Signal is the most private messenger available — but it still requires your real phone number to sign up. In August 2022, a breach at Twilio (Signal's SMS verification provider) exposed the phone numbers of approximately 1,900 Signal users. An attacker re-registered at least one victim's account. The phone number requirement means a single breach at a third-party company can compromise the identity of users of the most secure messenger on Earth. Signal's desktop app stored your encryption keys in a plaintext file for six years. Any malware could read them. Signal said it wasn't a real problem — then quietly fixed it after the story went viral.
What they claim: Signal provides E2E encryption across all platforms, keeping data secure.
What we found: Signal Desktop stored SQLite encryption key as plaintext in config.json for 6 years (2018-2024). Any process could read it. Signal's president dismissed concerns. Fixed only after Elon Musk amplified the issue on X (July 2024).
What they claim: Signal groups provide encrypted, private communication.
What we found: Groups V2 moved group state to server (encrypted but with metadata exposure). Server observes: group size, IP addresses, admin identification, timing patterns. V1 stored nothing server-side — V2 was a privacy downgrade.
What they claim: Signal is an independent privacy tool developed without government influence.
What we found: Signal received $2,955,000+ from Open Technology Fund (2013-2016). OTF was a program of Radio Free Asia (US government). Revenue ($25.8M in 2024) falls short of ~$50M needed annually.
What they claim: Signal's architecture protects against government overreach.
What we found: Signal Foundation is in Mountain View, CA — subject to NSLs, FISA Section 215, subpoenas. Single point of compulsion. No federation. Signal outages (2024) affected all users globally. Countries have blocked Signal.
What they claim: Signal is the ultimate privacy messenger. 'We can't read your messages or listen to your calls, and no one else can either.'
What we found: A phone number — a government-issued, SIM-registered identifier — is required to create an account. Usernames (2024) hide the number but registration requirement remains. Twilio breach (2022) exposed 1,900 numbers.
What they claim: Signal maintains robust security against third-party attacks.
What we found: Twilio breach (2022): 1,900 phone numbers exposed, one account re-registered. Russian QR code phishing (Feb 2025) abused linked devices. CVE-2023-24069/24068: Desktop attachment cleanup failures. 15 total CVEs on record.
What they claim: PIN-protected profile recovery keeps data secure in hardware-protected enclaves.
What we found: SVR2 relied on Intel SGX with catastrophic vulnerabilities (PlunderVolt, LVI, SGAxe). US government could compel Intel to provide signing keys. SVR3 distributes trust across 3 vendors — significant improvement but fundamental risk remains.
What they claim: Signal is the gold standard for private communication.
What we found: Signalgate (March 2025): Trump NSA advisor accidentally added The Atlantic's editor to a classified Signal group chat. Encryption worked perfectly — failure was purely human error. Validates Signal's technical model.
What they claim: Signal provides end-to-end encryption and opposes backdoors for law enforcement
What we found: Signal publicly opposed the UK Online Safety Act's device-scanning proposal (June 2026), warning that client-side scanning to detect child sexual abuse material would fundamentally undermine encryption. The UK government maintains the power to compel scanning under the Act. Signal has threatened to withdraw from the UK rather than comply — forcing users to choose between legal compliance and privacy.
What they claim: Sealed sender hides who is messaging whom: 'no one will be able to know, not even Signal.'
What we found: Academic research (NDSS 2021, IEEE S&P 2023) demonstrates delivery receipts — which cannot be disabled — create timing correlations that deanonymize communicating pairs. Signal acknowledges it is 'an incremental step.'
What they claim: Signal Foundation is an independent nonprofit serving user privacy above all else.
What we found: Moxie Marlinspike was listed as CTO of MobileCoin. He was a paid advisor. MOB token rallied ~450% before Signal's integration. MobileCoin CEO: 'I started MobileCoin to fund Signal.' Bruce Schneier: 'An incredibly bad idea.' Payments still active.