WASHINGTON — Signal, an end-to-end encrypted messaging app long considered one of the most secure in the world, has recently faced attacks from hackers accused of links to Russia.
Top German officials on Saturday blamed Moscow-backed groups for phishing attacks targeting senior politicians on the messaging app, raising questions about how secure Signal really is.
Similar phishing cases have been reported by Dutch and American users, with Google in February sounding the alarm over cyberattacks from Russia-aligned groups.
But what makes Signal different from other messaging apps, and how could one of the world’s most secure messaging apps be so widely targeted?
Signal’s end-to-end encryption means that any sent message travels in a scrambled form and can only be deciphered by the end user.
Nobody in between — not the company providing the service, not the internet provider, nor hackers intercepting the message — can read the content because they don’t have the keys to unlock it.
Signal is not the only messaging service to do this, but unlike WhatsApp and Apple’s iMessage, the app is controlled by an independent non-profit, not a big tech behemoth motivated by revenue. That has won it more trust with those concerned about privacy.
Signal also goes further than WhatsApp on data privacy, making metadata such as when the message was delivered and its recipient invisible even to the company itself.
And WhatsApp shares information with its parent company, Meta, and third parties, including phone numbers, mobile device information, and IP addresses.
For these reasons, Signal has long been a go-to messaging service for users particularly concerned about communications secrecy, such as people working in security professions, journalists, and their sources.