Multiple Russia-aligned threat actors actively targeting Signal Messenger

Re:Multiple Russia-aligned threat actors actively targeting ... by rakoo on Wednesday February 19, 2025 @03:18PM (#43107041)

Take time with the people to do the boring stuff on their phone/computer:

- install [the thing]

- start it, show how it works

- search for yourself, start a convo, exchange messages

- add them to the group

IME the friction comes from having to do the first step, because it's really an annoyance no one cares about, so if you take it for yourself and do it they'll like that

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by OsrsNeedsf2P on Wednesday February 19, 2025 @01:02PM (#43105180)

"Sorry, I only use Signal" has worked nearly a decade for me

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by echelon_musk on Wednesday February 19, 2025 @01:37PM (#43105644)

Virtue Signalling!

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by throwawayq3423 on Wednesday February 19, 2025 @01:46PM (#43105771)

Which is bad, how?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by potato3732842 on Wednesday February 19, 2025 @01:56PM (#43105888)

It's a joke, because virtue signaling (or whatever name you want to give it) is bad, but Signal the messenger app is good so it's a play on words.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by heyloolma on Wednesday February 19, 2025 @02:19PM (#43106211)

It’s not bad. It just IS.

the only people that think it is bad are people who have a different opinion and feel attacked for whatever reason. I find it telling when people accuse others of virtue signaling because it is almost always someone who is jealous or insecure attacking said signaler.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by DFHippie on Wednesday February 19, 2025 @03:55PM (#43107535)

"Virtue signaling" in theory means "talking the talk without walking the walk", but it's generally thrown out by people who make no effort to assess whether the person criticized is walking the walk or even in contradiction of such evidence.

Driving an economically efficient car -- choosing any sort of car -- has enormous consequences on one's life, for example. Choosing to by a particular car isn't a decision made lightly. But Prius drivers back in the day were accused of virtue signaling, as though the Prius were equivalent to a temporary tattoo.

In fact, speaking of temporary tattoos, simply having a bumper sticker advocating for animal rights, say, belief in anthropogenic climate change, or peace in the Middle East will expose one to regular displays of hostility and aggression, so it isn't a cheap signal.

In other words, in my experience your observation is spot on.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by root_axis on Wednesday February 19, 2025 @05:04PM (#43108335)

> "Virtue signaling" in theory means "talking the talk without walking the walk"

Virtue signaling means sending deliberate signals about your virtues, whether you "walk the walk" or not. People are often critiqued for going to uncomfortable lengths to signal their virtues, but something as simple as a "meat is murder" shirt or a MAGA hat is also virtue signaling.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by golergka on Wednesday February 19, 2025 @01:06PM (#43105232)

What if you need to contact someone and they use whatsapp?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by croes on Wednesday February 19, 2025 @01:18PM (#43105392)

What if they want to contact you and you use Signal?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by jisnsm on Wednesday February 19, 2025 @02:04PM (#43106008)

Luckily, with the technological advances in the last months, it is now possible to install more than one app on a phone at a time.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by maigret on Wednesday February 19, 2025 @02:28PM (#43106329)

It is also possible to communicate without using Meta services.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tumsfestival on Wednesday February 19, 2025 @03:08PM (#43106901)

Good luck with that depending on where you live.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by accrual on Wednesday February 19, 2025 @03:30PM (#43107222)

And when you live. The 20s-30s year old crowd I interact with seems to avoid, if not mock FB. I recognize it has its uses and benefits, though.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by jisnsm on Wednesday February 19, 2025 @05:05PM (#43108342)

They mock fb whilst they use instagram and WhatsApp.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by inetknght on Wednesday February 19, 2025 @05:18PM (#43108473)

> it is now possible to install more than one app on a phone at a time.

And, in doing so, achieve the security posture of the worse of the apps!

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by Henchman21 on Wednesday February 19, 2025 @01:12PM (#43105314)

IME you say “Sorry I only use Signal” and either they change or you don’t get in contact with that person.

If you change and abandon your principles were they really principles in the first place?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by golergka on Wednesday February 19, 2025 @01:21PM (#43105437)

How do you tell that to them in the first place? You got someone's phone number. The person who gives it to you tells them that they use whatsapp. You can't even tell them "Sorry I only use Signal" unless you open whatsapp app.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by basisword on Wednesday February 19, 2025 @01:51PM (#43105828)

You realise you could use that phone number to...call them and let them know? Also - in what situation are they giving you a phone number and telling you they use WhatsApp but you having no way to respond when receiving that info? If it's in person you can explain at the time. If it's taken from a website, call them. Or you can even fall back on SMS.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by prmoustache on Wednesday February 19, 2025 @01:58PM (#43105925)

If they can't reach you via whatsapp, they will call you.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by kelnos on Wednesday February 19, 2025 @04:56PM (#43108268)

Presumably at the time they've given you their phone number, they've told you that they are on WhatsApp, and then you've responded directly that you're only on Signal.

If there is a communications channel by which they can give you their phone number, you can use that same channel to discuss what messenger to use.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by ycombinatrix on Wednesday February 19, 2025 @01:24PM (#43105478)

Not GP - I tolerate Whatsapp but I draw the line at SMS.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tremon on Wednesday February 19, 2025 @04:06PM (#43107696)

For me it's the other way around: I tolerate SMS but I draw the line at Whatsapp.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by imp0cat on Thursday February 20, 2025 @01:29AM (#43111750)

Sounds like someone who never had to pay for each SMS.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tremon on Friday February 21, 2025 @07:52PM (#43134939)

Sounds like someone shouldn't have skipped those perspective-taking classes in kindergarten.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by root_axis on Wednesday February 19, 2025 @01:13PM (#43105325)

RCS?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by immibis on Wednesday February 19, 2025 @01:20PM (#43105426)

If you really really really need to? You use Whatsapp.

If you don't need to? You tell them to get Signal.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by Fnoord on Wednesday February 19, 2025 @01:31PM (#43105580)

You call them. Or use SMS. Or use e-mail.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by bdangubic on Wednesday February 19, 2025 @01:02PM (#43105185)

same

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by MillironX on Wednesday February 19, 2025 @03:26PM (#43107157)

I usually tell people, "It's like iMessage, but it works on iPhone and Android," or "Hey, if you download Signal we can send high-quality photos between Android and iPhone."

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by mmooss on Wednesday February 19, 2025 @01:56PM (#43105891)

I helped an especially non-technical user install Signal and they didn't need my help at all. They were using it in a minute - download from the app store, transcribe a code from a text message, and you're in - and it worked just like legacy text and phone.

I'd tell them that - just download it and you'll be texting me in a minute, and now nobody is tracking everyone you talk to.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by imglorp on Wednesday February 19, 2025 @02:02PM (#43105983)

To be clear, someone will/can track WHO you talk to. Right?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by mmooss on Wednesday February 19, 2025 @03:05PM (#43106857)

My understanding is that they can/do on WhatsApp.

On Signal, unless there is a some bug or outright fraud, afaik they cannot - that is one of their fundamental goals, and they did a lot of work to develop communication technology that worked without revealing that metadata.

(Of course, if someone gets access to your phone, then they know who you are talking to.)

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by seb1204 on Wednesday February 19, 2025 @04:27PM (#43107935)

That kind of meta data is not stored by signal as far as I know. But yes, data stream between two end points can be linked to communicating with each other.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by lcc on Wednesday February 19, 2025 @02:51PM (#43106658)

I've had good luck just asking for it, even with group chats (though admittedly my friends are mostly technical and more privacy conscious than the average person). Usually it's a switch from FB Messenger and I just say that I don't want to be locked into Facebook anymore.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tapoxi on Wednesday February 19, 2025 @01:31PM (#43105566)

My (non-technical) Mom actually got my whole extended family on Signal with a group link. Since there's no real account creation it was painless. It's how we do all video calls/photo sharing/chat now.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by miggol on Wednesday February 19, 2025 @01:44PM (#43105742)

Group stories are great fun and a feature I seriously miss on Whatsapp. They work well from meme chats to family groups.

There being a killer feature that Whatsapp users are missing out on won't convince everyone but it sure makes me feel less like a nerd when encouraging the switch to Signal.

I find it quite funny that such an obvious feature likely hasn't been added to Whatsapp yet because Meta thinks Instagram is for stories. That's pure speculation on my part though

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by Mistletoe on Wednesday February 19, 2025 @01:38PM (#43105660)

Just explain what end to end encryption means. People are starting to get it and don’t want companies able to read their messages.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by baq on Wednesday February 19, 2025 @01:50PM (#43105815)

Nobody cares about this unless they deal drugs or something.

What some people care about is not giving all their private conversations to masculine energy zuck - but don't expect any major wins.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by retrochameleon on Wednesday February 19, 2025 @01:56PM (#43105883)

Awful shortsighted and uninformed viewpoint that has been beaten into the ground ad nauseum.

Read a couple books. Privacy is a precondition to democracy.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by baq on Wednesday February 19, 2025 @02:01PM (#43105965)

It isn't a viewpoint. It's a fact. I'm using signal for almost a decade now and only managed to get a dozen or so people to use it in any capacity. Most keep using whatsapp as their primary method of communication anyway.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by codethief on Thursday February 20, 2025 @04:08AM (#43112646)

Meanwhile, I have been using Signal since the TextSecure days, too, and practically all my contacts are using it these days.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by baq on Thursday February 20, 2025 @04:48AM (#43112882)

Good for you, tell us how you did it!

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by lukan on Wednesday February 19, 2025 @02:31PM (#43106377)

What books would you recommend, that proof that connection?

"Privacy is a precondition to democracy"

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by esafak on Wednesday February 19, 2025 @04:59PM (#43108291)

How would you convert an autocracy into a democracy without secrecy? There are no peaceful means so you have to plot.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by lukan on Wednesday February 19, 2025 @05:19PM (#43108480)

Secrecy and privacy is not really the same concept.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by monadINtop on Wednesday February 19, 2025 @02:03PM (#43105999)

>Read a couple books

Maybe you should? It might help improve your reading comprehension. The person you're responding to said that most normal people don't care enough to switch to a vastly less popular app, which is obviously true.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by mikedelfino on Wednesday February 19, 2025 @01:45PM (#43105757)

Isn’t WhatsApp end-to-end encrypted?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by FergusArgyll on Wednesday February 19, 2025 @02:30PM (#43106367)

Yes it is, they actually use the signal protocol,[0] but they collect metadata which Signal supposedly doesn't (you can't really know)

[0] https://en.wikipedia.org/wiki/Signal_Protocol#:~:text=Severa...

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by inor0gu on Wednesday February 19, 2025 @04:29PM (#43107965)

Signal doesn't collect that data, but you have no reason to trust me on it.

Look at what data they can provide to governments when compelled by law: https://signal.org/bigbrother/

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by mmooss on Wednesday February 19, 2025 @01:57PM (#43105904)

I thought they recorded the metadata - who talks to who and when. (For the uninitiated, that is as valuable or more valuable than the message contents.)

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by inor0gu on Wednesday February 19, 2025 @04:28PM (#43107946)

you also send them your contacts in plaintext so you can find who's also on WhatsApp; signal doesn't

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by Mistletoe on Wednesday February 19, 2025 @10:58PM (#43110936)

https://www.reddit.com/r/privacy/comments/v7tsou/is_whatsapp...

It seems to be but there is more to it than that.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by subjectsigma on Wednesday February 19, 2025 @02:11PM (#43106097)

My Signal experience: ex gf in college asks what app I’m using to text. Tell her it’s Signal, E2EE, messages are only stored on her phone and nobody else can read them. She says cool and downloads the app. Four months later her phone breaks.

“Hey subjectsigma I got my new phone today. Where are all my messages?”

“… Do you have your old phone? That’s the only place they are.”

“No? Last time I got a new phone WhatsApp moved my messages over, and WA is E2EE so I thought it worked the same way.”

“Nope if you don’t have a backup or your old phone they’re gone. Sorry.”

“This is bullshit. Why does anyone use Signal. I can’t believe it deleted all my messages. I’m uninstalling it. Etc etc.”

We have a long way to go, my friend.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by noAnswer on Wednesday February 19, 2025 @02:53PM (#43106684)

It only works for WhatsApp if you have Backup to Google activated[1]. I once tried to work with backuped files from my old phone and it didn't work. (Older tutorials indicated that it once worked, though.)

[1] There was a time WhatsApp had a nag-screen if you hadn't Backup to Google activated. So I guess most people would have eventually caved.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tremon on Wednesday February 19, 2025 @04:08PM (#43107709)

That nag-screen is still there, it pops up roughly every three months for me (though not on my primary phone, Whatsapp won't get anywhere near that one).

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by Mistletoe on Friday February 21, 2025 @10:26PM (#43135798)

I don’t understand why people need old messages so badly. If they disappeared it would be fine with me. I set my iPhone messages to auto delete after a few months to save space and it works fine. A text is ephemeral, if I need to save something I use email.

[ Parent | on HN ]

[dead]

Re:Multiple Russia-aligned threat actors actively targeting ... by rsingel on Wednesday February 19, 2025 @03:03PM (#43106826)

Your anti-Signal FUD is so tiresome. Get a new hobby.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by autoexec on Wednesday February 19, 2025 @03:11PM (#43106956)

Every time it comes up I find signal users who were unaware that signal was collecting and keeping their data in the cloud. Maybe when that stops happening I'll stop mentioning it, but until then I'll be happy to point out that signal is lying to people when they say that "Signal is designed to never collect or store any sensitive information."

They'd had since 2020 to update their policy page and many people have asked them to, but it hasn't happened either. I'm fine with calling them out on their bullshit when the topic arises. Sorry if it bugs you to be reminded of it.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tptacek on Wednesday February 19, 2025 @03:30PM (#43107218)

I'm not going to run interference against all the comments you're writing on this thread, because I don't think Signal needs the help and it would make the thread ultra-tedious. But during the brief window where people were taking Wire seriously as a Signal alternative, I'd occasionally write a comment or tweet like:

Were you aware that Wire keeps a high-fidelity plaintext database of exactly who talks to who on their platform?

And people were reliably startled. But all that was happening was that ordinary users have no mental model for how a secure messenger is designed, and hadn't thought through how serverside contact lists that magically work no matter what device you enroll in the system were actually designed.

So here I'll just say: the stuff you're saying about Signal is pretty banal and uninteresting. The SGX+Enclave stuff is Signal's answer to something every other mainstream messenger does even worse than that. By all means, flunk them on their purity test!

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by autoexec on Wednesday February 19, 2025 @03:52PM (#43107502)

Even if you thought that SGX was bulletproof and pins were impossible to brute force, instead of just being 'better than what most other apps use' what possible justification is there for outright lying to users by claiming that their app doesn't collect any sensitive data when it does?

Signal is advertised and recommended to some extremely vulnerable people whose lives/freedom depend on their security. Signal owes users a clear explanation of the risks that come from the use of their software so that whistleblowers, journalists, and activists can make informed choices. Lying to those users is disgusting.

Seen most charitably, the fact that the very first line of their privacy policy page is an outright lie might be intended as a dead canary to warn users away as loudly as they can, but even in that case I'll be happy to say it plainly: Signal shouldn't be trusted.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by tptacek on Wednesday February 19, 2025 @04:00PM (#43107618)

I think we know you're happy to say it plainly, since you've been saying it plainly for over 4 years.

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by itishappy on Wednesday February 19, 2025 @03:18PM (#43107038)

This comes as news to me, and rather disappointing news at that. Do you have a source I can read further?

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by autoexec on Wednesday February 19, 2025 @03:41PM (#43107379)

Several sources and links for more info. Check my profile for more, I don't want to spam the same links all over this topic, but I'd start here:

https://community.signalusers.org/t/proper-secure-value-secu...

https://web.archive.org/web/20210126201848mp_/https://palant...

https://www.vice.com/en/article/pkyzek/signal-new-pin-featur...

[ Parent | on HN ]

Re:Multiple Russia-aligned threat actors actively targeting ... by jaza on Wednesday February 19, 2025 @06:29PM (#43109147)

I've still got Signal installed, but never use it, I only ever ended up chatting on it with a few ex-colleagues, who were fellow devs / nerds.

I have so many WhatsApp group chats (here in Australia) that are critical for me these days, and that I don't control, and that have way too many people, and way too diverse a range of people, for me to have any hope whatsoever of migrating them all to Signal. School parents group chats (one for each class that my kids are in). Strata (aka Home Owners Association) committee group chat. Scouts group chat. Various friends groups chats. Boycotting WhatsApp is not an option for me, it would literally make me unable to function in a number of my day-to-day responsibilities.

[ Parent | on HN ]