Signal data collection: Difference between revisions

Line 3:

Signal is an open source encrypted messaging service that is frequently recommended to highly vulnerable users such as human rights activists, whistleblowers, and journalists whose lives and/or freedom can depend on their ability to maintain private and secure communication.

~~Though they maintain a public image as a company with user-centric and minimal data collection practices, starting in~~ 2020 Signal ~~began~~ quietly collecting and storing sensitive user data on their cloud database~~. Signal's changes to what data is collected and how it is stored were made~~ without obtaining user consent. For a service that is trusted by users in privacy-critical situations, they have failed to allow current and prospective users to make informed choices about the risks they are taking when using Signal.

In 2020 Signal has been accused of quietly collecting and storing sensitive user data on their cloud database without obtaining user consent.

==Background==

Line 16:

''Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with."''

==~~Data collection begins~~==

==Incident==

{{~~DisputedInline~~|~~reason~~=~~see further notices in this section, section~~ title ~~is misleading~~|~~Misleading section title~~}}

In 2019, Signal previewed a feature called "secure value recovery".<ref>{{Cite web |title=Technology Preview for secure value recovery |url=https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025}}</ref> This feature would allow users installing signal on a new device to pull down the user's encrypted data from cloud servers.<ref>{{Cite web |title=Technology Preview for secure value recovery |url=https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025}}</ref>

Signal's data ~~collection practices changed~~ in ~~2019 when Signal previewed a feature they called "secure value recovery"~~.~~<ref>~~{{~~Cite web~~ |~~title=Technology Preview for secure value recovery~~ |~~url~~=~~https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025~~}}~~</ref>~~

This new feature has been accused of being a breach of privacy, with claims that Signal would start collecting the same kinds of information that Signal had been getting legal requests to turn over, and that Signal would keep that data in the cloud.{{DisputedInline|Misrepresents the new feature as storing user's data to cloud servers|reason=feature does not store user data in the cloud like other messaging apps}}

This new feature meant that Signal would start collecting the same kinds of information that Signal had been getting legal requests to turn over, and that Signal would keep that data in the cloud.{{DisputedInline|reason=feature does not store user data in the cloud like other messaging apps|Misrepresents the new feature as storing user's data to cloud servers}} Their stated reason for doing this was so that if a Signal user got a new device they could install the app, enter a pin, and the app would pull down the user's data from cloud servers.

The data being collecting and stored in could includes the user's name, photo, phone number, and a list of every Signal user they have contacted.<ref>{{Cite web |title=What contact info does the Signal PIN functionality actually save |url=https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/4 |access-date=6 Mar 2025}}</ref>{{DisputedInline|Cited source is heavily cherry picked|reason=contact discovery on Signal is private and does not share the phone number as explained later in the cited sources}} Messages are not saved, however.

The data being collecting and stored in could includes~~: The~~ user's name, photo, phone number, and a list of every Signal user they have contacted.<ref>{{Cite web |title=What contact info does the Signal PIN functionality actually save |url=https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/4 |access-date=6 Mar 2025}}</ref>{{DisputedInline|reason=contact discovery on Signal is private and does not share the phone number as explained later in the cited sources~~|Cited source is heavily cherry picked~~}} ~~Note that the messages~~ are not saved ~~in the cloud~~.

This was a highly controversial change, and some Signal users objected on philosophical grounds,<ref>{{Cite web |title=Don’t want PIN, don’t want anything stored in cloud |url=https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 |archive-url=https://web.archive.org/web/20240301015109/https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 |archive-date=1 Mar 2024 |access-date=6 Mar 2025}}</ref><ref>{{Cite web |title=PIN, cloud storage are showstoppers |url=https://old.reddit.com/r/signal/comments/ghsj5b/pin_cloud_storage_are_showstoppers/}}</ref><ref>{{Cite web |title=Forced PIN, bite it Signal |url=https://old.reddit.com/r/signal/comments/hkle3d/forced_pin_bite_it_signal/}}</ref><ref>{{Cite web |title=Welcome to the cloud Signal users! |url=https://old.reddit.com/r/signal/comments/hkl914/welcome_to_the_cloud_signal_users/}}</ref> requesting that Signal instead provide a means to export encrypted backups that could be imported locally eliminating any need to upload data to the cloud. Signal users also raised technical concerns about the security of the system and doubts that it would protect their data.<ref name=":1">{{Cite web |title=Proper secure value security: PINs are too easy to brute force, SGX is not reliable enough |url=https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 |archive-url=https://web.archive.org/web/20240301015110/https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 |archive-date=1 Mar 2024 |access-date=6 Mar 2025}}</ref> Some of these concerns were also shared by cybersecurity-experts<ref name=":2">{{Cite web |title=Signal’s New PIN Feature Worries Cybersecurity Experts |url=https://www.vice.com/en/article/signal-new-pin-feature-worries-cybersecurity-experts/ |archive-url=https://web.archive.org/web/20250117232443/https://www.vice.com/en/article/signal-new-pin-feature-worries-cybersecurity-experts/ |archive-date=17 Jan 2025 |access-date=6 Mar 2025}}</ref><ref name=":3">{{Cite web |title=Signal Going to Cloud? A Discussion with Sean O'Brien |url=https://www.youtube.com/watch?v=PFi-VI7_T3o}}</ref><ref name=":4">{{Cite web |title=Does Signal’s “secure value recovery” really work? |url=https://palant.info/2020/06/16/does-signals-secure-value-recovery-really-work/}}</ref> and security researchers demonstrated that the system was vulnerable to attacks which allowed them to access the user data being stored.<ref>{{Cite web |title=SGX CacheOut SGAxe attack. Signal’s cloud storage and contact discovery vulnerable |url=https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 |archive-url=https://web.archive.org/web/20230519115856/https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 |archive-date=19 May 2023 |access-date=6 Mar 2025}}</ref>{{DisputedInline|reason="In recent weeks, Signal has introduced more features that make it more user friendly to people who may not have extremely paranoid threat models. For example, it’s now possible to migrate all Signal data, including message history, from one phone to another, using a feature that does not rely on cloud servers and is also encrypted, according to Signal. "|Cited vice article explains more nuance}}

@@ Line 3: / Line 3: @@
 Signal is an open source encrypted messaging service that is frequently recommended to highly vulnerable users such as human rights activists, whistleblowers, and journalists whose lives and/or freedom can depend on their ability to maintain private and secure communication.
-Though they maintain a public image as a company with user-centric and minimal data collection practices, starting in 2020 Signal  began quietly collecting and storing sensitive user data on their cloud database. Signal's changes to what data is collected and how it is stored were made without obtaining user consent. For a service that is trusted by users in privacy-critical situations, they have failed to allow current and prospective users to make informed choices about the risks they are taking when using Signal.
+In 2020 Signal has been accused of quietly collecting and storing sensitive user data on their cloud database without obtaining user consent.
 ==Background==
@@ Line 16: / Line 16: @@
 ''Notably, things we don’t have stored include anything about a user’s contacts (such as the contacts themselves, a hash of the contacts, any other derivative contact information), anything about a user’s groups (such as how many groups a user is in, which groups a user is in, the membership lists of a user’s groups), or any records of who a user has been communicating with."''
-==Data collection begins==
+==Incident==
-{{DisputedInline|reason=see further notices in this section, section title is misleading|Misleading section title}}
+In 2019, Signal previewed a feature called "secure value recovery".<ref>{{Cite web |title=Technology Preview for secure value recovery |url=https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025}}</ref> This feature would allow users installing signal on a new device to pull down the user's encrypted data from cloud servers.<ref>{{Cite web |title=Technology Preview for secure value recovery |url=https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025}}</ref>
-Signal's data collection practices changed in 2019 when Signal previewed a feature they called "secure value recovery".<ref>{{Cite web |title=Technology Preview for secure value recovery |url=https://signal.org/blog/secure-value-recovery/ |archive-url=https://web.archive.org/web/20241228040757/https://signal.org/blog/secure-value-recovery/ |archive-date=28 Dec 2024 |access-date=6 Mar 2025}}</ref>
+This new feature has been accused of being a breach of privacy, with claims that Signal would start collecting the same kinds of information that Signal had been getting legal requests to turn over, and that Signal would keep that data in the cloud.{{DisputedInline|Misrepresents the new feature as storing user's data to cloud servers|reason=feature does not store user data in the cloud like other messaging apps}}
-This new feature meant that Signal would start collecting the same kinds of information that Signal had been getting legal requests to turn over, and that Signal would keep that data in the cloud.{{DisputedInline|reason=feature does not store user data in the cloud like other messaging apps|Misrepresents the new feature as storing user's data to cloud servers}} Their stated reason for doing this was so that if a Signal user got a new device they could install the app, enter a pin, and the app would pull down the user's data from cloud servers.
+The data being collecting and stored in could includes the user's name, photo, phone number, and a list of every Signal user they have contacted.<ref>{{Cite web |title=What contact info does the Signal PIN functionality actually save |url=https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/4 |access-date=6 Mar 2025}}</ref>{{DisputedInline|Cited source is heavily cherry picked|reason=contact discovery on Signal is private and does not share the phone number as explained later in the cited sources}} Messages are not saved, however.
-The data being collecting and stored in could includes: The user's name, photo, phone number, and a list of every Signal user they have contacted.<ref>{{Cite web |title=What contact info does the Signal PIN functionality actually save |url=https://community.signalusers.org/t/what-contact-info-does-the-signal-pin-functionality-actually-save/16854/4 |access-date=6 Mar 2025}}</ref>{{DisputedInline|reason=contact discovery on Signal is private and does not share the phone number as explained later in the cited sources|Cited source is heavily cherry picked}} Note that the messages are not saved in the cloud.
 This was a highly controversial change, and some Signal users objected on philosophical grounds,<ref>{{Cite web |title=Don’t want PIN, don’t want anything stored in cloud |url=https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 |archive-url=https://web.archive.org/web/20240301015109/https://community.signalusers.org/t/dont-want-pin-dont-want-anything-stored-in-cloud/14057 |archive-date=1 Mar 2024 |access-date=6 Mar 2025}}</ref><ref>{{Cite web |title=PIN, cloud storage are showstoppers |url=https://old.reddit.com/r/signal/comments/ghsj5b/pin_cloud_storage_are_showstoppers/}}</ref><ref>{{Cite web |title=Forced PIN, bite it Signal |url=https://old.reddit.com/r/signal/comments/hkle3d/forced_pin_bite_it_signal/}}</ref><ref>{{Cite web |title=Welcome to the cloud Signal users! |url=https://old.reddit.com/r/signal/comments/hkl914/welcome_to_the_cloud_signal_users/}}</ref> requesting that Signal instead provide a means to export encrypted backups that could be imported locally eliminating any need to upload data to the cloud. Signal users also raised technical concerns about the security of the system and doubts that it would protect their data.<ref name=":1">{{Cite web |title=Proper secure value security: PINs are too easy to brute force, SGX is not reliable enough |url=https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 |archive-url=https://web.archive.org/web/20240301015110/https://community.signalusers.org/t/proper-secure-value-security-pins-are-too-easy-to-brute-force-sgx-is-not-reliable-enough/15096 |archive-date=1 Mar 2024 |access-date=6 Mar 2025}}</ref> Some of these concerns were also shared by cybersecurity-experts<ref name=":2">{{Cite web |title=Signal’s New PIN Feature Worries Cybersecurity Experts |url=https://www.vice.com/en/article/signal-new-pin-feature-worries-cybersecurity-experts/ |archive-url=https://web.archive.org/web/20250117232443/https://www.vice.com/en/article/signal-new-pin-feature-worries-cybersecurity-experts/ |archive-date=17 Jan 2025 |access-date=6 Mar 2025}}</ref><ref name=":3">{{Cite web |title=Signal Going to Cloud? A Discussion with Sean O'Brien |url=https://www.youtube.com/watch?v=PFi-VI7_T3o}}</ref><ref name=":4">{{Cite web |title=Does Signal’s “secure value recovery” really work? |url=https://palant.info/2020/06/16/does-signals-secure-value-recovery-really-work/}}</ref> and security researchers demonstrated that the system was vulnerable to attacks which allowed them to access the user data being stored.<ref>{{Cite web |title=SGX CacheOut SGAxe attack. Signal’s cloud storage and contact discovery vulnerable |url=https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 |archive-url=https://web.archive.org/web/20230519115856/https://community.signalusers.org/t/sgx-cacheout-sgaxe-attack-signals-cloud-storage-and-contact-discovery-vulnerable/14892 |archive-date=19 May 2023 |access-date=6 Mar 2025}}</ref>{{DisputedInline|reason="In recent weeks, Signal has introduced more features that make it more user friendly to people who may not have extremely paranoid threat models. For example, it’s now possible to migrate all Signal data, including message history, from one phone to another, using a feature that does not rely on cloud servers and is also encrypted, according to Signal. "|Cited vice article explains more nuance}}