5 ms·

I'm surprised no one here has mentioned that the government's cyber security agency CISA recommends the use of Signal, as of December 2024: > Apply these best

I'm surprised no one here has mentioned that the government's cyber security agency CISA recommends the use of Signal, as of December 2024: > Apply these best practices to your devices and online accounts. > 1. Use only end-to-end encrypted communications. > Adopt a free messaging application for secure communications that guarantees end-to-end encryption, such as Signal or similar apps. https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf https://www.cisa.gov/sites/default/files/2024-12/guidance-mo...

defrost 1y ago
The concern is less about Signal, more about inviting journalists and immediate civilian family to a front row as it happens discussion about upcoming targets. That and the deliberate lack of record keeping. Attorneys suing the United States government over its use of vanishing Signal messages to coordinate military strikes last month in Yemen allege that new court filings by the government reveal a “calculated strategy” by Trump administration officials to evade transparency laws through the illegal destruction of government records. The use of the private group chat—in which some messages were configured to automatically delete before they could be archived—was first revealed by The Atlantic’s editor in chief, Jeffrey Goldberg, on March 24, after he was inadvertently added to the group by Trump’s national security adviser, Michael Waltz. American Oversight subsequently filed Freedom of Information Act requests over the chats and then sought a temporary restraining order in a Washington, DC, federal court in an effort to compel the government to salvage any messages yet to be deleted. ~ https://www.wired.com/story/heres-what-happened-to-those-signalgate-messages/ https://www.wired.com/story/heres-what-happened-to-those-sig...
- leereeves 1y ago
  Hegseth has invited his wife and brother to other official meetings in person. He seems to be including them as part of his team; inviting them to the Signal chat probably wasn't a mistake. > That and the deliberate lack of record keeping. That part seems like speculation. How would we even know if records were kept? If records were kept, they'd be classified. > Attorneys suing the United States government over its use of vanishing Signal messages That seems very much like the concern is about the use of Signal, so the fact that CISA recommends it is very relevant.
  - maxerickson 1y ago
    Oh good, his disregard for security is flagrant rather than incompetent.
    - leereeves 1y ago
      I imagine he trusts his wife and brother more than he trusts anyone else with access to that info. Having staff he trusts is the opposite of disregard for security. And since this info was leaked to the press, there is clearly someone with access who he should not have trusted. Do you really think the security breach in this case came from his wife or brother?
      - maxerickson 1y ago
        Really going hard on the Wilhoit, huh?
        leereeves 1y ago
        > Really going hard on the Wilhoit, huh? I guess that's a reference to some fictional "Wilhoit's Law", right? I had to look it up. Turns out it's just a partisan Internet snipe from a classical music composer originally posted in the comments on a blog[1]. That sums up the case against Hegseth nicely. Just a partisan attack without substance, sustained only by ignorance. 1: https://slate.com/business/2022/06/wilhoits-law-conservatives-frank-wilhoit.html https://slate.com/business/2022/06/wilhoits-law-conservative...
        piva00 1y ago
        Without substance? Using chats without double checking who are members of the chat group is a thing not even I do when sharing some gossip, lol. That's blatant incompetence, a person responsible for the USA defence cannot be bothered to cross the members list of a group chat before sharing extremely sensitive information. And now he's adding his family into the mix?
        1y ago
belter 1y ago
These are generic, and quite weak recommendations on the part of the CISA. And that was the excuse of the CIA director, while knowing very well these are for regular work not real-time battle plans. Also those recommendations from the CISA recommend to use password managers...like Lastpass and 1Password and others, who had multiple security breaches. If this is the type of Cybersecurity the US government applies to day to day work, its much easier to understand the field day North Korean and Chinese hackers seem to have all the time. https://www.upguard.com/blog/lastpass-vulnerability-and-future-of-password-security https://www.upguard.com/blog/lastpass-vulnerability-and-futu... https://www.forbes.com/sites/daveywinder/2024/08/07/critical-1password-security-flaw-could-let-hackers-steal-unlock-key/ https://www.forbes.com/sites/daveywinder/2024/08/07/critical...
- leereeves 1y ago
  Your argument is that you know better than CISA? You didn't even read the linked article properly. These were not recommendations for "regular work", they were for "highly targeted individuals". But let's assume you're right and it's bad advice. The objection in the OP isn't that there was a breach. It's just exploiting the perception that using Signal is somehow wrong, and suggesting that it is a sign that Hegseth is incompetent. So it's rather important to know that using Signal is recommended by the government's own experts (even if those experts were wrong, hypothetically).
  - belter 1y ago
    "The White House is looking to replace Pete Hegseth as defense secretary" - https://www.npr.org/2025/04/21/nx-s1-5371312/trump-white-house-pete-hegseth-defense-department https://www.npr.org/2025/04/21/nx-s1-5371312/trump-white-hou...
    - leereeves 1y ago
      ...according to an unnamed source.
amalcon 1y ago
This is CISA telling potential target civilians (and government employees in their civilian capacity, since government employees talk to their friends too) what to do to protect themselves. The government has separate, much stricter guidelines for security compliance for cloud services used by the government. Those guidelines are called FedRAMP, and Signal is not FedRAMP certified.
- leereeves 1y ago
  It specifically says it is addressed to senior government officials. Also, I don't know for sure, but there was a link and discussion here not long ago saying that Signal is pre-installed and widely used at the CIA. https://news.ycombinator.com/item?id=43478091 https://news.ycombinator.com/item?id=43478091
  - amalcon 1y ago
    > It specifically says it is addressed to senior government officials. Sure, because senior government officials sometimes do things outside of their official capacity. If a senior government official's communications with their therapist or their lawyer e.g. are compromised, this could leave them vulnerable to blackmail. That's bad for everyone. Re: other post about use of Signal, I'm not commenting on that post and/or that issue. I'm not expressing an opinion either way on whether it's relevant to this issue. I just want to point out that FedRAMP exists, and Signal isn't FedRAMP certified. If you don't think that is important (and a lot of reasonable people don't), you do you.
aigen000 1y ago
Signal is not an approved communication channel for confidential attack plans.

defrost 1y ago

The concern is less about Signal, more about inviting journalists and immediate civilian family to a front row as it happens discussion about upcoming targets. That and the deliberate lack of record keeping. Attorneys suing the United States government over its use of vanishing Signal messages to coordinate military strikes last month in Yemen allege that new court filings by the government reveal a “calculated strategy” by Trump administration officials to evade transparency laws through the illegal destruction of government records. The use of the private group chat—in which some messages were configured to automatically delete before they could be archived—was first revealed by The Atlantic’s editor in chief, Jeffrey Goldberg, on March 24, after he was inadvertently added to the group by Trump’s national security adviser, Michael Waltz. American Oversight subsequently filed Freedom of Information Act requests over the chats and then sought a temporary restraining order in a Washington, DC, federal court in an effort to compel the government to salvage any messages yet to be deleted. ~ https://www.wired.com/story/heres-what-happened-to-those-signalgate-messages/ https://www.wired.com/story/heres-what-happened-to-those-sig...

leereeves 1y ago
Hegseth has invited his wife and brother to other official meetings in person. He seems to be including them as part of his team; inviting them to the Signal chat probably wasn't a mistake. > That and the deliberate lack of record keeping. That part seems like speculation. How would we even know if records were kept? If records were kept, they'd be classified. > Attorneys suing the United States government over its use of vanishing Signal messages That seems very much like the concern is about the use of Signal, so the fact that CISA recommends it is very relevant.
- maxerickson 1y ago
  Oh good, his disregard for security is flagrant rather than incompetent.
  - leereeves 1y ago
    I imagine he trusts his wife and brother more than he trusts anyone else with access to that info. Having staff he trusts is the opposite of disregard for security. And since this info was leaked to the press, there is clearly someone with access who he should not have trusted. Do you really think the security breach in this case came from his wife or brother?
    - maxerickson 1y ago
      Really going hard on the Wilhoit, huh?
      - leereeves 1y ago
        > Really going hard on the Wilhoit, huh? I guess that's a reference to some fictional "Wilhoit's Law", right? I had to look it up. Turns out it's just a partisan Internet snipe from a classical music composer originally posted in the comments on a blog[1]. That sums up the case against Hegseth nicely. Just a partisan attack without substance, sustained only by ignorance. 1: https://slate.com/business/2022/06/wilhoits-law-conservatives-frank-wilhoit.html https://slate.com/business/2022/06/wilhoits-law-conservative...
        piva00 1y ago
        Without substance? Using chats without double checking who are members of the chat group is a thing not even I do when sharing some gossip, lol. That's blatant incompetence, a person responsible for the USA defence cannot be bothered to cross the members list of a group chat before sharing extremely sensitive information. And now he's adding his family into the mix?
        1y ago

belter 1y ago

These are generic, and quite weak recommendations on the part of the CISA. And that was the excuse of the CIA director, while knowing very well these are for regular work not real-time battle plans. Also those recommendations from the CISA recommend to use password managers...like Lastpass and 1Password and others, who had multiple security breaches. If this is the type of Cybersecurity the US government applies to day to day work, its much easier to understand the field day North Korean and Chinese hackers seem to have all the time. https://www.upguard.com/blog/lastpass-vulnerability-and-future-of-password-security https://www.upguard.com/blog/lastpass-vulnerability-and-futu... https://www.forbes.com/sites/daveywinder/2024/08/07/critical-1password-security-flaw-could-let-hackers-steal-unlock-key/ https://www.forbes.com/sites/daveywinder/2024/08/07/critical...

leereeves 1y ago
Your argument is that you know better than CISA? You didn't even read the linked article properly. These were not recommendations for "regular work", they were for "highly targeted individuals". But let's assume you're right and it's bad advice. The objection in the OP isn't that there was a breach. It's just exploiting the perception that using Signal is somehow wrong, and suggesting that it is a sign that Hegseth is incompetent. So it's rather important to know that using Signal is recommended by the government's own experts (even if those experts were wrong, hypothetically).
- belter 1y ago
  "The White House is looking to replace Pete Hegseth as defense secretary" - https://www.npr.org/2025/04/21/nx-s1-5371312/trump-white-house-pete-hegseth-defense-department https://www.npr.org/2025/04/21/nx-s1-5371312/trump-white-hou...
  - leereeves 1y ago
    ...according to an unnamed source.

amalcon 1y ago

This is CISA telling potential target civilians (and government employees in their civilian capacity, since government employees talk to their friends too) what to do to protect themselves. The government has separate, much stricter guidelines for security compliance for cloud services used by the government. Those guidelines are called FedRAMP, and Signal is not FedRAMP certified.

leereeves 1y ago
It specifically says it is addressed to senior government officials. Also, I don't know for sure, but there was a link and discussion here not long ago saying that Signal is pre-installed and widely used at the CIA. https://news.ycombinator.com/item?id=43478091 https://news.ycombinator.com/item?id=43478091
- amalcon 1y ago
  > It specifically says it is addressed to senior government officials. Sure, because senior government officials sometimes do things outside of their official capacity. If a senior government official's communications with their therapist or their lawyer e.g. are compromised, this could leave them vulnerable to blackmail. That's bad for everyone. Re: other post about use of Signal, I'm not commenting on that post and/or that issue. I'm not expressing an opinion either way on whether it's relevant to this issue. I just want to point out that FedRAMP exists, and Signal isn't FedRAMP certified. If you don't think that is important (and a lot of reasonable people don't), you do you.

aigen000 1y ago

Signal is not an approved communication channel for confidential attack plans.