Before, to make sure no one was eavesdropping, you often had to compare a code (safety number) face-to-face... Now, the app automatically verifies your contact’s encryption key
But there’s a catch!
For this system to work reliably, Signal has asked Cloudflare (and Trail of Bits) to verify the key log
If U.S. authorities ever exert pressure, or if one of these parties is compromised, the system could be weakened
This isn’t really in line with the “trust no one” principle anymore
Another point...
Currently, you still need a phone number to sign up.
Soon, Signal will offer sign-up without a phone number (called Signal Login)... but you’ll have to pay a one-time fee, most likely via in-app purchases on Google Play or the App Store.
So we’re replacing a phone number (which is already traceable, but can be anonymized with a secondary number or VoIP) with a payment that leaves an even more solid financial trail, directly linked to a Google or Apple account and a real identity!
In short... Signal remains excellent for most people. It protects message content very well and collects very little data
But for those who want true maximum privacy (no permanent identifiers, no trust in a company, no dependence on a country), Signal remains a centralized and pragmatic tool
It's getting better, but it's not changing its model.
