that continuum depends on risk. There are things you could do to be more secure than Signal, but they would also be more difficult to use, and many of those things aren't about Signal itself, but the hardware and networks it is on.
• QuiEgo 2y ago
  Nothing stops you from opening signal in a bar and having a guy sitting behind you from the KGB reading the texts. Or say, adding a rando to the group. In their context, that means it’s unsecure. The cryptography of Signal is not the issue.
• 1vuio0pswjnm7 2y ago
  "commercially available messaging platform" Is Signal engaged in commerce. Is it a free service.
• aaron695 2y ago
  [dead]
• Ros23 2y ago
  1) Those Alex Horton and Missy Ryan do owe an apology to Signal project. Their publication was incorrect and caused misinformation regarding one of the most secure platforms on Earth. 2) As for Gov officials - I understand they used Signal on 1) Government issued devices, without a doubt running NSA built OS; 2) preinstalled Signal App, without a doubt audited by NSA line by line; 3) tactical OP information which has very close expiry date. 3) That "journalist", IMO, is guilty of high treason. They must have immediately notified the group about their presence and they must have not publish any of the secrets they accidentally got privy to. And even more, from professional POV, the actions of journalist were deeply non-ethical. I dare say, un-American and definitely not something that any US Citizen can be expected to do. 4) The "deep state" is furious because they can't leak Signal chat messages. IMO, it's a good choice. They (Administration) just need to carefully audit the groups and distribution lists. That was a very bad call. I personally will _continue_ using Signal, even with more confidence now.
  • jmulho 2y ago
    The journalist published proof that Hegseth texted detailed military attack plans via Signal two hours prior to the attack (the secrets) after multiple participants on the Signal chain lied to congress in a public hearing and claimed it didn’t happen. Would letting those lies stand have been the ethical thing for a journalist to do? Exposing a bunch of liars at the highest level of government is absolutely American and something all US citizens should be expected to do. Sadly, about half of Americans will still believe the lies even now that they have been exposed.
    • Ros23 2y ago
      You very conveniently ignored my demand for official apology to Signal team. Why? What you have against them? Or everything should burn because half of America hates Trump? ;-) What about my point of running Signal on officially issued by Whitehouse phones? Do you disagree with that? Or we are ignoring the facts again, to make TDS the center of our conversation? And, what I _really_ want to know - will you continue using Signal or, as result of that stupid publication, you would ditch it? Thank you and please don't take my post wrong - I respect your views very much, I am just appalled how Signal is getting hurt among all that. It's unfair to Developers and great people workingin Signal team.
• nottorp 2y ago
  Stupid question, if anyone still reads this thread: Why do these oh-so-secure offerings allow any idiot to add you to a group chat without asking you if you approve?