Is it still viable to use Signal for privacy in 2026? It's centralized, and has had many suspicious occurrences in the past.(Unopen source server code, careless whisper exploit which is still active as far as I know, and the whole mobile coin situation.)

Thoughts?

The client is open source, so it doesn't matter what the server code is, you can see everything the client sends and therefore tell what possible data is being collected.

It's run by a non-profit so there's no shareholders to please.

Your messages and decryption key are not stored on their servers.

It's been independently audited.

They have publicly posted responses to user information requests where they only provide the account creation date and last access time.

The (admittedly incompetent) US government recommends using Signal (for non-classified information) and top officials have been caught using it (Houthi Working Group).

You can never be 100% sure, but it appears to have excellent security and privacy.

A lot of people use Signal. It may not be the best solution out there, but it is so, so, so much better than the proprietary alternates.

One good thing is that a normie can easily use it as an alternative to WhatsApp, since the app design is so similar. I mean, it is easy for family and friends to understand and start using Signal, compared to something like Matrix or XMPP.

And if someone needs a little more hardening, they could use the fork called Molly, which has a few more security benefits over the stock app.

Yes. You will find a lot of randos saying no, but the consensus among security professionals and researchers is that it is still the current standard. Not to say that it doesn't deserve scrutiny or criticism, or that other projects aren't important to develop.

You may want to read Why not Signal?, but I still use it.

and top officials have been caught using it (Houthi Working Group).

For me this is the gold seal.

These guys desperately don't want records of their acts to become public record and they have the authority to outright ask US Intelligence 'Can you guys get access to this?' and the app they choose is Signal.

While centralisation continues to be a problem (as the recent AWS outage has shown), Signal continues to be the a sufficient compromise between privacy and usability that a non-technical user will actually use.

That said, I'm making contingency plans to set up an alternative for close family in case the US goes full retard and makes it inaccessible.

Just remember that if you, or anyone you are talking to, has notifications turned on (in the app itself), that conversation is now outside of signal and a lot easier to get to.

Fuck dessalines tho

https://github.com/mollyim/mollyim-android

@dessalines@lemmy.ml being as sharp as always, thank you for sharing this! I somehow missed that essay in the past, and recently even had a discussion where I argued in favor of signal. His overview makes some great points that shouldn't be dismissed offhandedly. The important point is to not make the mistake of shunning signal in favor of an even less secure alternative.
Also the user's threat model should be taken into account. Those who aren't anticapitalists (yet) might need to worry less about the concerns.

Which is an everything problem, not a signal problem. Just in case it sounds like a signal problem.

Doesn’t it depend on what’s in the notifications?

Yes but using it though Molly is more secure

I think the text is somewhat dubious in its arguments, but this (and the arguments built on this assertion) is just plain wrong:

[Signals servers have] a few important pieces of data;

Message dates and times
Message senders and recipients (via phone number identifiers)

Signal clients implement the Pond protocol. As a result, Signals servers know who a message is for (obviously, how else do you get the message) but cannot know who it is FROM.

I've been playing around with implementing a secure/private messenger demo for myself, and have been consistently impressed with how privacy preserving Signal is when reading their papers and code. I wish it was selfhostable, but apart from that, it's great.

The server would be NICE to be OSS, but ultimately, privacy breaches are prevented client/protocol side.

Agreed! I won't consider donating to them until they drop it.

IMHO the question depends on :

• who you are (boring, rando, political dissident, journalist, etc)
• who you talk to (family, friends, work, etc)
• what alternatives actually exist

So... sure Signal is not perfect but if you can't convince your family members to move to DeltaChat it sure beats using WhatsApp, Telegram, etc.

Not perfect (as recent news demonstrated) but still the standard
The no-brainer choice for secure and private messaging

What's the recent news?

You people are so fucking insufferable. You'll freeload off of them but the second they try to pay the bills you screech.

I'm SURE, you were totally going to pay you just saw the coin and turned away 🙄

Most likely this is referring to the case where they extracted messages from the notification history of an iPhone.

Which would be the situation with any app that has notifications that show content.

If you want to be perfectly safe here, you'd need to disable notification content. This has nothing to do with signal.

if you are super private person or want to be anonymous, maybe you can choose SimpleX.

Signal clients implement the Pond protocol. As a result, Signals servers know who a message is for (obviously, how else do you get the message) but cannot know who it is FROM.

Give me ssh access to signal's centralized US-hosted server so I can verify this (IE that their centralized DB doesn't store).

Otherwise this is a "trust me bro" claim, considering they have the phone numbers of everyone who signed up, and are the routing service for the messages you send.

PRODUCT PITCH: Hey everyone, I have a great idea for a secure / private messaging service.

It's hosted in the US, subject to its pervasive spying laws including national security letters.

Also I need all your phone numbers.

Also no you can't host this yourself, I run the only server.

Everyone who uses signal and supports it, is falling for this pitch.

Why not signal?

Not to mention the FBI admitted that the only data from Singal they get is when the account signed up and when they last connected and they are very unhappy about so little information.

Shit these are great features. I had never heard of it before.

Molly is an independent Signal fork for Android with improved features:

Fully FOSS Contains no proprietary blobs, unlike Signal

Encrypted Protects database with Passphrase Encryption

Multi-Device Pair multiple devices to a single account

Material You Extra theme that follows your device palette

UnifiedPush Ungoogled notification system

Automatic Locking When you are gone for a set period of time

RAM Shredding Securely shreds sensitive data

Tor Support Supports SOCKS proxy and Tor via Orbot

For example https://www.heise.de/en/news/iOS-Deleted-Signal-data-extracted-by-FBI-via-notification-database-11252199.html

But as I said it still is the standard and it is hard to find a better alternative

Oh yeah. As another comment pointed out. Users can control this by using hidden notifications. Not a sigbal issue.

As per usual, the answer is "depends on your threat model". For a lot of sensitive communications, the centralised design and therefore ability to correlate metadata is a no-go. But if you're just using it e.g. as a WhatsApp replacement to message your friends, it's fine. It's still the most polished and normie-friendly e2ee foss messenger.

I don't really understand why you think this, can you explain? Signal stores, and has access to, no message metadata. They don't know who your contacts are, which group chats you're in, when you're sending messages, or who you're talking to.

To be convinced of this, take a look at the client source code, and compile the app yourself. None of this information ever leaves your phone without being encrypted or otherwise masked. No analysis of their server code is required to be convinced of this.

What's your alternative?

Ooh! And you can add an F-Droid repo!
https://molly.im/fdroid/

This isn't a signal issue, it's a notification issue.

Literally any app that you allow to use notifications would do the same thing.

If you want this to be more secure, you have to turn off notifications.

And then proceed to invite a random journalist to their group 😅

Also, will I be able to reach people with any alternatives? It's not like they'll all switch to the app I choose, or at least I'm not that popular for them to follow me anywhere, well... worse, I still have to open Messenger (FB/meta) from time to time to get in touch with some of them 🤮🤢

Signal stores, and has access to, no message metadata.

Phone numbers are the most important metadata you can give them, far more important than message content. It means your real identity / name and address. With phone numbers you can build social networking graphs: who talked to who, and when.

To be convinced of this, take a look at the client source code, and compile the app yourself.

Client source code is irrelevant here. Signal is a centralized service, you can't verify what their US-based server is actually running (although they did go a full year without publishing any server updates at one point, until they received a lot of backlash for it).

None of this information ever leaves your phone without being encrypted or otherwise masked.

You gave them your phone number / real identity when you signed up. The most important piece of info they could possibly give them, you already did.

I'm considering several, and haven't made the decision yet: Matrix/Element, Briar, and Session are all on the table.

Can you explain how signal will build a social network graph when it doesn't know who sent any message, which group chats you're in, or who is on your contact list? Again, none of this ever leaves your device without being encrypted, which you can check by looking at the client source code.

when it doesn't know who sent any message

They have your phone number. You gave it to them when you signed up.

which group chats you're in

Signal wouldn't know how to route messages if it didn't store this info.

These are super cool parts of signal's architecture, that are not obvious to understand, but you can truly verify client side that (1) signal only sees an IP address, no phone number, associated with each outgoing message, and (2) signal has no idea who is in which group chat and which permissions you have in those chats.

The first one is pretty simple: you don't prove to signal who you are, signal just routes packets and lets the receiver verify that the sender is who they say they are by verifying a short lived certificate attesting your identity.

The second one is more interesting: group chats are implemented as a complete graph of direct messages between all participants. In order to update the group state, you send Signal a zero-knowledge proof that you are a member of the group, which convinces Signal that you can add or remove people, without ever revealing your identity. This same mechanism is used to prevent griefing, spam, and DDOS attacks for sealed sender.

Again, both of these can be verified by only looking at the client source code, and nothing else.

More info:
https://signal.org/blog/sealed-sender/
https://signal.org/blog/signal-private-group-system/

These are all "trust me bro" claims.

Give me ssh access to their server so I can verify that this "sealed sender" is working correctly and not using the info you already gave them. We would demand this transparency of open source messengers, so why not signal?

I'll just say one last time: none of this information ever leaves your client device, so even if signal wanted to know the phone number of a message sender, or which group chats you're in, they have no access to this because it all never leaves your phone. As long as you're running the correct client code, the server can be arbitrarily malicious, and it doesnt matter.

Have a great day

Session is closing in less than 90 days.

Session has now entered its final 90 days of operation. If we are unable to reach our funding goal within this period, the Session Technology Foundation (STF) will be forced to shut down.[...]
This is our final appeal to the Session community: without your support, the STF will cease all operations on July 8, 2026.

https://getsession.org/donate

Do you find it that hard to believe that other people have principles?

Name a more secure way to communicate with normies. They're not going to use SimpleX or Matrix...

[edit:fuck downvoters of this up the ass. Your siblings/cousins/parents/freinds are not ALL going to deal with Matrix on mobile/desktops. 100% fuck you for your puerile dedication to purity. You are Whatsapping right fucking now, hypocrite scum]

And the phone number! But still not a crime to be using signal (yet).

use xmpp like me

Sure I could just look this up, but: know if molly can restore from regular signal backups off the top of your head?