Is Signal Secure? An Analysis of its History, Encryption Protocol, and Privacy Policy

[harlan4096]

Signal is an Instant Messaging App with a Longstanding History. But Is Signal Secure? Let’s Find Out.

Everyone from Elon Musk to Edward Snowden has been talking about Signal these days. Friends, family, and followers received recommendations to create accounts left and right, leaving us to wonder: what is Signal? And even more importantly, is Signal secure?
 
Before diving into the technical details, I’ll have a brief look at the app’s history that spans over a decade. Then, I’ll go over the app’s encryption protocol and privacy policy to help answer the most pressing question at hand: is Signal secure?

Stay tuned until the end to find out, and don’t forget to check out this article’s section on actionable tips that will help you boost your cybersecurity while using Signal.

What is Signal? A Brief History

2010

The origins of the Signal messaging app can be traced back to May 25, 2010, when a now-defunct company by the name of Whisper Systems launched beta versions of RedPhone and TextSecure. The former was an encrypted voice calling app, while the latter consisted of an encrypted texting program.

Whisper Systems was an enterprise mobile security startup founded by Stuart Anderson, a roboticist, and Moxie Marlinspike (real name Matthew Rosenfeld, a security researcher. You might recognize Moxie’s name as a co-founder of the present-day Signal Foundation which administers the Signal messaging app. But more on that later.

2011

Famed social media platform Twitter acquired Whisper Systems in November 2011. Shortly thereafter, RedPhone was made unavailable, which drew heavy criticism from the public due to the app’s relevance in the field of humanitarian aid. One month later, on December 20[sup]th[/sup], 2011, TextSecure was released as a free and open-source piece of software under the GPLv3 license.

2012

On the 18[sup]th[/sup] of July, 2012, RedPhone was released as free and open-source as well under the same GPLv3 license.

2013

Moxie Marlinspike leaves Twitter in January 2013 to found Open Whisper Systems (OWS), a collaborative open-source project focused on the further evolution of the TextSecure and RedPhone apps.

2014

In February 2014, OWS integrates instant messaging and end-to-end encrypted group chat functions into TextSecure. This represented the second version of their TextSecure Protocol, now known as the Signal Protocol.

Towards the end of July 2014, OWS first released Signal as the iOS version of RedPhone. During this time, Moxie Marlinspike also announced the company’s intentions to merge RedPhone and TextSecure into a single app that will take on the Signal name and brand.

2015

On the 6[sup]th[/sup] of March, 2015, creator Moxie Marlinspike posted an announcement on the company’s blog stating that support for encrypted SMS/MMS messaging function in TextSecure had been suspended. From there on out, only sending and receiving encrypted messages via the data channel was supported by the Android application. Simultaneously to this, the encrypted instant messages feature was added to the Signal app on iOS.

Come November 2015, RedPhone and TextSecure merge on Android and the resulting mobile application is renamed with the Signal brand. By December 2015, Signal had become a Google Chrome App available on desktop devices as well.

2016

Open Whisper Systems founder Moxie Marlinspike announced on September 26, 2016, that Signal Desktop could then be connected with Signal’s iOS version as well.

On October 4, 2016, a series of documents were released disclosing that Open Whisper Systems had been issued a subpoena asking them to provide information related to two phone numbers involved in a federal grand jury investigation conducted in the first half of 2016. The exposé was carried out in collaboration with the American Civil Liberties Union (ACLU), which OWS approached to get help in lifting the gag order placed on the company that prevented them from publicly discussing the subpoena.

2017

The video call feature was added to Signal in beta testing in March 2017 by transitioning from its proprietary RedPhone system to the open-source WebRTC project. Subsequently the same year, Open Whisper Systems announced the deprecation of its Google Chrome App on October 31, 2017, just in time for Halloween.

2018

On the 21[sup]st[/sup] of February, 2018, Moxie Marlinspike announced the formation of the Signal Foundation together with WhatsApp co-founder Brian Acton. With an initial investment of $50 million from Acton, the Signal Foundation has been and is continuing to be run as a nonprofit organization. This allowed Signal to run entirely on donations by 2020.

2019

Signal started adding new features starting with November 2019, all through February 2020. Its updated roster included videos, stickers, reactions, view-once images, and support for iPads.

2020

Signal gained momentum in the United States of America during the Black Lives Matter protests that followed George Floyd’s death. Twitter CEO Jack Dorsey recommended the app in the wake of increased police surveillance on the movement. This increased downloads five times. What is more, a new feature allowing for face blurring in photos was introduced by the app as a response to federal monitoring efforts.
...

Continue Reading