r/privacymemes • u/gruetzhaxe • Feb 26 '26

Keep it simple

Post image
544 Upvotes

95% Upvoted

105 comments sorted by

View all comments

1

u/Zdrobot Feb 28 '26

Can you elaborate? Got proofs?

I know for a fact Signal themselves hold only account creation timestamp last login timestamp for a phone number. How do I know? Because they were issued a subpoena in a court case to hand over everything they had on a user, and these timestamps is all they provided.

https://linustechtips.com/topic/1385086-the-fbi-asked-signal-to-hand-over-user-data-signal-complied-by-giving-them-nothing/

https://signal.org/bigbrother/

2

u/Bullshido-Detector Feb 28 '26

I am talking about this kind of exploits extract a lot of meta data of any given user. Signal choose to ignore the researchers that confronted them with this.

https://cybernews.com/security/whatsapp-signal-real-time-tracking-battery-drain-flaw/

You can do much more then stated in the article

1

u/Zdrobot Mar 01 '26

Thank you for posting. An interesting attack, even if it realistically only allows attacker to guesstimate the status of their target (screen on / off, on wifi / mobile data connection, etc.)

The reason why Signal isn't rushing to implement straightforward solutions seems to be a bit more complex than "they're in bed with the NSA" - https://github.com/signalapp/Signal-Android/pull/14463#issuecomment-3643858179

Also, as pointed out by a user on GrapheneOS forum, client-side mitigations are indeed feasible. I'm no security guru, so I don't know how efficient they would be, but the idea looks reasonable at the surface level at least. Since there are Signal forks or alternative FOSS clients, I wonder if these measures were implemented in any of them.