I could think of a few ranging from just asking Apple for a copy of your iCloud backups, asking you personally for a copy of the messages through to exploiting iOS itself.

Given that iCloud backups don't contain Signal messages, and "ask you for a copy" and "exploit the OS" affect any application... can you clarify?

The context was what are things that those with more or less unlimited resources can do in order to read your signal messages.

They are 3 particular paths that aren’t in any way open to most attackers but will work here.

Saying it impacts all applications isn’t wrong but it’s also not relevant to what was asked.

If whatever the hell you are doing requires a threat model where the NSA is interested in finding out who you are talking with and what you are saying the original comment of signal is inappropriate is 100% accurate.

If your threat model involves NSA finding out who is talking to you, PGP literally doesn't help you at all: it doesn't protect metadata.

Just to be clear I’m not advocating for PGP at almost any point in time, especially not in 2024.

Ok, sure! Just: this is a thread about why WhatsApp and Signal are so much more successful than PGP, and the argument given was that they sacrificed security to get their popularity. No, that's not it.

One way would be to install a zero-click Pegasus-like software on their phones. Better yet, ask Apple to activate code on their iPhone.

It’s a criticism of the platform, not applications running on it.

How exactly is email with PGP more secure than signal in this scenario? If the endpoint is root compromised there can be no security.

I don’t follow. Phones and desktops obviously are very different endpoints.

Yes: phones (or, at least, flagship Apple and Google phones) are drastically harder to compromise.

You don’t properly phrase things.

Yes, phone operating systems are more modern, and implement: sandboxing, hardware security, MAC, app permissions, etc. That’s why they do less. In this category, I would use iPadOS in lockdown mode.

But a phone is a device for the every day use of an average user. It’s not designed to be a security device to protect people against targeted attacks. If your threat model is a state actor, you might be better off with a desktop. Phones have phone numbers and take unauthenticated input from the external sources (messages). There is an opaque baseband chip. The threat model in which they are secure is skewed in favor of the phone provider: essentially you rent their device, and share your information. Phones communicate information about user such as the location, and might conveniently backup users data to the external servers by default. There is limited app choice. You can’t inspect, select and customize a phone OS. On the other hand, I can cherry pick a desktop OS, even build one selecting components, see, monitor and control the software, and run it on hardware from a source I trust.

No, we just don't agree. I've spent a fair bit of time on this problem, and more time than that talking to people who specialize professionally in helping targets of state attacks protect their comms, and the consensus I've heard is that nobody is better off on a desktop platform. If you're using a mainstream desktop/laptop platform, even Belize can afford to buy their way into your device.

I'm not saying this to convince you, just to establish that we are definitely talking about the same thing, and I am definitely not being flippant.

I was making a poorly informed assumption that signal's popularity must hinge on a key exchange process that can be MITM'd by authorities with enough privileges on the network to setup a persistent interception operation that spans every access point on the target's network partition.

So for instance, if you are using signal to do an outreach and support operation for a human rights group operating in China, it might be reasonable to assume that some Chinese intelligence orgs can view your plaintext. The strategy would then be to not transmit any information that would allow a decisive action against the group. The opportunity cost of revealing the surveillance has to be greater than the utility of acting on the intelligence. But obviously this would compromise the scope of assistance you could provide.

And the risk is iffy, for a few reasons that I've thought of since seeing your response:

1) PGP key exchange has the same problems when done over the network. Doing foreign outreach via PGP has the same problems.

2) I don't know of any examples of Signal MITM attacks stemming from weak key exchange. Worse, I don't actually know how key exchange works on signal

4) Key exchange problems are more of a universal nitpick against all crypto systems, not a full compromise

I'd be curious about your feedback - even if it's a chastisement.

I am also curious if you feel signal has any REAL issues which keep you up at night, if not key exchange.