Re:A Formal Security Analysis of the Signal Messaging Protocol
by nickpsecurity on Tuesday November 08, 2016 @11:35AM
(#12901605)
That commenter's point is relevant here because major groups in threat model have 0-days in the platforms Signal runs on and many black hats hack Android too. So, anyone with that threat model can't trust Signal at all.
Outside that threat model, it's a useful privacy tool in that it at least reduces risk ftom some vectors. Still need OS-level security like putting and trusted path on OKL4 with secure firmware. Even then, subversion risk is so great that still can't use it for nation-states. Better to put usable front end on very cross-platform, easy-to-isolate tool like GPG. Or communicate in person or mailing encrypted files/messages.
Outside that threat model, it's a useful privacy tool in that it at least reduces risk ftom some vectors. Still need OS-level security like putting and trusted path on OKL4 with secure firmware. Even then, subversion risk is so great that still can't use it for nation-states. Better to put usable front end on very cross-platform, easy-to-isolate tool like GPG. Or communicate in person or mailing encrypted files/messages.