I'm happy that I found this subthread here, which in a sea of comments talks about the really relevant point: Signal's goal is not to provide the most secure communication channel ever to targeted individuals. It's to mitigate passive eavesdropping on a whole population. This creates the smokescreen that the actual targets require, and prevents people from actually becoming a target in the first place.

Exactly. I only use signal for chat, and I tell my family and friends that they must install it if they want to send me text messages. It's not because I fear being hacked, it's because I don't want highly personal conversations about sex, drugs, chronic illness, and skeletons in the family closet getting picked up by global passive surveillance.

Yep. And Signal is as good as it gets for end users with zero technical knowledge. I've had many family members and friends install it on their own and not skip a beat.

This is a very underrated point.

It also means that an adversary can't go in long after the fact and dig up a message history from a server god knows where.

A lot of the eavesdropping scenarios concocted around key change in particular are fanciful. Practically speaking, end-to-end encrypted chat is often replacing email, not trying to protect secret agents hiding from the Reptilian Council.

>A big benefit of end-to-end encryption is that it makes it impossible for the service provider to suddenly start doing silent mass surveillance of their userbase.

Mass surveillance no, but if everybody blindly trusts any key provided (which seems to be the default "setting" for Signal and WhatsApp) then it's easy to start MITM'ing any connection at any point. You'll just get an innocuous-looking "your safety number has changed" and nothing else.

I do agree that it's still much better than nothing but I also agree with TFA when they say that "Signal cut a big corner by not planning device management properly", there are many ways Signal could make it massively easier for users to transfer their keys from one device to an other (for instance by deriving the master key from a passphrase bitcoin-wallet-style, or simply by making it easier to transfer your keys and history from device to device).

Because they didn't do this they probably considered that having an SSH-style intrusive "SOMETHING IS GOING WRONG HERE" message was too annoying and got rid of it. But really, they're fixing the symptom, not the problem.