My reading is that the owner of any device the provider previously plugged in to could exfiltrate your mother's data by installing a persistent backdoor. Since this is a phone, I assume this includes email, passwords, etc. and they could use this data to e.g. access your mother's financial accounts. This is a fantastic vector for criminals.

Signal is providing a strong, albeit rude (likely in response to Cellebrite's claims), incentive to fix their shit. Would you rather have a temporary period where transfers weren't working, or deal with the scenario above in a year?

> weren't working

If that were the case, fine. But the post does not specify the effect of the "aesthetically pleasing" files. They could destroy all Signal data or irreversibly harm the machine itself.

We just have to "trust" the Signal devs to not do that?

This is not how security should work.

Huh? Don't you trust the Signal devs to not destroy all Signal data every day?

You're trusting the Signal devs to your keep messages safe and secure. I don't know if that means wiping all messages when accessed via Cellebrite, but that seems like a reasonable option. My assumption would be that they will just crash or brick the Cellebrite software. Either way and completely independently of the aesthetically pleasing files, if you disagree with the choices Signal makes to keep your messages safe and secure, there are many other messaging options that you can use.

Publicly calling out big security problems is exactly how security should work (notwithstanding specifics of disclosure).

Because when my mother has to transfer her phone, she'll then be liable for thousands of dollars of damage to their property, and she'd otherwise have no idea why.

That's the problem. The fact nobody sees the effects of this is absolutely surreal and alarming.

I’m not sure how your judicial system works but, in my country you can’t be hold responsible for something that “you have no idea why”. That’s not how liability works.

In the US, you are not exempt from liability just for ignorance.

If you don't know how to pay your taxes, you're still required to pay your taxes.

On what basis would you sue someone for software crashing when you plug in their device?

Property damage, of course.

Yeah, that's not going to happen

I think what you're missing is that Signal does not need to place any files on any phones for their purpose, and likely will not ever do so.

Their intention is to render using Cellebrite for court evidence worthless by suggesting that the record could have been tampered with at any point, if any phone the user scanned had Signal on it.

Proving that no phones ever had an 'aesthetic' file that could cause damage to Cellebrite is impossible, and they've provided clear reason why it is impossible to prove.

You're fabricating complications which don't make any technical sense as a justification to be angry about this basically harmless gesture. If you are that averse to the idea of being even remotely complicit in jamming the surveillance state, just don't use Signal.

Firstly, never has it been a requirement to "jam the surveillance state" to be a user of Signal. That's absolutely bananas.

Did you read the text at the bottom of the post? They are randomly installing malware on users' devices to break or harm or otherwise self-destruct when Cellebrite machines read them.

I'm not speaking for myself. I would opt in personally. I'm speaking for my mother who just wants a secure and reliable line of communication with her son without being pulled into some offensive scheme that could land HER in trouble or cause damages.

If something is broken or destroyed without user knowledge or understanding or consent, you better believe Signal will see court cases.

The exploit targets Cellebrite, not Signal's own software. Cellebrite is running on the machine doing the extracting and not the device containing the original data.

It's entirely possible that I'm wrong and this will cause your phone to explode, but if you don't trust the Signal developers enough to assume they won't intentionally explode your phone, you probably shouldn't be using their product.

I understand this. I'm saying my mother shouldn't be on the hook for her phone bricking a celebrity device used in good faith.

there are plenty of other options than Signal, vote with your feet

Name another privacy respecting application that can do calling and video between two phones with e2ee and is simple enough for a 65 year old non-tech-savvy woman to use. I'll switch her over immediately.

Viber, Telegram?

Telegram is a joke, it constantly gets censored in countries with totalitarian regimes.

Threema.