Hacker News Reader

Not all other messengers require a mobile phone number in order to get access, meaning not all other messengers have a view of users' social networks - some of them are anonymous, and Signal is not. It's a fundamental difference. But we've been here before.

They kill people based on metadata - they told us so. They don't need the rest.

Threema leaks no such metadata

https://breakingthe3ma.app/

You want to use this, by all means.

Were any/all of those vulnerabilities mitigated?

Per the link. Yes. Here the specific statement.

Lessons Learned

We believe that all of the vulnerabilities we discovered have been mitigated by Threema's recent patches. This means that, at this time, the security issues we found no longer pose any threat to Threema customers, including OnPrem instances that have been kept up-to-date. On the other hand, some of the vulnerabilities we discovered may have been present in Threema for a long time.

For what it's worth, and obviously I could have been clearer about this: what's interesting about that link is the description of Threema's design, not the specific vulnerabilities the team found.