Is it still viable to use Signal for privacy in 2026? It’s centralized, and has had many suspicious occurrences in the past.(Unopen source server code, careless whisper exploit which is still active as far as I know, and the whole mobile coin situation.)

Thoughts?

  • nutbutter@discuss.tchncs.de
    361·
    12 days ago

    A lot of people use Signal. It may not be the best solution out there, but it is so, so, so much better than the proprietary alternates.

    One good thing is that a normie can easily use it as an alternative to WhatsApp, since the app design is so similar. I mean, it is easy for family and friends to understand and start using Signal, compared to something like Matrix or XMPP.

    And if someone needs a little more hardening, they could use the fork called Molly, which has a few more security benefits over the stock app.

  • electric_nan@lemmy.ml
    24·
    12 days ago

    Yes. You will find a lot of randos saying no, but the consensus among security professionals and researchers is that it is still the current standard. Not to say that it doesn’t deserve scrutiny or criticism, or that other projects aren’t important to develop.

    • whyNotSquirrel@sh.itjust.worksEnglish
      2·
      11 days ago

      Also, will I be able to reach people with any alternatives? It’s not like they’ll all switch to the app I choose, or at least I’m not that popular for them to follow me anywhere, well… worse, I still have to open Messenger (FB/meta) from time to time to get in touch with some of them 🤮🤢

      • SreudianFlip@sh.itjust.works
        1·
        11 days ago

        They don’t have phone numbers? I will risk the known exposure through the phone system before anything Meta or LinkedIn. Basically if fb or insta is your contact choice, I am going to phone or sms instead.

  • Dessalines@lemmy.ml
    213·
    11 days ago

    PRODUCT PITCH: Hey everyone, I have a great idea for a secure / private messaging service.

    It’s hosted in the US, subject to its pervasive spying laws including national security letters.

    Also I need all your phone numbers.

    Also no you can’t host this yourself, I run the only server.

    Everyone who uses signal and supports it, is falling for this pitch.

    Why not signal?

    • ☆ Yσɠƚԋσʂ ☆@lemmy.ml
      62·
      11 days ago

      One of the most sus things about Signal is the cult following it has. I really can’t think of any other chat app that will have people coming out of the woodwork advocating for it while telling you not to use anything else. There’s absolutely nothing special about Signal that would warrant this. It’s at best a mediocre user experience, it still handles a lot of things like switching devices really poorly. It’s open source in name only. There’s just no reason why it should be this popular on its own merits.

      • axx@slrpnk.net
        1·
        10 days ago

        I think you’re missing historical context. There are more options now, but when Signal came out (or became Signal, after TextSecure), it was the only tool to offer such strong cryptographic properties with its then novel double ratchet algorithm. Compared to OTR and, much worse, all the other crap that was not E2E encrypted at all, it was the first really credible option on a mass scale.

        The crypto was reviewed by well-considered experts, and came out looking strong.

        Telegram fought for years trying to say they were just as good and in fact better, which is entirely disingenuous considering it’s not an encrypted messaging app.

        These things contributed to what you call the cult following. Which wouldn’t be negative (a cult film has a cult following) if not intended to mean “a cult like Scientology”.

        • ☆ Yσɠƚԋσʂ ☆@lemmy.ml
          2·
          10 days ago

          But that’s precisely what makes the whole thing cultish in a negative sense. A decade ago you could make the argument that Signal was doing something special, but that hasn’t been the case for a long time. The continued adherence to the app is utterly irrational today.

  • Captain Aggravated@sh.itjust.worksEnglish
    17·
    11 days ago

    The stories I’ve heard where Signal messages have been extracted or otherwise accessed was from beyond either end. Someone invited a journalist to a private group chat. Someone handed someone else an unlocked device. The most alarming one is apparently Apple uploads every push notification your device gets to their servers. So if you are concerned about privacy there’s a feature in Signal to set push notifications to only say “you got a message” and not include the sender or message contents in the notification.

    I haven’t heard of Signal itself leaking messages.

    • sakuraba@lemmy.ml
      2·
      11 days ago

      IIRC Android has the same issue with push notifications, if you really care about privacy you should disable showing any content from any messaging app in your notifications unless you want Google or Apple to collect it

        • stegosaur@lemmy.world
          2·
          10 days ago

          We are both right 😆

          It is true for Signal on Apple devices.

          It is not true for Signal on Android devices*

          *Well I’m using grapheneOS so I feel more comfortable in my case but a regular Android device with full access Google Play Services? That I’m not so sure about. It’s conceivable that Google has a way to read the final notification (FCM push -> Signal fetches and displays message -> Google can read all notifications on the device, FCM or otherwise) 😬

            • stegosaur@lemmy.world
              2·
              10 days ago

              I’m not an expert or even close to that, so no, not really I suppose. Can you really trust any device when it comes down to the hardware level? I wouldn’t trust an iPhone or any other phone more. Again, while I’m not an expert, I’d trust grapheneOS for software over any other mobile OS. Probably trust to that effect would be grapheneOS >>>> iOS >> everything else. But full trust in any hardware? Who really knows

  • Zak@lemmy.world
    16·
    11 days ago

    Who do you want privacy from and why?

    That’s not a rhetorical question. It matters. If you want privacy from corporations and governments doing mass surveillance because you’re against mass surveillance in principle, Signal is great! As long as you don’t give janky apps permission to read your notifications, or you limit what Signal shows in its notifications, your device won’t leak to those kinds of threat actors. You can’t be sure everyone you talk to is as fastidious though.

    If the cops, gangsters, or similar are likely to target you and the people you’re talking to directly, there’s a good chance just using Signal without a security plan won’t keep them from getting the contents of the conversation as in this recent incident where the FBI extracted deleted messages from notification logs. To defend against that specific attack, everyone needs to configure Signal to keep message content and contact details out of the notification. Dedicated devices for secure communication set up by someone who knows what they’re doing are ideal in this situation. Signal is still a good choice here, but Signal alone won’t guarantee privacy.

    If you’re being targeted by an intelligence agency from a rich country that has allocated a significant budget to surveil you in particular, you’re probably screwed. There’s plenty of public information about how US government officials and contractors are required to work with classified information to get a sense of how you might try to mount a defense. It’s guaranteed to be inconvenient.

    • eldavi@lemmy.mlEnglish
      6·
      11 days ago

      agreed and to add to this:

      Dedicated devices for secure communication set up by someone who knows what they’re doing are ideal in this situation.

      becoming your own expert is unfeasible for 99.999999999999999999999999999999999% of people and expecting it is no different than expecting people to become their own lawyer, dentist, or doctor.

      If you’re being targeted by an intelligence agency from a rich country that has allocated a significant budget to surveil you in particular, you’re probably screwed

      the bar against protecting yourself from the local police in the united states is MUCH lower than the cia, nsa, mossad, etc. and should be the goal of most projects since it’s the most realistic and the most likely to happen; there’s next to nothing that can be done against he alternatives.

      the alternative is that unfeasible ultra high bar and judges in the united states have a history of holding people in jail for years for contempt of court of not providing passwords or using duress like options on their electronic equipment.

  • airikr@lemmy.mlEnglish
    161·
    11 days ago

    If you don’t care about sharing your phone number with Signal and a third-party company (Signal refuses to state what company it is) that send the text message with the activation code to you. And if you don’t care that everything will be saved on servers maintained by Amazon in USA.

    Then yes, Signal is the right app for you even in 2026.

    But if you do care (and you should) about your phone number and the location of your data, you should focus on something more privacy like XMPP (Snikket would be the easiest way to setup your own server) and SimpleX.

    XMPP (for an example Snikket) uses OMEMO and OMEMO is based on Signal Protocol.

  • BillMangionee@lemmy.ml
    121·
    11 days ago

    In my experience, the bigger issue is folks just completely ignore OPSEC once they get on signal.

    The centralized component is pretty concerning. Imagine if protests like in Iran earlier this year were to occur in the States. The Feds would immediately seize or DDOS those servers during nationwide unrest, before cutting the internet which is basically an inside out panopticon.

    EOD it depends on your threat model. You’re probably not on Signal if your life depends on it anyway.

    Plus, its always useful to not have my texts immediately read and sent to advertisers.

  • communism@lemmy.ml
    111·
    11 days ago

    As per usual, the answer is “depends on your threat model”. For a lot of sensitive communications, the centralised design and therefore ability to correlate metadata is a no-go. But if you’re just using it e.g. as a WhatsApp replacement to message your friends, it’s fine. It’s still the most polished and normie-friendly e2ee foss messenger.

    • AzuraTheSpellkissed@lemmy.blahaj.zone
      51·
      12 days ago

      @dessalines@lemmy.ml being as sharp as always, thank you for sharing this! I somehow missed that essay in the past, and recently even had a discussion where I argued in favor of signal. His overview makes some great points that shouldn’t be dismissed offhandedly. The important point is to not make the mistake of shunning signal in favor of an even less secure alternative. Also the user’s threat model should be taken into account. Those who aren’t anticapitalists (yet) might need to worry less about the concerns.

  • utopiah@lemmy.ml
    8·
    12 days ago

    IMHO the question depends on :

    • who you are (boring, rando, political dissident, journalist, etc)
    • who you talk to (family, friends, work, etc)
    • what alternatives actually exist

    So… sure Signal is not perfect but if you can’t convince your family members to move to DeltaChat it sure beats using WhatsApp, Telegram, etc.

  • Autonomous@lemmy.world
    51·
    12 days ago

    Just remember that if you, or anyone you are talking to, has notifications turned on (in the app itself), that conversation is now outside of signal and a lot easier to get to.

    • Telex@sopuli.xyz
      12·
      12 days ago

      Which is an everything problem, not a signal problem. Just in case it sounds like a signal problem.