“a crafted archive can escape its intended extraction directory and write files to other locations on the system. When chained, this can escalate to full code execution under the same privileges as the user”
To be clear, you want Tom’s Hardware to downplay the severity of this situation?
You literally don’t understand how hashing works, got it. Please educate yourself on this topic. In short, “connecting your existing contacts” is ENTIRELY possible with hashed phone numbers; it’s not even complicated or tricky. To claim otherwise, as you just did, is nothing but trumpeting your own ignorance.
As for deleting (and propagating deletion of) messages, this is most definitely NOT a matter of “just trust us”. The client is open-source! We KNOW how it works. We KNOW that deletion propagates across devices when you tell it to. We KNOW that the service cannot see your unencrypted messages, and that the encrypted messages are made with AES so even quantum computers in the future can’t decrypt them. This is incredibly far from “just trust us”.
This is vastly different from every other piece of information I’ve read about Signal. Please link me to a source for your claims.
Are you talking about the client app, or about the service?
Much of what you said doesn’t apply to the service, which stores hashed phone numbers and first access / last access times and nothing else.
And the client does store these things, but also lets users delete messages and contacts. Your message deletions can propagate as well.
Indeed, I also don’t realize that. Please explain further.
Signal stores the hash of the phone number. So you can query them for a specific phone number, but are unable to figure out phone numbers based on the hashes (outside of brute force - trying every 12-digit phone number).
And after doing that, you learn “this person uses/used Signal”, with no information about particular messages whatsoever.
The leak from the administration was because Pete Hegseth included a journalist in a discussion about sensitive war plans. Trying to blame that on Signal is deceptive on your part.
If you are saying that Signal does not offer anonymity then you are right. Anyone I message on there knows it’s me. But Signal is still keeping my messages safe from monitoring and third-party surveillance, to the best of my knowledge.
Thank you, Vivaldi, for not giving in to this all-consuming fad!
Be specific: what does Signal divilge about me to outsiders besides “I have used Signal”?
Signal is important to some of my contacts and its E2E encryption is excellent. The only thing the phone number gives away to the outside is “has this person used Signal in the past?”. Since it is not illegal to use Signal in my country, I’m not worried.
Can you use Signal on a Linux phone? I know there’s a desktop Linux client, but it relies on being activated from an Android or iPhone app to function, in my experience.
Signal is the best intersection of genuine security and ease-of-use that I’ve ever seen. No choosing a server, no making an account. Just install the app, get a confirmation SMS, and now you can communicate with future-proof encryption and authentication right away.
For more technical people, who aren’t going to be intimidated by things like making accounts and secure passwords and choosing servers, Signal is not the best. But when I need to communicate securely with non-technical people, it’s a wonderful quick go-to solution.