San Francisco Frontiers - What is Signal and is it secure?

What differentiates it from other messaging apps, and why has its use by top Trump officials plotting strikes on Yemen raised concerns?

- What is end-to-end encryption? -

End-to-end encryption means that any sent message travels in a scrambled form and can only be deciphered by the end user.

Nobody in between -- not the company providing the service, not your internet provider, nor hackers intercepting the message -- can read the content because they don't have the keys to unlock it.

Signal is not the only messaging service to provide this service, but unlike WhatsApp and Apple's iMessage, the app is controlled by an independent non-profit -- not a big tech behemoth motivated by revenue -- winning it more trust to those concerned about privacy.

Signal crucially goes further than WhatsApp on data privacy by making metadata such as when the message was delivered and who it was sent to invisible even to the company itself.

WhatsApp, meanwhile, shares information with its parent company Meta and third parties, including your phone number, mobile device information, and IP addresses.

For these reasons, Signal has always been a go-to messaging service for users especially concerned about communications secrecy, notably people working in security professions, journalists, and their sources.

- Who owns Signal? -

Founded in 2012, Signal is owned by the Mountain View, California-based Signal Foundation.

Its history is linked to WhatsApp: the site was founded by cryptographer and entrepreneur Moxie Marlinspike, with an initial $50 million from WhatsApp co-founder Brian Acton.

Both Signal and WhatsApp, which was bought by Mark Zuckerberg in 2014, are based on the same protocol built by Marlinspike.

"We're not tied to any major tech companies, and we can never be acquired by one either," Signal's website reads. Development is mainly supported by grants and donations.

Very outspoken compared to other Silicon Valley bosses, Signal's CEO is Meredith Whittaker, who spent years working for Google before helping to organize a staff walkout in 2018 over working conditions.

Whittaker campaigns for privacy and is a fierce critic of business models built on the extraction of personal data.

- How secure is Signal? -

"Signal is a very solid platform because of the way that it goes about doing its business, the way that it frequently updates the app, the way that it uses end-to-end encryption," said Michael Daniel, former White House cybersecurity coordinator under Barack Obama and current head of the Cyber Threat Alliance.

But "it was never built or intended to be used for discussing military plans," Daniel told AFP.

The real vulnerability, Daniel said, is not so much the app itself, "but everything that goes on around it. It's more that these are on personal devices that may or may not be stored in a secure manner or protected in the right way."

He noted that given their responsibilities, the high-level officials involved in the Huthi conversation would have communications teams with them at all times capable of handling the conversation using the appropriate methods.

Under normal circumstances, "It wouldn't have been that difficult to jump off their phones and do this in the proper protocols," he said, adding that having an outsider on the call would have been impossible if the right technology was used.

Matthew Green, who teaches cryptography at Johns Hopkins University and has collaborated with the development of Signal, said on Bluesky that by asking it to step up to "military grade" communications, Signal was "being asked to do a lot!"

He warned that Signal, which shot up on the list of most downloaded apps after the revelation, could become a victim of its own success.

"As the only encrypted messenger people seem to 'really' trust, Signal is going to end up being a target for too many people," he said.

E.Cruz--SFF