Talk:Signal cloud backups - Revision history

Illerfish2: Illerfish2 moved page Talk:Signal's data collection despite privacy-focused advertising to Talk:Signal cloud backups: Page's past references to voluntary breaches in data privacy were unfounded. Page now focuses on the particular issue of cloud backups through PIN system. "Despite" listed as a word to avoid in wiki guidelines, not sufficiently neutral in tone.

2025-08-29T14:15:49Z

Illerfish2 moved page Talk:Signal's data collection despite privacy-focused advertising to Talk:Signal cloud backups: Page's past references to voluntary breaches in data privacy were unfounded. Page now focuses on the particular issue of cloud backups through PIN system. "Despite" listed as a word to avoid in wiki guidelines, not sufficiently neutral in tone.

← Older revision		Revision as of 14:15, 29 August 2025
(No difference)

Beanie Bo: Beanie Bo moved page Talk:Signal data collection to Talk:Signal's data collection despite privacy-focused advertising: more specificity

2025-08-27T18:41:56Z

Beanie Bo moved page Talk:Signal data collection to Talk:Signal's data collection despite privacy-focused advertising: more specificity

← Older revision		Revision as of 18:41, 27 August 2025
(No difference)

Sojourna: Sojourna moved page Talk:Signal Data Collection to Talk:Signal data collection: Misspelled title: Not in sentence case

2025-07-22T18:01:33Z

Sojourna moved page Talk:Signal Data Collection to Talk:Signal data collection: Misspelled title: Not in sentence case

← Older revision		Revision as of 18:01, 22 July 2025
(No difference)

InTransparencyWeTrust: /* Notices */ Reply

2025-03-07T09:01:34Z

Notices: Reply

← Older revision		Revision as of 09:01, 7 March 2025
Line 1:		Line 1:
	== Notices ==		==Notices==

	added several notices on this article [[User:InTransparencyWeTrust\|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust\|talk]]) 18:30, 6 March 2025 (UTC)		added several notices on this article [[User:InTransparencyWeTrust\|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust\|talk]]) 18:30, 6 March 2025 (UTC)

	: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.		:[[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.

	: There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers		:There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers

	: The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690		:The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

	: Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. It just doesn't use the data stored in the cloud to transfer settings. The data is still in the cloud though. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.		:Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. It just doesn't use the data stored in the cloud to transfer settings. The data is still in the cloud though. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.

	: As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)		:As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)
			::The animation you reference is about the consensus algorithm they use, which they operate within the constrained environment of an SGX enclave, used to store the auth key and amount of guesses, according to the blog. You mention that the alleged data collection is different, and is only for SVR/Storage Service, which you do not mention in the article. What is also missing is explaining when this Storage Service is used, opt-in/opt-out, relation to settings like setting a PIN, etc. The article also needs a fuller extend of the response to the backlash. A more recent blog post of this year (https://signal.org/blog/a-synchronized-start-for-linked-devices/) explains that "your personal devices are where your message history lives, and that means we have to transfer history between the devices themselves.", "We don’t have access to your message history (or your [https://signal.org/blog/building-faster-oram/ contacts], [https://signal.org/blog/signal-private-group-system/ groups], [https://signal.org/blog/introducing-stories/ stories], [https://signal.org/blog/signal-profiles-beta/ profile avatars], or [https://signal.org/bigbrother/ anything else])." [[User:InTransparencyWeTrust\|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust\|talk]]) 09:01, 7 March 2025 (UTC)

Kostas: indent reply

2025-03-07T08:50:00Z

indent reply

← Older revision		Revision as of 08:50, 7 March 2025
Line 5:		Line 5:
	: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.		: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.

	There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers		: There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers

	The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690		: The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

	Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. It just doesn't use the data stored in the cloud to transfer settings. The data is still in the cloud though. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.		: Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. It just doesn't use the data stored in the cloud to transfer settings. The data is still in the cloud though. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.

	As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)		: As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)

131.93.221.242 at 01:38, 7 March 2025

2025-03-07T01:38:39Z

← Older revision		Revision as of 01:38, 7 March 2025
Line 9:		Line 9:
	The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690		The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

	Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.		Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. It just doesn't use the data stored in the cloud to transfer settings. The data is still in the cloud though. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.

	As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)		As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)

131.93.221.242 at 01:37, 7 March 2025

2025-03-07T01:37:08Z

← Older revision		Revision as of 01:37, 7 March 2025
Line 7:		Line 7:
	There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers		There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers

	The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this helpful ~~FAQ that~~ was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690		The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this FAQ helpful. This is the archived version as it was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

	Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.		Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.

	As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)		As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)

131.93.221.242 at 01:35, 7 March 2025

2025-03-07T01:35:40Z

← Older revision		Revision as of 01:35, 7 March 2025
Line 5:		Line 5:
	: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.		: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.

	There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers		There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation https://signal.org/blog/images/secure-value-recovery-animation.gif taken from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers

	The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this helpful FAQ that was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690		The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this helpful FAQ that was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

131.93.221.242 at 01:21, 7 March 2025

2025-03-07T01:21:09Z

← Older revision		Revision as of 01:21, 7 March 2025
Line 2:		Line 2:

	added several notices on this article [[User:InTransparencyWeTrust\|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust\|talk]]) 18:30, 6 March 2025 (UTC)		added several notices on this article [[User:InTransparencyWeTrust\|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust\|talk]]) 18:30, 6 March 2025 (UTC)

			: [[User:InTransparencyWeTrust\|@InTransparencyWeTrust]]! Thank you for highlighting exactly the problem with Signal's misleading and unclear communication.

			There is no question that Signal stores data in the cloud. Please review references for more information. If you are in a hurry, here's Signal's handy animation from https://signal.org/blog/secure-value-recovery/ explicitly illustrating how requests are sent to and handled by their cloud servers

			The data being stored in the cloud (which includes the user's name, photo, phone number, and a list of every contact) is an entirely different thing from private contact discovery. The data collection is not related in any way to private contact discovery (although both use SGX for protection). This data collection is only for SVR/Storage Service. You may find this helpful FAQ that was removed and replaced with links to a bunch of far less helpful blog posts: https://web.archive.org/web/20230101032155/https://community.signalusers.org/t/faq-signal-pin-svr-kbs-storage-service-cloud/15690

			Also note that the feature which can migrate all Signal data without the data stored on the cloud does not in any way prevent Signal from collecting and storing that data on the cloud. More importantly that feature did nothing prevent the data already stored in the cloud from being vulnerable to the CacheOut attack and will not prevent any future SGX vulnerabilities or side channel attacks from allowing that data to be exposed.

			As for "Tone" concerns, if somebody has a better way to say that Signal is telling people something that objectively isn't true ("Signal is designed to never collect or store any sensitive information.") without saying that they are lying, feel free to edit that language to whatever is more appropriate. I don't know what else to call a lie without sounding like weasel. [[Special:Contributions/131.93.221.242\|131.93.221.242]] 01:21, 7 March 2025 (UTC)

InTransparencyWeTrust: /* Notices */ new section

2025-03-06T18:30:20Z

Notices: new section

New page

== Notices ==

added several notices on this article [[User:InTransparencyWeTrust|InTransparencyWeTrust]] ([[User talk:InTransparencyWeTrust|talk]]) 18:30, 6 March 2025 (UTC)