Technology

https://signal.miraheze.org/wiki/Secure_Value_Recovery

https://github.com/signalapp/SecureValueRecovery2

If you want to do an empirical test, create a signal account set a pin. Send a message to someone. Then delete signal. Recreate the account using the same phone number, recover using the pin and send a message. The receiver of that message will not get a warning that the signing key has changed.

The only way that's possible is if the key, or a derived key, is recoverable from the network. That is de facto proof that the keys or a key generation mechanism is in the cloud. Which is probably fine for personal communication.

But if I'm a nation state, this represents a significant security risk, especially when you're worried about another nation-state peaking at your communication. I.e France is buddy buddy with the US, but they probably don't want the US to read all of their internal communication.

SGX https://en.m.wikipedia.org/wiki/Software_Guard_Extensions

https://sslab-gatech.github.io/sgx101/pages/attestation.html

SGX is a inside chip secure enclave created by Intel, a company headquartered in the United States, that uses key management, and signing keys from Intel. Intel could be compelled by domestic intelligence to provide their keys, or to sign certain enclave software. I'm not saying it's happened, but I am saying this is part of the risk assessment a nation state would use to evaluate a messaging platform

So a nation state attack might look something like this: Intel is compelled to release their signing keys, the signal user enclave is copied, using the combination of both of these a special SGX environment will be set up to brute Force the passwords, with no limit. The limit will be removed, and it will operate in the SGX environment, and brute forcing a six-digit pin is trivial if you're not rate limited. This is just one possibility, SGX has at least nine known side channel attacks at the moment, I'm sure there's more that haven't been published.

Lol at military stuff being secure. Most often it's not, it's just hidden. There was an Ars Technica article about the "secure" devices used at military bases being full of holes for example: https://arstechnica.com/security/2023/08/next-gen-osdp-was-supposed-to-make-it-harder-to-break-in-to-secure-facilities-it-failed/

When code is hidden all you know for sure is that you don't know anything about it. You certainly can't say it's secure.

If a piece of code or a system is really secure then it does not care if the code is open because the security lays in the quality of its algorithms and the strength of the keys.

Well let's give some counter examples in the softwares I mentioned :

• WhatsApp closed : Owned by Facebook. Well Facebook had multiple data leaks, privacy violations and nothing substantial was done about it. Definitely not trustable (also zero days are getting sold on the black market for WhatsApp (https://techcrunch.com/2023/10/05/zero-days-for-hacking-whatsapp-are-now-worth-millions-of-dollars/ ).

• Telegram closed : not end to end encrypted. Russian app. Not trustable.

• Signal open : well this one is e to e encrypted. Open source, maybe could be trusted. Seems to have passed some security audits (https://community.signalusers.org/t/overview-of-third-party-security-audits/13243), tho it's based in the US and uses servers, maybe the US may have super computers capable of decrypting such communications. However is signal has switched their encryption to quantum computer resistance it may be too hard even for a state actor. However they also "debunked"/ignored zero-day reports which were not reported through their own tool, and by asking the US for confirmation. I am not sure if the US can be trusted to give confirmation about the existance or not of vulnerabilities when they are very likely to use them (https://thehackernews.com/2023/10/signal-debunks-zero-day-vulnerability.html?m=1).

• Olvid open (servers closed) : is French, e to e, and backed up by an encryption PhD. And why not use a local messaging app witch also is very secure and open source.

Notice how closed source is untrusted here. The economic activity of the tool changes how trustable it is. Military équipement has a huge and strict budget, it has to be secure.

Communication apps are user first. So they do what they can get away with, and that is very true for Facebook.

👆

Signal isn’t much better in this regard. They certainly don’t work directly in the public repos - they have internal repos that they work from and they push updates from them to the public repos after the fact.

I’m not sure about the current state but when I looked into it a couple years ago, their client side repos were around a year behind. I recall reading some issues stating that the client was so far behind that the server was refusing to communicate with builds of it.