Sane Security Guy: Signal knows who you’re talking to

The title of the article cited by OP is no surprise to me. No matter what metadata resistance Signal adds, being a centralized instant-messaging service, I’ve always thought Signal is capable of knowing (with some effort) which accounts talk with which accounts. For an instant-messaging service to be incapable, it must at least route communications in a decentralized manner.

The article argues sealed sender is effectively useless. I haven’t looked into the technical details but sealed sender provides only one-way (sender) anonymity, and all messages are acknowledged with delivery receipts thus compromising the anonymity. From the moment I first heard about sealed sender I thought it as a false sense of security, especially given all messages including delivery receipts have sender/receiver IP addresses.

In spite of this I still recommend Signal in most cases for instant messaging and internet communication in general.

However, abuse of delivery receipts to spy on Signal users, and that Signal apparently has ignored this vulnerability, is concerning. See this thread.

I see this phrase thrown around a lot. With few exceptions, privacy issues are also security issues. They should be treated as such.

1 Like