• ᗪᗩᗰᑎ@sh.itjust.works
    link
    fedilink
    arrow-up
    68
    ·
    6 days ago

    Signal is a publicly available app that provides encrypted communications, but it can be hacked.

    This is misleading statement that will only confuse people who want to use a secure messenger.

    To clear things up with anyone who’s not technically inclined: Anything can be theoretically hacked. Signal has not been hacked and has no history of being compromised.

    The Signal “hacks” that linked people’s Signal client to devices that aren’t theirs were sophisticated phishing/spoofing attacks. The equivalent of getting someone to click a malicious link via email because it looked like the real thing.

    A reminder that you still need to do your due diligence even when using a secure service. Technology alone cannot completely protect you.

    • Eatspancakes84@lemmy.world
      link
      fedilink
      arrow-up
      2
      ·
      6 days ago

      Not particularly technically inclined so this question may be stupid, but suppose an intelligence service found some backdoor into Signal, wouldn’t they try to keep that information hidden from Signal? So in theory the chat could be vulnerable already?

      • ᗪᗩᗰᑎ@sh.itjust.works
        link
        fedilink
        arrow-up
        1
        ·
        4 days ago

        to add even more to what’s already been said, even if Signal’s infrastructure was compromised and they could see messages traveling through their servers, each one is encrypted, the keys are rotated with every message (cracking one, which is nearly impossible, doesn’t give you access to previous or future messages), and thanks to Sealed Sender, only the recipient knows who a message came from. There are many other layers that they’ve engineered to ensure they can’t know anything about you, like private contact discovery, using secure enclaves, remote attestation, etc.

      • Sanctus@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        6 days ago

        You dont just find backdoors in real encryption. They’re placed there intentionally. Signal already had governments demanding backdoors and they said no.

      • jpeps@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        5 days ago

        To add to the other comment and give an analogy: say you’re concerned that I secretly possess keys to the back door of your house and I can freely come and go. It’s technically possible. But two questions are important; how come you’ve never seen me in your house or any signs I’ve been there? And secondly, why do me and my friends keep asking you to give us your back door key?