Latest security news
Mon, September 28
Back to Backups: A Year in Review
Last September, we introduced an optional new way to automatically keep your Signal data safely and securely backed up so that important messages and memories can be easily recovered if something unexpected happens to one of your devices. We’ve been listening to your feedback and working hard on several improvements over the past year. We hinted at several of these “future plans” when Signal Secure Backups were first announced, and the future is now available on all platforms with the launch of iOS version 8.30 today. Here’s an overview of everything that’s changed since the initial release.…
Tue, August 11
Introducing Automatic Key Verification
Signal now offers a feature called “automatic key verification” which complements the existing safety number system . Signal is always end-to-end encrypted, and automatic key verification provides an additional, streamlined way to confirm that there’s no unexpected party between you and the other “end” of an end-to-end encrypted session. Read more...
Tue, August 4
More linked devices are on the table (and the Android tablet)
The latest update for Signal Android introduces comprehensive support for linked devices. Now you can easily link another Android phone or Android tablet to your Signal account. Thanks to significant interface improvements to better support large devices, your messages will stay in sync across every screen and look good on all of them too. We’re also expanding linked device support on iOS so you can link an iPhone to your Signal account in addition to our ongoing support for iPads. Signal Android v8.20 and Signal iOS v8.22 are rolling out now. Feel free to stop here if that’s all you needed t…
Thu, March 19
Label yourself
We all take on different roles in relation to our friends, neighbors, family members, and colleagues. Keep those different roles clear in your many Signal group chats by using group member labels, now available in the latest versions of Signal for Android, Desktop, and iOS. Read more...
Thu, January 29
Put a pin in it
Your most frequently asked questions, dinner reservations, and vacation itineraries are already top of mind. Now they can be top of chat as well. In the latest version of Signal rolling out now, you can pin your most important messages to the top of your 1-1 and group chats. Read more...
Wed, November 19
Signal Polls: Yes, no, maybe (yes!)
Signal polling: An easier way to see what your group chat really thinks and feels. Read more...
Thu, October 2
Signal Protocol and Post-Quantum Ratchets
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s resilience against future quantum computing threats while maintaining our existing security guarantees of forward secrecy and post-compromise security. Read more...
Mon, September 8
Introducing Signal Secure Backups
In the past, if you broke or lost your phone, your Signal message history was gone. This has been a challenge for people whose most important conversations happen on Signal. Think family photos, sweet messages, important documents, or anything else you don’t want to lose forever. This explains why the most common feature request has been backups; a way for people to get Signal messages back even if their phone is lost or damaged. After careful design and development, we are now starting to roll out secure backups, an opt-in feature. This first phase is available in the latest beta release for…
Wed, May 21
By Default, Signal Doesn't Recall
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows. This setting is automatically enabled by default in Signal Desktop on Windows 11. If you’re wondering why we’re only implementing this on Windows right now, it’s because the purpose of this setting is to protect your Signal messages from Microsoft Recall . Read more...
Mon, January 27
A Synchronized Start for Linked Devices
With Signal on Desktop and iPad, you can link your primary Android or iOS account with another device, letting you check and respond to messages in both places or conduct video meetings and calls from the comfort of a bigger screen. Signal’s upcoming beta releases will also introduce the option to transfer your messages and media when you link your primary Signal device to a new Desktop or iPad. Instead of starting fresh, and having only new messages show up, you can choose to bring your chats and your last 45 days of media with you. Or, you can choose not to. Read more...
Mon, November 11
Improving Private Signal Calls: Call Links & More
If you love group calls on Signal, but don’t want to create a group chat for every combination of your friends or colleagues, you’re in luck. Today we’re launching call links: Share a link with anyone on Signal and in just a tap or click they can join the call. No group chat required. Read more...
Fri, August 9
Proxy Please: Help People Connect to Signal
Several countries have recently blocked Signal, leaving their residents without a trusted and safe place to communicate. To help in this situation, Signal provides a built-in censorship circumvention feature and also includes support for a simple TLS proxy that can bypass these blocks in many circumstances and let people communicate privately. Read more...
Tue, February 20
Keep your phone number private with Signal usernames
Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else. Now we’re taking that one step further, by making your phone number on Signal more private. Here’s how: Read more...
Wed, December 13
Trend report: Use Signal
New long-sleeve shirts and tote bags fresh from the Signal test kitchen: We build Signal for people all over the world . So, of course we wanted to reflect that same global outlook in our merch. Read more...
Thu, November 16
Privacy is Priceless, but Signal is Expensive
Signal is the world’s most widely used truly private messaging app, and our cryptographic technologies provide extra layers of privacy beyond the Signal app itself. Since launching in 2013, the Signal Protocol—our end-to-end encryption technology—has become the de facto standard for private communication, protecting the contents of billions of conversations in WhatsApp, Google Messages, and many others. Signal also continues to invest in research and development in the pursuit of extending communications privacy. This commitment underlies our recent work to add a layer of quantum resistance t…
Wed, November 8
New Features Roll Call: Fall 2023
You should be able to communicate without worrying that every gossip tidbit, meme, or joke you share and who you share it with will get churned up into fodder for targeted ads or used to train an AI model. You also shouldn’t have to strip your communications down to the barest and most utilitarian version of relaying information. This is why Signal is dedicated to providing a truly private messaging app, and why we work to constantly make the experience better for everyone who uses it. We want you to know about the improvements we’re making in Signal, even the smaller ones that simply make th…
Tue, September 19
Quantum Resistance and the Signal Protocol
The Signal Protocol is a set of cryptographic specifications that provides end-to-end encryption for private communications exchanged daily by billions of people around the world. After its publication in 2013, the Signal Protocol was adopted not only by Signal but well beyond. Technical information on the Signal Protocol can be found in the specifications section of our docs site. Today we are happy to announce the first step in advancing quantum resistance for the Signal Protocol: an upgrade to the X3DH specification which we are calling PQXDH . With this upgrade, we are adding a layer of p…
Thu, March 9
Standing firm against threats to private and safe communication
Signal exists to provide people everywhere with a tool for real private communication. That’s our only goal, and we take it very seriously. We’re structured as a nonprofit to ensure that market forces can never put profit or expediency over the safety of those who rely on us. Our work also resonates beyond the Signal app. The Signal Protocol has become the foundation for end-to-end encryption technology that is used and trusted by many private messaging services to protect billions of messages every day. We recognize that privacy is a human right and that free expression and the ability to di…
Tue, March 7
Signal is for everyone, and everyone is different
The tech industry–its products, conceptual frameworks, linguistic conventions, and cultural norms–is largely centered in the US (and, increasingly, China. But we’re focused here on the US, where Signal is based). This is not because the US has better programmers or more visionary entrepreneurs, but due primarily to historical material conditions. For example, early investments in networked computation from the US military, which happened around the same time that the US was becoming a global superpower, which was followed by the privatization and then commercialization of networked computatio…
Mon, November 7
Story Time
If your favorite way to update your friends about life disappears in 24 hours, we’ve got some happy news for you. Stories are now available on Signal for Android and iOS, with Desktop coming soon! Read more...
Wed, October 12
Removing SMS support from Signal Android (soon)
For many years, the Signal app on Android has supported sending and receiving plaintext SMS and MMS messages in addition to Signal messages. SMS and MMS are standardized communication protocols that allow mobile devices to send and transmit messages, and most people picking up their phone to text or share memes don’t really think about them. To give some context, when we started supporting SMS, Signal didn’t exist yet. Our Android app was called TextSecure and the Signal encryption protocol was called Axolotl. Almost a decade has passed since then, and a lot has changed. Read more...
Thu, September 22
Help people in Iran reconnect to Signal – a request to our community
Signal is currently blocked in Iran. To help people in the country access Signal, we are republishing and revising a post that we originally posted in February, 2021 during a very similar situation in Iran. If you are willing and able, please follow the instructions below to set up a proxy server that will enable people in Iran to connect to Signal. We are grateful to the community who pitches in to help each other during these moments. If you are currently running a proxy, you will need to make some updates to ensure it continues to function. Update instructions are here . Read more...
Tue, September 6
A Message from Signal's New President
On September 12 I’ll be stepping into the role of Signal’s President, a new position created in collaboration with Signal’s leadership. I am thrilled, and I can’t think of a more meaningful use of my time, or a greater honor. I’ve been a friend, admirer, and champion of Signal since it was RedPhone and TextSecure, and in 2020 I joined Signal’s Board of Directors, helping inform high-level strategy and direction. So in many ways this is a happy step on a long continuum, not a dramatic change. Signal is more important now than ever, and I expect this to stay true well into the future. As Presid…
Fri, August 19
Technology Deep Dive: Building a Faster ORAM Layer for Enclaves
Private doesn’t mean lonely. Signal’s mission is to help you connect with people in a secure way. This means that you need to know which of your contacts are also on Signal. This is called “contact discovery” and it’s an essential part of any messaging app. Most other communications apps enable contact discovery by maintaining their own internal social graph or by uploading and storing your full address book on their servers. But Signal enables you to find and connect with people in a privacy-preserving way. In short, we let you see which of your friends use Signal, but we don’t want to know…
Mon, May 16
Signal Your Support
People around the world count on Signal for things as simple as sharing moments of celebration like a graduation or as high stakes as coordinating a protest. We’ve got your back no matter what! As we’ve seen in recent times from moments of civil unrest to demonstrations for democracy, people turn to Signal for private and even lifesaving communications. Day in and day out, the team at Signal is working to keep your chats, voice, and video calls safe and private. It’s our mission. It’s also the reason why, unlike most other tech companies, we are structured as a nonprofit. We aren’t driven by…
Mon, February 7
You Can Change Your Number
Millions of people worldwide rely on Signal every day for secure and private communication. Some of these people change their phone number, but want to continue using Signal without registering for a new account. We now provide the ability to change the phone number on your Signal account, while retaining all of your chats, profile information, and groups. Read more...
Mon, January 10
New year, new CEO
It’s a new year, and I’ve decided it’s a good time to replace myself as the CEO of Signal. I have now been working on Signal for almost a decade. It has always been my goal for Signal to grow and sustain beyond my involvement, but four years ago that would still not have been possible. I was writing all the Android code, was writing all of the server code, was the only person on call for the service, was facilitating all product development, and was managing everyone. I couldn’t ever leave cell service, had to take my laptop with me everywhere in case of emergencies, and occasionally found my…
Wed, December 15
How to build large-scale end-to-end encrypted group video calls
Signal released end-to-end encrypted group calls a year ago, and since then we’ve scaled from support for 5 participants all the way to 40. There is no off the shelf software that would allow us to support calls of that size while ensuring that all communication is end-to-end encrypted, so we built our own open source Signal Calling Service to do the job. This post will describe how it works in more detail. Read more...
Wed, December 1
Become a Signal Sustainer
Signal has no data to sell, no advertisers to sell it to, and no shareholders to benefit from such a sale. We’re building a different kind of tech – where your data stays in your hands – but we’re also building a different kind of tech organization . One without investors, quarterly earnings calls, or share price considerations. While the model for conventional tech companies incentivizes them to build products for your data rather than for you , Signal’s nonprofit structure is designed so that the only way value can accrue is in the experience of using the app; the only place it can accrue i…
Mon, November 1
Improving first impressions on Signal
The phenomenon of unsolicited and unwanted messaging dates back to the earliest communication platforms: from prehistoric cave graffiti and postal chain letters to popup ads and robocalls. To prevent spam, most online services rely on large-scale inspection of plaintext conversation content or detailed social-graph analysis to determine who is saying what to whom and whether or not that should be allowed. At Signal, we build on a foundation of privacy and do not have access to that type of data or metadata. We build Signal in the open, with publicly available source code for our applications…
Tue, August 10
Embrace ephemerality with default disappearing messages
As the norms for how people connect have changed, much of the communication that once took place through the medium of coffee shops, bars, and parks now takes place through the medium of digital devices. One side effect of this shift from analog to digital is the conjoined shift from the ephemeral to the eternal: words once transiently spoken are now – more often than not – data stored forever. We’ve designed Signal so that your data always stays in your hands. We think there’s something special about sharing a private fleeting moment between friends, so Signal also supports disappearing mess…
Tue, May 4
The Instagram ads Facebook won't show you
Companies like Facebook aren’t building technology for you, they’re building technology for your data. They collect everything they can from FB, Instagram, and WhatsApp in order to sell visibility into people and their lives. This isn’t exactly a secret, but the full picture is hazy to most – dimly concealed within complex, opaquely-rendered systems and fine print designed to be scrolled past. The way most of the internet works today would be considered intolerable if translated into comprehensible real world analogs, but it endures because it is invisible. Read more...
Wed, April 21
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere. A few months ago, they announced that they added Signal support to their software . Their products have often been linked to the persecution of impriso…
Tue, April 13
Update on beta testing payments in Signal
As the world stands today, the future of transaction privacy does not look great. The existing landscape is dominated by traditional credit companies, who over the past decade have been steadily pushing their networks for increased access to user data. They (and their data customers) are on a track to getting SKU level data of every purchase everyone makes everywhere. There are other contenders, such as regional online payments networks (like Venmo in the US), but the data story there is similar. This is not a future we are particularly excited about. At Signal, we want to help build a differ…
Tue, April 6
Help us test payments in Signal
The latest Signal betas are rolling out today. Inside, you’ll find performance enhancements, a slew of bug fixes, improvements to the mute settings, and if you’re in the United Kingdom, you’ll see support for Signal Payments – a new feature that enables you to send and receive privacy focused payments as easily as sending or receiving a message. This is a beta feature in a beta build , but for those in the United Kingdom living life on the edge, please help us test and give feedback. Read more...
Thu, February 4
Help users in Iran reconnect to Signal
Just over a week ago, we announced that Iranian censors had started blocking all Signal traffic in the country. As an interim solution to help people in Iran get connected again, we’ve added support in Signal for a simple TLS proxy that is easy to set up, can be used to bypass the network block, and will securely route traffic to the Signal service. This new connection method is supported in the latest Signal Android beta release, and will be rolling out to production users in a few days. Our hope is that this will help many people in Iran start sending and receiving messages again while we c…
Wed, December 23
No, Cellebrite cannot 'break Signal encryption.'
Yesterday, the BBC ran a story with the factually untrue headline, “Cellebrite claimed to have cracked chat app’s encryption.” This is false. Not only can Cellebrite not break Signal encryption, but Cellebrite never even claimed to be able to. Since we weren’t actually given the opportunity to comment in that story, we’re posting this to help to clarify things for anyone who may have seen the headline. Read more...
Mon, December 14
Adding Encrypted Group Calls to Signal
2020 has seen its fair number of challenges and changes. We’ve all adapted to new ways of staying in touch, getting work done, celebrating birthdays and weddings, and even exercising. As more and more of our critical and personal moments move online, we want to continue to provide you with new ways to share and connect privately. Today, we’re launching group calls in Signal with the latest versions of our apps. Group calls are free, private, and end-to-end encrypted — like everything else on Signal. Read more...
Wed, October 28
Link Up with Group Links
We recently released a new version of Signal groups with group admins, @mentions, permissions, and more. Today we’re adding one more feature into the mix: group links, which let you quickly create a link that anyone can follow to join your group. Like our other new group features, you can create a new group to try it out now, but these features will be coming soon to your existing Signal groups. Read more...
Mon, October 26
Research on your terms
Signal has always benefitted from our engaged and supportive community, and wouldn’t be what it is without your input and feedback. As the number of people using Signal has grown, so have our efforts to keep pace with what people expect from a messaging app, and where we might find new opportunities for Signal. Software companies typically overflow with data that explains the past and forecasts possible futures. They know exactly who is doing what with their products, how often, and where. While an abundance of data can contribute to their product and user experience decisions, these data col…
Tue, October 20
Multi-device calls with ICE forking
Now that voice and video calls are available for everyone on Signal Desktop and iPad, in addition to our mobile clients, we want to share a closer look at the technology that makes it possible for incoming calls to ring across multiple devices. Every call placed on Signal has always been private and end-to-end encrypted, but we previously supported only calls to or from one primary device per person. Now, you can make and receive secure audio and video calls from the devices in your pocket, on your lap, or at your desk. Read more...
Wed, October 14
New Features Coming to Signal Groups
Whether it’s staying in touch with family and friends, planning a party, scheduling an event, getting work done, or organizing for change , group chats are an increasingly important part of Signal. Today we’re releasing a new version of Signal groups that gives you a richer private group experience with group admins, granular permissions, @mentions and more. If you’re excited to try out these features now, you can create a new group to do so. These features will be coming soon to your existing Signal groups in a future update. Signal groups are built on top of the new private group system tec…
Thu, August 13
A new platform is calling: Help us test one-to-one voice and video conversations on Signal Desktop
Update: This feature is now available in production. The latest beta release of Signal Desktop includes preliminary support for one-to-one voice and video calls. Call your friends and family on macOS, Windows, and Linux; see their smiles on a larger screen; hear their laughter through the big speakers on your desk; and help us test the next generation of calling on Signal. Beta users get an early chance to evaluate call quality and performance while we continue to improve the interface and work on upcoming features. Read more...
Wed, August 12
Accept the unexpected: Message requests are now available in Signal
The number of people who join Signal every day is still growing at a record pace. With so many new conversations getting started, we’ve heard from a lot of users that they’d like more control over how they begin. With message requests, when someone who isn’t in your contacts starts a new chat with you or adds you to a group, you can quickly see more info before accepting the request, deleting it, or blocking the conversation. Read more...
Wed, July 1
Certifiably "F"ine
Sometimes people dive into Signal’s code looking for domain names, and then they send us screenshots asking if they should be concerned: We reply with a short explanation that lays out why there’s nothing wrong, but we understand the confusion. Nobody would be excited about getting a grade like this on a homework assignment – and you’d have to stay after class and ask the teacher what the hell a “T” even means on your report about summer vacation (“T”oo cool for school?). Let’s take a deeper look at what’s going on. Read more...
Tue, June 23
Help us encrypt even more faces
It’s been about two weeks since we announced an initiative to distribute versatile face coverings to help support everyone who is self-organizing for change in the streets. Since then, we’ve shipped over $25,000 worth of face coverings to organizers throughout the United States. Over $6,000 worth of merchandise was sent to Washington D.C. last week in time for the Juneteenth events in the heart of the city. We continue to be inspired by the energy and enthusiasm that is helping to shape change in America, and many people have reached out and asked how they can help. In order to make it as eas…
Fri, June 12
It's OK to be a little Emojional
The world was a different place when we announced message reactions back in February, but expressing the way you feel has never been more important. Instead of being limited to the default set of reactions that we started with, the latest Signal updates for Android, Desktop, and iOS let you react with even more emoji. Read more...
Tue, June 9
Your next upgrade deserves an upgrade
Signal iOS now includes a new feature that makes it possible to switch to a brand-new iPhone or iPad while securely transferring Signal information from your existing iOS device. As with every new Signal feature, the process is end-to-end encrypted and designed to protect your privacy . Transfers also occur over a local connection (similar to AirDrop), so even large migrations can be completed quickly. Read more...
Mon, June 8
Encrypt your face
One immediate thing seems clear about 2020: it’s a good year to cover your face. Online, we’re working to scale and improve Signal for everyone that is relying on it, but as one small offline way to help support everyone self-organizing for change in the streets, we’re also distributing face coverings free of charge. Read more...
Fri, June 5
Looking back at how Signal works, as the world moves forward
In the midst of world-wide protests against racism and police brutality, a lot of people are becoming more immediately aware and concerned about the security of their data and online communication. We’ve gotten a lot of questions at Signal over the past week, so we wanted to briefly recap how it is that we’ve designed Signal, and how we think about concepts like privacy, security, and trust. Read more...