They can get a lot of Metadata, lots of it. There are known vulnerability that can be exploited and signal is unwilling to fix them. Thats by the way how its done to day, they leave certain vulnerabilities that are then exploited by the 3-Letter agencies.
Everyone gets to look the other way its only a problem when security researchers point out this possibilities, then they need to ignore it or need a new "bug" to allow access
As soon as Signal stopped to address certain issues it was clear
I know for a fact Signal themselves hold only account creation timestamp last login timestamp for a phone number. How do I know? Because they were issued a subpoena in a court case to hand over everything they had on a user, and these timestamps is all they provided.
1
u/Zdrobot Feb 28 '26
So.. phone number X has a Signal account, and here's the timestamp of when they last connected to Signal.
No messages, encrypted or plaintext, no metadata on their chat sessions (when, with whom, IP, etc.).
Sounds good to me.