If you hadn’t heard of Signal before this week, chances are you’re well aware of it now. The messaging app was thrust into the news on Monday when The Atlantic’s editor-in-chief, Jeffrey Goldberg, was mistakenly added to a group chat involving top military officials planning an airstrike. Even though it entered the discourse for extremely unusual reasons, Signal has been, and remains, a well-regarded messaging platform for secure communication. It’s not foolproof — emphasis on fool, in this case — but it’s worth understanding what it is and how it works, even if you’re not a person who deals with highly confidential information.
Signal is a messaging app. You download it to your iOS or Android device, link your phone number, and you’re ready to go — just like other services like WhatsApp or Telegram. The thing that makes Signal different is its emphasis on privacy. Communication on the platform is end-to-end encrypted by default, and the app offers additional protections to keep your private discussions private.
Why is end-to-end encryption important?
Aside from, say, walking over to someone and whispering in their ear, end-to-end encryption is the best way to communicate with someone else and ensure that your messaging remains private. Encryption disguises the contents of your message so that it’s effectively unreadable by anyone without the key necessary to decrypt it. End-to-end encryption means that the message you’re sharing is basically unreadable on every step of the journey between your device and the recipient’s. It’s decrypted only when it reaches its intended destination.
By comparison, standard SMS text messages are unencrypted as they move across cellular networks — from towers to servers to the person you’re texting. Your phone might store them as encrypted files, but the ISPs handling the messages have access to them and may keep copies stored on their servers. That’s where your message is vulnerable to sophisticated hacks like Salt Typhoon or a court order served on the ISP. Messages that are end-to-end encrypted can’t be compromised in the same way, since they’re effectively impossible to read without the key. The Electronic Frontier Foundation has an excellent explainer on encryption and lots of other resources on privacy best practices.
How is Signal different from other messaging platforms with end-to-end encryption?
End-to-end encryption is becoming a standard feature in more chat platforms, and that’s a good thing. It’s part of WhatsApp as well as iMessage on iPhones and RCS chats on Google Messages. Right now, messages between Android and iPhone users don’t support end-to-end encryption, although that’s changing soon. But even if your messages themselves are end-to-end encrypted, tech companies can access and store other information about you. For example, WhatsApp saves things like your profile information and address book and will provide those things to law enforcement if presented with a search warrant.
Signal is run by a nonprofit and notably saves only two pieces of information about its users: when they created their Signal account, and when they last used Signal. Law enforcement can’t get more information than that from Signal about its users because the company simply doesn’t have it. That’s why it’s popular with journalists, activists, and people who are privacy-conscious. Bear in mind that if law enforcement, hackers, or a foreign adversary gets their hands on the person you messaged — that is, the other endpoint — there’s a good deal more information they can glean, even if you have disappearing messages set up.
Who might want to use Signal?
The short answer is anybody. Obviously, people with certain kinds of jobs have more to risk in their communication, but you don’t need to be a reporter or a government official to want a little more assurance of privacy. Law enforcement in Nebraska obtained the private Facebook chat history between a mother and her 17-year-old daughter to aid in prosecuting them on charges of carrying out an abortion illegally. Because the chat was unencrypted, Meta had the messages in question and turned them over to officials when it received the request. If the messages had been encrypted, Meta wouldn’t have been able to comply.
What are the disadvantages of using Signal?
Because most of your Signal account information is stored locally on your device, transferring your account to a new device requires a few extra steps as well as access to your old device. When your information is stored in the cloud, it’s less secure but much easier to port to a new device. And this might be a given, but the person you’re communicating with needs to have a Signal account as well.
What else should I know about Signal?
This week’s news highlights one more important aspect of using Signal or any other communication platform: it can’t protect you from you. Signal’s messaging protocol is highly secure, but there’s still room for human error in the event that you add the wrong person to a chat. That said, you can take some extra steps to avoid potential mistakes. 404 Media has a good tip on using Signal’s nickname feature to avoid mistaking one display name for another.
Another timely concern is how secure your data is when someone else has access to your phone — particularly a border agent. There’s no bulletproof method to securing information on your phone, and the regulations around how immigration officials can access your phone and what they can do with it aren’t exactly crystal clear. But it’s a good idea to keep your digital footprint as small as you can and take steps to limit what someone might find on your phone with a cursory search.
Signal provides a disappearing messages option that removes them from your device after a certain amount of time. There are also options to hide the app’s contents in the app switcher view, and you can set up the app to require your screen lock credentials every time you reopen it. A little extra caution can go a long way.
