roryuphold

Signal safety numbers changing after someone has died is not proof of a conspiracy, nor that Signal was “broken”. But believing so is a good sign that YOU aren’t using Signal securely! You can only ensure your Signal comms aren’t being intercepted IF you verify your safety numbers with each contact and do so anytime they change. You need to use a secure comms pathway to do this. Ideally in person. New safety numbers are created anytime they move to a new phone. VERY FEW PEOPLE DO THIS! Compared to cracking the encryption, it is MUCH easier to register a new phone to your Signal account. All I need is to steal your phone number (ex: SIM swap). That’s it! If I also know your Signal PIN (most people use terrible PINs) then I will also get access to your signal contacts & groups. But with ONE BIG CAVEAT: Signal will announce to all your existing contacts that the safety numbers changed! This would stop me from from pretending to be you IF people securely verified these new safety numbers, but few people do. (Note: Registration Lock would significantly prevent me from stealing your Signal identity this way.) Now let’s say someone just died in a car explosion and the FBI is trying to quickly figure out if they are working with others. There are a few scenarios I can imagine that leads to a changed safety number. 1 - They can “SIM swap” the number to a new device and collect all inbound messages. It will generate new safety numbers, but many don’t pay attention. So it’s great for building out a social graph of potentially unknown contacts. 2 - They can eventually dump your charred phone and restore the data into a new phone. This will also generate new safety numbers and announce it to all contacts, if the new devices is allowed to communicate with the Signal servers. Now with #2, what data can be extracted depends heavily on whether the passcode is known or if some awesome 0days/backdoors are available. But if someone was typing that passcode in view of a bunch of in-car cameras, I doubt 0day would be needed.