Meredith Whittaker

President of @signalapp, Chief Advisor to @ainowinstitute (Also on Mastodon @[email protected], also on bsky @meredithmeredith.bsky.social)

[John Scott-Railton @jsrailton]

Every parent wants to keep their kids safe.

But doesn't want to hand over their photos to the nanny state.

And no adult should have to scan their face just to talk to a friend.

Enormous own goal for the UK

Sure to make UK tech untouchable to the rest of the world. (Except, perhaps, to dictatorships.)

And would slosh massive power to big tech companies.

Finally, it wouldn't take much for the nudity filter to turn into a dissent filter.

Well put by @signalapp

[Matthew Green @matthew_d_green]

I wrote a new post about the privacy risks of on-phone agents like Apple’s new Siri, and how private inference isn’t any sort of silver bullet. https://t.co/91ydRo9HRn

[Mishal Husain @MishalHusain]

Signal boss Meredith Whittaker has been talking to me about this - rejecting the idea of ‘scanning systems’ that purportedly detect nude images. Easily weaponised by governments, she says, for political speech and other content https://t.co/VytX6JLHhB

[Meredith Whittaker @mer__edith]

Thank you Jimmy ❤️

[Jimmy Wales @jimmy_wales]

I support human rights - therefore I support Signal in this. This government has gone completely off the rails on these issues.

[Signal @signalapp]

Our statement on the UK government’s demand that all content on all devices sold or used in the country be scanned, on the presumption of nudity, using a dystopian combination of age verification and content scanning. This proposal will not safeguard children. It endangers us all.

https://t.co/VdWe9uhi8p

[John Scott-Railton @jsrailton]

NEW: CENTCOM CONFIRMS: adversaries are buying commercial location data to target US troops.

Pentagon acknowledges it's not a one-off threat.

We got here thanks to big companies:
Who forced advertising everywhere. And it became a surveillance & weapons targeting system.

When you use apps they often harvest detailed data from your phone.

That data gets piped to an ecosystem of data brokers... who then sell the movements of millions to anybody with a credit card.

Customers include: shady players, criminals & military adversaries.

The data is incredibly detailed and can be used to track US military & intelligence activity (and that of every other government) and direct attacks.

Americans = extra vulnerable

Thanks to a lot of lobbying, the US has no comprehensive privacy law. For all of GDPR's flaws, Americans are far less protected from the data broker ecosystem.

...which is now leaving everybody exposed. Troops included.

Pentagon Policy? Yikes

Right now troops aren't prohibited from using their personal phones (which for reasons explained above are like giant, identifying beacons).

And until recently government devices could have ad tracking functionality enabled. Another massive own-goal.

Finally it seems like policy is being implemented to disable trackign on gov devices, but the gaps are enormous.

Some Action?

Now, a bipartisan group of Senators led by @RonWyden has called on the Pentagon to stop the flow of location data & stop using browsers built around collecting advertising data (they specifically call out Chrome).

And some other eminently sensible measures.

Good but also: experts have been collectively warning about this for almost a decade. What are we doing?

Story by @razhael
https://t.co/dY5m9lBZPs

[Mel Andrews @bayesianboy]

Finally, some good news for once. ArXiV will no longer tolerate hallucinated content in submitted works, with real, enforceable consequences.

[Meredith Whittaker @mer__edith]

One of my most deeply held beliefs is that refusing to name truth makes you stupid--literally degrades your intellect.

Engaging in mental gymnastics to justify what's convenient but unevidenced, unjust but personally beneficial, 'rewires your neural map' in ways that degrade your overall ability to understand and analyze the world around you, which is a precondition for intelligence and creativity.

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

Researchers at security firm RedAccess found more than 5,000 vibe-coded apps, created with AI tools from Lovable, Replit, Base44 and Netlify, with essentially no security, accessible on the open web. About 40% exposed sensitive personal or corporate data. https://t.co/8b8Kv3Jphn

[Matthew Green @matthew_d_green]

There’s something ominous about the speed with which the entire world has marched to require identification on platforms and, as I expected, begin the process of banning anonymous VPNs.

[Signal @signalapp]

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised.

However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us.
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks.

Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account.

We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.

For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock).

[Signal @signalapp]

We are very happy that today Apple issued a patch and a security advisory. This comes following @404mediaco reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted.

Apple’s advisory confirmed that the bugs that allowed this to happen have been fixed in the latest iOS release. You can read more here: https://t.co/yE8ufSTQHk

Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.

We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication.

[Meredith Whittaker @mer__edith]

@KimZetter Here’s our statement linked to the original 404 media reporting

[Meredith Whittaker @mer__edith]

Notifications for deleted messages shouldn't remain in any OS notification database, and we've asked Apple to address this.

In the meantime, you can prevent any preview text from your Signal messages from appearing in your notifications.

Signal Settings > Notifications > Show “No Name or Content”

https://t.co/JewPqt4N4F

[Meredith Whittaker @mer__edith]

@KimZetter Hi, this is actually not what we’re asking. We know why—it’s because Apple stores notification previews in an iOS database for what’s in our opinion much too long.

We are asking Apple to change this.

Would you mind deleting to forestall more confusion? Thank you!

[Meredith Whittaker @mer__edith]

Notifications for deleted messages shouldn't remain in any OS notification database, and we've asked Apple to address this.

In the meantime, you can prevent any preview text from your Signal messages from appearing in your notifications.

Signal Settings > Notifications > Show “No Name or Content”

https://t.co/JewPqt4N4F

[The Globe and Mail @globeandmail]

Signal’s Meredith Whittaker on AI and the tension between privacy and public safety https://t.co/KXjH5zaVQS

[Éric Bothorel #FluctuatNecMergitur @ebothorel]

Une audition de très haut niveau de @mer__edith et comme toujours, des arguments imparables sur le chiffrement de bout en bout. #E2EE
🙏
📽️🎬à retrouver ici https://t.co/KEHsexFfSW

[IndiaToday @IndiaToday]

Privacy is about being able to navigate my relationships in ways that allow me to live a full and authentic human life: @mer__edith

#IndiaTodayConclave26 | @TEE_S_G @Akshita_N @jessica_goel @nagarjund

[Matthew Green @matthew_d_green]

I’m going to keep harping on this. Meta’s push to remove encryption and lobby for age verification laws feel like two sides of a very ominous coin.

[dilip cherian @DILIPtheCHERIAN]

Brilliant session on our agentic future as @mer__edith unveils some red flags of data, law enforcement and human-rights. Privacy must be more respected than fake fear of bad-actors. @sardesairajdeep attempts to unwravel the @signalapp appeal. IYKYK