HACKER Q&A
📣 rwol

Is Signal still a good app to use for encrypted messaging?


How secure is it?


  👤 rmrfstar Accepted Answer ✓
Its use of SGX for secure value recovery is highly problematic [1].

@matthew_d_green twitter feed has a regular stream of high-quality Signal commentary.

[1] https://arstechnica.com/information-technology/2020/06/new-e...

[2] https://twitter.com/signalapp/status/1262844332278603777


👤 h2odragon
Probably at least as secure and very likely moreso than pretty much any other option. cite as "random redneck off the internet" and due yer own dilligencing, of course.

I must say its preferable for plain old SMS messaging, if nothing else, for the options it offers and the stable sane behavior.


👤 shervinafshar
Depends on what you need. EFF previously used to have a scorecard[1] for all the messaging applications, but they reconsidered the model of their recommendation and put together a good set of articles on the topic which ask questions to consider and provide privacy and tech context. Here's one: https://www.eff.org/deeplinks/2018/03/thinking-about-what-yo...

The rest are linked from here[2].

[1]: https://www.eff.org/pages/secure-messaging-scorecard

[2]: https://www.eff.org/de/deeplinks/2018/03/secure-messaging-mo...


👤 viraptor
It all depends on the context / your threat model. Do you want to prevent a service provider from reading your messages? It's good. Do you want to be the next Snowden? Probably not. Do you trust people you talk to? Etc.

👤 upofadown
Pretty much anything will fail if the end device is compromised. It's probably good up to that point. Otherwise you will have to look into some sort of air gapping to a physically secure device dedicated to messaging (e.g. Yubikey).

As always, it depends on the threat model...


👤 rogerkirkness
If you have to ask, you'll just have to trust it.

👤 cpach
Yes. Signal is the gold standard of messaging apps.

👤 aaron695
Rather than conspiracies theories of, depends if you are a spy or not.

Anyone want to explain where Signal fails for top level spying and Nation States are coming after you?

And what the safer alternative is?


👤 zh
What about https://status.im/ instead - OSS, e2e encrypted by default.

👤 probinso
you have to understand and read their security model in order to assess whether it is an appropriate technology for your context. every time you use a security advertised platform read the threat/security model.

👤 besus
Wickr is another alternative with really tight security throughout it's app to stack.

👤 parliament32
Signal is still considered the gold standard for secure messaging on mobile.

👤 wideawake
Depends on threat model. For most people. Yes.

👤 giantg2
Best way to avoid interference or maintain security is to adopt old school tactics. Look at the war games the military played to prepare for Iraq and how the low tech red team comms worked.