Signal

Signal is a nonprofit end-to-end encrypted communications app. Privacy isn’t an optional mode, it’s the way Signal works. Every message, every call, every time.

[Signal @signalapp]

To help protect Signal users from phishing and social engineering attacks, we’ve introduced additional confirmations and educational messaging in the app to help people better detect fraudulent profiles, especially message requests from scammers posing as Signal.

More changes are on the way.

[Signal @signalapp]

A response to recent reporting in Germany, in service of clarity and accountability:

First, it’s important to be precise when it comes to critical infrastructure like Signal. Signal was not “hacked” — in that our encryption, infrastructure, and the integrity of the app’s code was not compromised.

However, sophisticated attackers have engaged in a harmful phishing campaign, posing as “Signal Support” by changing their profile display name and using social engineering to trick people into handing over their credentials — information that allowed these attackers to take over some targeted Signal accounts. This is something that plagues any mainstream messaging app once it reaches the scale of Signal, but we know how high the stakes are given the trust people place in us.
In the coming weeks, you’ll see us rolling out a number of changes to help hinder these kinds of attacks.

Because we don’t collect user data, what we know about these attacks comes from the victims of phishing. And from what victims have told us, the attacks followed a broad pattern: after tricking people into revealing their Signal credentials, attackers then used those credentials to take over their account and also frequently changed the associated phone number. Because such a change results in de-registering your Signal accounts, attackers prepared people for this by telling them that being de-registered was intended behavior, and that all they would need to do is “re-register,” or, create a new account. When they moved to create a new Signal account — one that was now decoupled from their hijacked account — the victims thought they were logging back in to their primary account. As a result, many didn't notice the takeover. The compromised accounts were then weaponized to target the victims' contact lists by posing as the owners of the account.

We understand the trust that people put in Signal, and how devastating this kind of social engineering can be. While it’s true that all messaging platforms are susceptible to scammers and phishing that betrays people’s trust and convinces them to “unlock the front door” where no backdoor exists, we are looking to do everything we can to help people avoid and detect such scams.

For the time being, please stay vigilant against phishing and account takeover attempts. Remember that no one from Signal Support will ever send you a message request or ask for your registration verification code or Signal PIN. For an added layer of protection, you can enable Registration Lock in your Signal Settings (Account -> Registration Lock).

[Signal @signalapp]

We are very happy that today Apple issued a patch and a security advisory. This comes following @404mediaco reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted.

Apple’s advisory confirmed that the bugs that allowed this to happen have been fixed in the latest iOS release. You can read more here: https://t.co/yE8ufSTQHk

Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.

We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication.

[Signal @signalapp]

New: Group member labels, a way to describe yourself or your role in a group chat, only visible to that group chat.

Label yourself the “Goalie” to your soccer team or “Favorite Child” to your family to stir some drama.

Available on Android, Desktop & iOS https://t.co/mwtxDEESrz

[Signal @signalapp]

While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone. 4/4
https://t.co/3yDodyTTnt. .

[Signal @signalapp]

We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.

To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts. 1/4

[Signal @signalapp]

To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN.

We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup. 3/4

[Signal @signalapp]

New artist-created sticker packs in Signal, ready for you to use to your heart's content.

Thank you to the artists: Amanda Cotan, Lexi Vay, Miguel Ángel Camprubí, Plastic Thing & Tiffany Beucher. We love your work!

[Signal @signalapp]

Signal video and voice calls are now supported for up to 75 participants!

Share your screen, raise your hand, react with the right emoji, and create easily shareable call links with Signal calls.

https://t.co/olLSAiloma"

[Signal @signalapp]

We’ve improved private group video calls in Signal with new features, incl. call links.
Create a link that anyone on Signal can use to join a group call *without* having to join a Signal group chat first
+ raise hand, emoji reactions, calls tab, & more https://t.co/EF32bROeFK

[Signal @signalapp]

Find us in the Microsoft Store :)

https://t.co/8U98Kx3mbo

[Signal @signalapp]

📌 Pin your most important messages to the top of your 1-1 and group chats.

Long press a message to pin it for yourself and everyone else in the chat.

Now available on the latest version of Signal for Android, Desktop, and iOS.

https://t.co/6oR6TkmKZ6

[Meredith Whittaker @mer__edith]

Welcome to Signal, we love to have you <3

Bienvenido a Signal, nos alegra que estés aquí. <3

https://t.co/zgUfGhZWf7

[Signal @signalapp]

It's been a big year at Signal. Thanks to you, more & more people are speaking privately and freely. Thanks to you, we hit the top of app stores in multiple countries & served as critical global comms infrastructure. It's an honor to build Signal for you, with your support. 🩵

[Signal @signalapp]

Getting a new phone for the holidays doesn’t mean giving up Signal message history. Restore old messages on a new phone using Signal Secure Backups or device-to-device transfer.

https://t.co/yyFllVyKgt

[Signal @signalapp]

If you’ve felt safer sending a message because you sent it on Signal, please support our work. As a nonprofit, Signal exists because of your donations.

In the app: Settings > Donate
On the web: https://t.co/S42Pju9vpl

[Signal @signalapp]

There are so many ways to donate to Signal, and we're grateful to you for supporting us.

Settings > Donate
https://t.co/S42Pju9vpl

[Signal @signalapp]

Do you depend on Signal? Please donate to keep us growing

Settings > Donate
https://t.co/S42Pju8XzN

[Signal @signalapp]

Like many services, as Signal grows, it becomes a more appealing place for scammers to try and cause harm. We've put together tips to help you protect yourself from phishing, scams, & impersonation attempts. Plus info about how Signal support communicates.
https://t.co/znhlopaW6Y