No more anonymous than some alternatives, although likely no more than mainstream alternatives, but while also leaving users with a false sense of security since this feature was supposed to prevent the exact thing it's allowing.
> is a pretty straightforward traffic analysis attack.
"straightforward" traffic analysis attacks that expose people who would normally be protected by VPNs and/or TOR, but now aren't purely because of how Signal works.
I mean, not only did these researchers find and disclose the flaw for free, they also came up with and tested solutions to the problem but still signal is like "nah, we'll keep it broken!"
It always rings on the PC app, but on our phones it's always hit or miss. Only once you open the app when someone is calling you, does it finally decide to ring.
Googling around it seems many are impacted by this bug which has been around since forever, but no fix has been implemented and since the dev team seems mostly iOS focused, I doubt it will ever be. The lack of supporting linking to Android tablets is another blow for us when iPad support has been available since forever.
Shame. I respect Signal and its devs for doing what they did, but we need more than a barebones messaging app with focus on stickers and stories instead of fixing jarring bugs and missing Android features, so it looks like it's back to WhatsApp for us. It may be part of Zuck's empire but it has never ever let us down in any situation.
> insecurely storing user data in the cloud
What data are they storing insecurely?
Signal has claimed [0] that the only two pieces of information they store are two integers, "Last connection date" and "Account Creation date". Has that changed?
[0]: https://signal.org/bigbrother/cd-california-grand-jury/
Specifically, they now keep your name, your phone number, your photo, and worst of all a complete listing of everyone you have been contacting using Signal and all of it is kept in the cloud.
The community was upset and wanted this to be optional since many didn't want any of their data saved in the cloud (https://community.signalusers.org/t/dont-want-pin-dont-want-...) but they were ignored.
Security concerns were raised very early (https://community.signalusers.org/t/proper-secure-value-secu...) and to their credit Signal did make it possible to create pins longer than 4 characters, but they still called them pins (which in most people's mind is a 4 digit number) still allowed short/simple pins, and in the end everyone's data is still sitting forever in a leaky SGX enclave and can still be brute forced.
If you are a signal user and you had no idea this data collection was happening that should tell you everything you need to know about how trustworthy Signal is. The truth is they went out of their way to be confusing about all of this leading to tons of people having the wrong idea. (for example see this whole thread, but especially the point made by this guy about their communications https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...)
My guess is that some three letter agency showed up and forced them to start collecting data. It'd explain why they collected the data, refused to make it optional, were so unclear in communications rolling it out, and why they seem to be trying to scare away their own users.
At this point I consider the fact that the very first sentence of their privacy policy has been a lie since 2020 to be a huge dead canary. It's not like people haven't asked them to update it (https://community.signalusers.org/t/can-signal-please-update...)
I loved signal and recommended it to many people over the years, but I ditched it after they started collecting and insecurely storing user data in the cloud, and I'm still disappointed in what it has turned into. The folks behind Signal had a great project once and I hope someone outside of the US steps up to give us a real replacement one of these days.