Note for all about the Signal messaging app. While the level of stupid for someone to have a secret level government...

[dutch777]

...text exchange on any application not vetted and approved by the NSA is staggering, and including in a journalist by accident is beyond comprehension (unless you have clown car members for a Cabinet), we all should be aware that the Signal app is not perfect. It's end to end encryption is considered top notch at least for a non-governmental system, but it can be breached. Cracking the encryption by non governmental hackers is unlikely but the true level of capability of Russia, China, the US and others is not really known. Knowing NSA and knowing bad actors probably like Signal, I would suspect a lot of focus and supercomputer time has worked on breaking the encryption. Further, Signal has no defense if the device taking in a Signal message has been compromised and others can simply read what is on the screen remotely. The message in transit may be safe but not so much possibly if being entered or received on a hacked device. I know progressive political entities like Signal so we ALL should be aware nothing is 100% safe from prying eyes.

[0rganism]

1. i like Signal a lot, it's an elegant answer to many questions. Per normal, evil people get to use it too

As you point out, endpoint-to-endpoint security remains extremely nice but its value greatly diminishes if the endpoints themselves are compromised, which is what the EVIL IDIOTS did this week. Presumably, they continue to use it even now; maybe they've since ran a purge of responsible journalists in NSA and DOD group chats and called it "good", who knows? Still an excellent application if you know what you're doing and handle your endpoints responsibly.

[drray23]

2. Completely agree. Especially your last part.

About the device itself. Even if encrypted in transit and assuming major state actors can't break it, it still leaves the device itself vulnerable.
Personal phones can be compromised. Each time I have gone on an official trip ( on behalf of DOE) in a country considered a security risk ( like China, Ecuador) I have to use secure laptops and phones and I am not allowed to take my personal devices.

The laptop has minimal functionality, can not accept USB keys and it's network acces automatically disabled upon landing back in the US. Once returned to IT , everything is wiped out. Same for the phone. It's blanked out anew.

For the physical breaching of the phone, we were told to never let it away from our possession and be wary of random people trying to befriend you, especially young attractive people.

[usonian]

3. A few simple points.

An ordinary phone is subject to compromise (surprise)

1. A shoulder surfer can watch you type in passwords. I curse Apple every time I make an Apple Pay purchase and the phone demands that I type in a passcode (IN PUBLIC) instead of a thumbprint (I got the last iphone model that doesn't do face id)

2. Someone can just coerce you into typing in your password and opening up Signal. (an offer you cannot refuse)
This is how signal conversations were revealed in trials.

3. Malware can steal your keystrokes/taps.

4. Malware can take over your selfie camera or front-facing camera.

5. Malware can capture your screen, messages and passwords

6. Malware can open up your microphone and listen in.

Probably more of a technical nature. Suffice it to say, these common ones are plenty.

This is why secrecy bans personal phones.

[eppur_se_muova]

4. Also Apple Watches and even key fobs. ANYTHING that can transmit a signal can provide some meta-info, at least.

Also, anything that can record, like GoPro, camera glasses, etc. is suspect.

Remember when FitBit watches were broadcasting info about troop whereabouts in Afghanistan ? The watches had to be banned.

Remember that the Mossad rigged cell phones with lethal explosives, and Ukraine put them in headphones. Nothing electronic can be taken at face value. I wouldn't admit anyone who got a pacemaker in China or Russia, or a brain implant from Musk's company.

[usonian]

5. Yeah. Exercise watches.

Remember the Swiss company that sold "unbreakable" phones to Eutlropean mafiosi?

The phone company was a front for law enforcement. They had it all

Trust nobody.