「Signal は安全か？」

In a stunning breach of national security, a reporter for The Atlantic was inadvertently invited to join the group chat and soon made a partially redacted transcript of it available to the public. Crucially, the entire “Signalgate” scandal was the result of purely human error, not any technical flaw in Signal.

A similar issue appears to be responsible for a successful FBI spying operation that targeted an immigrants’ rights activists Signal group chat. Although details are not yet clear, the FBI said the information came from a “sensitive source with excellent access”, which strongly suggests that an inside source had been invited to the chat.

All Threema apps use the open-source NaCl cryptography library to encrypt messages end to end, and they have been audited by security professionals. Unlike most messaging apps, you don’t need an email address or phone number to register an account, and it’s possible to purchase Threema for Android anonymously using Bitcoin —Threema is a paid app. The company says this allows you to text and make calls anonymously, and it goes to lengths to ensure that it collects minimum metadata.

However, being hosted on AWS servers remains a concern in light of Signal’s reliance on SGX. There are a number of open-source encrypted messaging apps like Threema that try to address this and other perceived issues with Signal — such as its reliance on a centralized server and the need to supply a real phone number— some of which show great promise.