this post was submitted on 03 Sep 2022
19 points (80.6% liked)
Security
5183 readers
1 users here now
Confidentiality Integrity Availability
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
To be fair, even though they bypassed the 2FA, they did not get access to previous conversations and contact list. That's the point of the article, right?
Even if the encryption does not collapse, it is still an app full of identifiers. That makes metadata available. An attacker could figure out who contacted whom.
Whenever someone says "Signal is not good enough", my answer is "what's your threat model"? For me it's a pretty damn good compromise given that all my friends and family are on it (as opposed to e.g. using WhatsApp or Telegram 99% of the time and a perfect alternative with one contact). The day I can realistically think about making my contacts move to a better alternative, I'll do it. In the meantime, that's the best I've got. And it's not too bad, to be fair.
Uh, I forgot to tell you that the "account" is safely saved locally (something) like jones.zip. That's it!