There’s a vulnerability in Signal where you can set up linked devices that replicate your signal messages. You can do this by just scanning a QRcode. This is known to be used by Russian hackers.
What are the chances the Russians duped Witkoff into scanning a QR code while he was in Moscow?
What are the chances this admin had him do it ON PURPOSE?
In a previous world, some three letter agency (FBI maybe?) would seize the phones in the chat to investigate the leak.
You mean the desktop linking feature? If that's considered a vulnerability, then so is being able to chat with someone after getting their public key unverified from an overseas server, the primary mode in which everyone uses it (including the people in this chat, evidently, since no out-of-band key exchange was performed)...
Not to mention the "vulnerability" where you copy the phone's storage and get the key material onto another device to do with what you will, which may be harder or easier depending on the hardware but I'd trust any sufficiently funded security agency to be able to do this for common devices
I agree it could be hardening to allow users/organizations to disable this feature, and also other features such as automatic media decoding and other mechanisms that are trade-offs between security and usability, but simply does not meet the definition of a vulnerability (nobody will assign this a CVE number to track the bug and "resolve" it)
Acrylic table menus have inserts which can be easily replaced.
https://thehackernews.com/2025/02/hackers-exploit-signals-li...
“… the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance.”
“ These QR codes are known to masquerade as group invites, security alerts, or legitimate device pairing instructions from the Signal website.”
Also
“ Last week, Microsoft and Volexity also revealed that multiple Russian threat actors are taking advantage of a technique called device code phishing to log into victims' accounts by targeting them via messaging apps like WhatsApp, Signal, and Microsoft Teams.”
Signal could make the pairing attack impossible by eliminating the device pairing feature, but that would also reduce its appeal and harm its mission of bringing secure communication to a broad audience. It could add steps to setting up a group chat and inviting additional members to make it less likely users will invite the wrong person, but that, too would hurt its popularity.
Security is a process and a spectrum, not a binary that can be guaranteed by using a certain product or service.
In that view, Signal is the wrong app to use for US Officials.
Signal probably shouldn't be approved for that purpose because it does trade some foolproofness for convenience. Secure communication should also be limited to dedicated devices, which probably wouldn't have journalists stored in their contacts.
You could see a CIA agent being in Russia needing to use Signal with an informant, e.g. But that wouldn't be the same level of security needed to hold nuclear secrets.
That list of conditions would likely be quite restrictive compared to how we saw it used here. It would certainly include using a dedicated device for classified information, and would forbid taking that device to an unfriendly country. The US government doesn't need to do that though; it already has its own systems for secure communication.
[1] "Putin gave Trump portrait to envoy, Kremlin confirms" - https://thehill.com/policy/international/5212691-putin-trump...
[2] https://en.wikipedia.org/wiki/The_Thing_(listening_device)