Ask HN: Is Washington Post correct in saying Signal is unsecure? | Hacker News Reader

Ask HN: Is Washington Post correct in saying Signal is unsecure?

50 pointskilljoywashere106 comments

https://www.washingtonpost.com/national-security/2025/03/26/trump-signal-chat-war-plan-texts-released/

By Alex Horton and Missy Ryan

"the conversation that occurred over an unsecure, commercially available messaging platform."

My understanding has been that Signal is actually well out ahead of other platforms in terms of respecting user privacy, so this seems confusing to me. Has Signal failed an audit that I'm unaware of?

View on HN

Unsecure in terms of being vulnerable to state spying on cell phones. Not of network interception, but rather compromised phones where a foreign adversary can read all your phone's data.

From this perspective, all phones are insecure. Classified government stuff isn't ever supposed to be on commercial smartphones in the first place.

The kind of security Signal provides is sufficient for people who aren't active targets of foreign states.

I remember how big of a deal it was when Obama wanted to keep his Blackberry. I have a colleague that used to work for RIM, and he's alluded to work he did for that effort that he's still unable to discuss.

Remember when Hillary used a private email server? Trump and MAGA were chanting to "Lock her up!"

Remember how she wasn't locked up? That set the precedent.

> Remember how she wasn't locked up? That set the precedent.

Locking her up would have set a far worse precedent, and I think that the other norm-breaking behavior of the current administration does not support the idea that prior punishment of past administration members for insecure data management would have led this administration to more secure data practices.

No better time than the present to establish a better precedent. Though more realistically, nobody needs to be going to jail in either case - but if there are zero consequences for anyone involved well, that's telling for a leader who frequently criticizes his opponents for not firing people when they do poorly.

A non-encrypted email server under a desk with a rogue email address where foreign officials have written that is not a .gov domain, not monitored, not seizable, is like deleting evidence. It’s possibly accessory to treason when you are Minister of State.

Using Signal is still against all rules, but at least it’s not unencrypted.

It proves that all governments bypass monitoring of their communications, even Google’s CEO when they discussed by auto-deleted chats.

I realize that government is terrified of the Captains of Industry, but it really should have cracked down on that hard and made it clear that if it happened again, the next crackdown would guarantee there wouldn't be a third repeat.

> not monitored, not seizable, is like deleting evidence

Like Signal?

>> Mike Waltz set disappearing message time to 4 weeks [0]

[0] https://www.theatlantic.com/politics/archive/2025/03/signal-...

Hmm. Well the issue is that he's using Signal, and that it's on a consumer grade phone, that is akin to deleting evidence.

But at this point disappearing message is more like limiting how bad this behavior is rather than aggravating circumstances.

I mean he's wrong to be using that setup but if using it I much prefer those illegal messages not be present anymore when he loses his phone or something.

It is illegal to destroy records of US government communications, especially at a high level, without first receiving approval from the National Archives.

But is destroying illegally stored records relevant? I don't know the legal precedents

https://www.bbc.com/news/articles/c9de770q9e0o

Sufficiently so, so that a judge ordered immediate retention.

Thank you!

Desktop operating systems are less secure than phone ones so any desktop messenger is more insecure.

QubesOS, Genode, QNX if you manage to run a desktop...

Well, top secret information isn't permitted on internet-connected desktop computers either.

But the thing about desktop computers is that they're not connecting to cell towers all the time. So if WiFi is disabled too as a precaution, and they're only connected to private secure networks via Ethernet and not the internet, you can consider them secure in terms of protecting classified secrets.

I don’t think many people understand how the TS or Secret networks of military bases are connected.

It wasn’t long ago that we were subject to stringent military standards for hosting these networks on site but once they came through, there was never any re-certification.

That is inherently very untrue. Mobile phones are targeted differently than desktop PCs, but this general statement is wrong as it is.

It also doesn't adhere to gov't record keeping policies / laws.

> Unsecure in terms of being vulnerable to state spying on cell phones

Signal forces us to use Android or iOS. Doesn't it look suspicious? I would happily use it on my desktop with Qubes OS, but I can't do it without a much less secure smartphone.

If QubesOS supports Flatpaks sufficiently, then it might run the Signal Desktop app (though if you want to register a new account, you do have to have a phone number, which is also possible virtually these days anyway)

Yes, Flatpaks are supported. However the untrusted, vulnerable phone will have a full access, won't it?

Only if you use a phone with it. Does the official server actively filter numbers from VoIP providers?

As much as I want to say "screw the developer's nonsense, just compile it yourself and do as you please" honestly why bend over backwards to use such a platform when solutions such as Matrix are available?

I agree and use Matrix myself. I just don't understand the Signal hype on HN.

It all depends on your security requirements. For me it is insecure compared to almost any anonymous internet chat since it requires your mobile number, a serious and unnecessary security risk. Burner phones are illegal in the EU, it isn't the privacy paradise its marketing sometimes tries to project.

"Secure", particularly when used in the casual general public sense, is a pretty overloaded term. All real security is in the context of a specific threat profiles, and makes tradeoffs vs other required functionality. Signal is definitely "secure" in the sense of its core cryptography and design, and it's aimed to be of practical value to the global general public. But that requires being able to scale massively, making authentication more convenient and leaving more up to the users, who won't tend to have their own sophisticated centralized auth system, IT support, and constant life/safety critical stuff being thrown around. Signal provides tools that can be used for better assurance in who you're talking to but it doesn't simply take that out of users' hands entirely because for its use case that simply isn't feasible.

For small vetted group top secret conversations by a sophisticated organization, it makes more sense to have something where inviting anyone who hasn't already been brought into the magic circle with physical interaction is simply impossible. If technically unsophisticated users are important, ideally one would have fully vetted tech support who will be monitoring all participants and doing the verification work for them. All managed via central systems and heavily walled off with multiple layers from crossing between high and low sides. If they want to talk to the general public, they should use physically different devices. Worse scaling, far more friction, but that's OK for top levels of a big organization in the context of extremely sensitive information.

Signal is a tool and a decent one, but no tool is good for absolutely everything and trying to use a hammer as a saw isn't a defect in the hammer it's a problem with the user/organization trying to do something so foolish.

For the threat profile of top leadership of the US government, yes, Signal is not secure. Signal runs on phones and phones can be compromised or lost, which can grant non-authorized individuals the ability to read the messages.

Spyware like Pegasus [0] has been able to use zero-click exploits to penetrate target phones and read messages as though they were the phone's owner.

The US has the best SigInt capacity in the world. The leaders of the US government know that phones are not secure against sophisticated adversaries and they know that we have very sophisticated adversaries. It's deeply troubling that so many of our leaders were so comfortable discussing Secret level plans in such a reckless and illegal way, and it's extremely likely that hostile adversaries have fly-on-the-wall level access to extremely sensitive US planning.

[0] https://en.wikipedia.org/wiki/Pegasus_(spyware)

> The US has the best SigInt capacity in the world.

How can anyone, including the top SigInt people in the US, know that? It has surely always been part of the principles of good spycraft that, if you've got fantastic SigInt (or other -Int) capabilities, then the best way to take advantage of them might be to make sure that nobody else knows about them.

When you work for most public corporations, you aren't allowed to bring personal devices linked to company servers to specific countries. You need to bring a burner device instead, because you are perceived as a target for corporate espionage.

This is like that, except the government and the type of people on the list are even better targets for their personal devices. The government has strict rules about secrecy and communication for military operations, and strong punishments for not following these protocols, because they can lead to a loss of life.

This is a different sort of "unsecure". The platform itself may be "secure", but the device, being in public where someone could take a picture of military secrets, etc. isn't.

256 bit encryption can't secure kneecaps.

Or in this case, fat fingers.

My college advisor was fond of the term "rubber hose cryptanalysis"

$5 wrench

https://xkcd.com/538/

It's called BYOD. Corporations have flirted with it for 10-15 years. The C-suite far too often is allowed privileges and exceptions like aristocracy that sacrifice and weaken the security of the organization.

Also, even for corporate-managed devices, as an example, Meta has specific requirements and procedures for taking devices to and returning them from contentious places like mainland China.

Just guessing but perhaps what they meant was that Signal allows one to invite anyone into a chat thread whereas their actual in-house classified comms will not permit that without going through a massive chain of approvals and being assigned custom hardware.

That, and it's vulnerable to the usual sort of attacks that governments are capable of.

If your threat model is "local cops" or "nosy people" then Signal seems very secure. If your threat model is "Enemies of the US" then honestly... nothing short of a SCIF is going to cut it.

True and even a SCIF is not foolproof. From the 50's to the 90's the US and Soviet military played a lot of fun games one of which included typing up a classified document in a SCIF and the Russians met up with the contest judge with an exact replica of the document. There were thousands of such games. I learned about many of them in the military. Between those stories and the fact we bought transmitter parts from them during the cold war showed me that each nations military were never enemies, just the bureaucrats were.

We publicly know about tools like Pegasus and competitors Predator, Hermit and I would confidently assume hundreds of other tools that dont publicly advertise themselves. (they all might be using the same handful of 0days for all we know)

There are multiple public price lists for 0days, Crowdfense currently has iOS full Zero Click Full Chain listed as $5m-$7m

And thats a long way to say - thats correct, its insecure. For the price of $7m any adverse of the US (or friendly country, who cares) can read all these government messages (who knows how many more Signal groups exist without the Atlantic editor)

That would be the cheapest way to get US confidential information in the history of spy agencies. The NSA budget is $10B per year

The assumption of anyone should be - everything in my iPhone and Android phone can be read for $7m. The conversations im having in front of my iPhone can be recorded for $7m. Then the only question left is - is the information worth more than that

If the answer is yes, assume your phone is compromised and only talk near it / message using it, information you understand will become public

End to end encryption doesn't make the ends secure, just the channel between them.

Not something the average Jane needs to worry about, but people discussing military action should.

Edit: if Jane's phone gets hacked, they're going to swipe her credit cards and send messages to all her whatsapp contacts asking to borrow money urgently and here's a convenient Revolut link*. Not exfiltrate her Signal messages.

* whatsapp thing is for real, the latest scam making the news around where I am.

They're not saying it's not secure for normal conversation, but not up to the national security standards for such coversations. It not being a proper tool for the job is what makes it "unsecure".

Yes, this. I was about to post my own comment and will instead reply and upvote yours.

This strikes me as setting the conversation to be whether it's 'secure', and can then everyone can discuss that part - instead of the fact that's not where or how that conversation should have been happening at all.

I think the "unsecure" is relative - instead of something in-house, locally hosted, and up to the required standards for classified information

Security/cryptographic strength are indeed relative, they depend on the 'threat model' being used.

The sentence applies the "unsecure" adjective directly to Signal as a "messaging platform", not to the phone itself or the wider context. Signal by itself is secure. No need to mince words here, the Washington Post is simply wrong.

puts on tinfoil hat

The coverage of this story has felt a lot like it's being used as an excuse to trick people into believing that Signal is nOT a sECuRe mESsAGing APp to discourage regular people from using it.

Signal allows you to add anyone to a conversation, without any requirement that they be vetted for security clearance, have a Common Access Card, or other centralized identity provider approval. Signal guarantees that you can't spoof the identity of a participant in a conversation (as long as you've verified their keys) but doesn't do anything to limit who you can add to a conversation. The cryptography is secure, but it's not intended for organizational use and doesn't support the sorts of centralized authentication that governments require. So it's not secure for those uses. The Washington Post is correct, but missing nuance.

Well, unsecure in the sense that a reporter was mistakenly added to a group chat they certainly should not have been in. A secure app in this context would prevent random people from being added to secure areas.

Notably, it’s a common feature in a corporate environment, even though the stakes are typically much lower.

A secure app in this context also couldn’t be loaded on any random smartphone and allow you to login with single-factor authentication.

It's entirely possible that other "unsecure" people were on this and other chats without going public with it!

The threat model for using signal is wider than what signal can audit internally:

Audits of a signal deployment, vs signal software at some point in time, aren't just of the app, but also how it is installed, configured, patched, operated, monitored, etc. Likewise, it's the full system, like device, os, network.

This stuff is supposed to run managed, especially at the level of the VP and secdef. Ex: Are they running signal patched from this week or 6 months ago, so a network attacker can leverage a software exploit to work around the crypto. Ex: Was an attacking payload sent through one of the chats while one of the people talking to the VP's + secdef's device was in Russia?

With the unmonitored auto deletion, and on who knows what device/network, external + internal crimes audit trails are being intentionally, recklessly, and illegally deleted. Managed detection and response, and post-crime investigations, are hard when you can't see.

I think Signal is the only usable option for trusted fully e2e-encrypted messaging today. Even the military is using it in some countries.

look into SimpleX

Since I never heard of it before, I looked it up.

It's some website https://simplex.chat/ with some claims about privacy because they don't use user ID:s (uh).

Do explain to me why anyone should trust this sus russian project [1] over the well regarded Signal?

1: https://find-and-update.company-information.service.gov.uk/o... (proof of russian natinality of Evgeny Poberezkin)

Had more look and learned that their privacy claim about no user ID:s is false, as they expose user IP:s:

https://news.ycombinator.com/item?id=41381204

Also it’s not just the app — it’s the fact that the app is running on unsecured private devices in unsecured locations.

It is certainly insecure compared to the normal channels for sharing classified information. The US government maintains a network that is cut off from the rest of the internet (more or less, there’s some nuances). The only way to access it is through a SCIF room. So they aren’t just using encryption for sending data, they are also using physical layer security. You can’t hack what you can’t reach, after all.

My understanding - largely based on this person's blog - is that Signal is the best secure messaging app that exists today: https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-sig...

no, simplex chat is https://simplex.chat/

No, my RandomThingie is even *-er

Ain't no one using a chat app named after a virus I have on my lips.

But actually, I imagine there's significant friction to using a new "hyper-secure application" after the encrochat debacle.

Soatok wrote a blog about this specific incident yesterday. Signal may have the most reliable E2EE, but that isn't the only security step required to secure the most sensitive information. https://soatok.blog/2025/03/25/the-practical-limitations-of-...

Nope. The US military has better (or at least more secure) messaging systems.

... based on Microsoft Lync :-) Yes, what a step forward.

No, they're wrong. Signal is considered extremely secure, which is why journalists and government uses it. Some people like to criticize anything Trump does, right or wrong.

That being said, the Signal non-profit entity is located in the US, so probably subject to the same risks as WhatsApp and Messenger; namely US courts compelling them to share data.

But the difference is that Signal has been architected from the start to retain much less (meta)data on the server, so that even if the Signal Foundation is compelled to share the data they have, that data will be extremely limited to the point of being mostly useless.

Thinking more in the sense of being forced to introduce a backdoor, weaken encryption, in the future which would give the US more data. Yes the encryption algorithm is theoretically very secure.

Any entity that operates in the US has to abide by US laws, after all. Probably not a concern for US citizens since they're allowed due process but creates risk for non-Americans looking for a truly secure messenger, especially if they live in a place that is currently at odds with US policy (Canada, Europe).

There are laws about this sort of thing that have severe penalties attached. When I was in the Navy handling encryption gear I had to sign a paper that stated that I understood that compromise of the secrets I'd been entrusted with could lead to the death penalty. Are you saying that shouldn't be true? Or shouldn't be true for people above a certain level?

Are you claiming that Signal running on consumer iPhone and Android devices where Pegasys and 0-days are for sale is secure?

Are you claiming that it's secure to conduct classified business on a platform where you can add anyone to the conversation without the appropriate documented approvals?

I have no idea what the US government's policy is, especially across branches. I'm not American.

I do know that the Signal algorithm is considered among the most secure, and has been considered the safest option for political dissidents, journalists, etc...

I also know some governments do use commercially available messengers (and OSes, and phones).

The CIA director also seemed to indicate that Signal was installed on all their phones.

On March 25, CIA Director John Ratcliffe told the Senate Intelligence Committee that when he became director, he was given a phone with Signal pre-loaded. He was briefed that Signal was “permissible” for work use, and “That is a practice that preceded the current administration to the Biden administration.”

It is permissible for non-classified stuff, the way you and I (and indeed, even the tightest of fed agencies) use teams.

Christ people, at work if I send some emails without encryption I would be fired. If I knowingly tried to get around records laws I would be fired.

The amount of motivated reasoning, just to excuse anything these incompetent and WILLFULLY bad at their jobs shitheads do is infuriating.

Signal responded to this directly on X: https://x.com/signalapp/status/1904666111989166408

Also Bluesky: https://bsky.app/profile/did:plc:tovhrfml47r6u4idaitaxefk/po...

In this case, assuming you are using Signal on iOS, the app could very well decide to send all the decyphered messages of targeted users (users that say a certain thing, or users with a certain name) to a 3rd party server. If they wanted to be undetected in all cases, they could leak data via the timing of the network packets.

And they could do all that without even knowing it, just by using a compromised toolchain.

Long story short, unless the SW (the app, the OS, the toolchains) and the HW have been audited, you have no idea what's going on.

Just to reinforce what others are saying, security isn't a binary yes or no thing, it's on a continuum that has tradeoffs with usability, and where you want to be on that continuum depends on risk. There are things you could do to be more secure than Signal, but they would also be more difficult to use, and many of those things aren't about Signal itself, but the hardware and networks it is on.

Any system you can invite someone into willy nilly isn't really that secure. At least it doesn't give them the full chat history.

If it is know that secret agencies are using Signal, then it is almost certain that other agencies are working to exploit that.

An obvious attack on Signal is to get one of your people a job working there, or to bribe/blackmail and existing employee, and have them install a backdoor or other exploitable code (maybe a secret weakening of the encryption?).

That raises an interesting question. Are all of these agencies using the build from the Play/iOS stores or is there a build based on the audited public repo?

Nothing stops you from opening signal in a bar and having a guy sitting behind you from the KGB reading the texts. Or say, adding a rando to the group. In their context, that means it’s unsecure.

The cryptography of Signal is not the issue.

Stupid question, if anyone still reads this thread:

Why do these oh-so-secure offerings allow any idiot to add you to a group chat without asking you if you approve?

Soatok wrote a good blog post about this that was discussed yesterday: https://news.ycombinator.com/item?id=43471223 The Practical Limitations of End-to-End Encryption (41 points, 42 comments)

The gist is that there are potential threats that any end-to-end encryption cannot fully protect against. Signal is a good provider of that encryption, but there are other considerations to protect highly confidential data, and Signal often lures non-technical users into disregarding those.

I wouldn't trust any form of symmetric encryption to secure anything.

And I would bet that there used to be people in the govt that could have told you why.

What would you trust that isn't symmetric encryption? And why not?

I wonder if its possible that an adversary added the reporter to the chat by controlling a compromised phone.

"commercially available messaging platform"

Is Signal engaged in commerce. Is it a free service.

Nit: the word is "insecure", not "unsecure".

Of “Небезопасный”?

It's missing the point of the story to focus on this aspect. The characters involved in this event were not using Signal because they thought it was secure. They used Signal because they intended to break and knew they were breaking the law.

Yes, thank you for saying so. I agree. And that's what should be being discussed everywhere.

For this specific chat, what law were they breaking?

(I'm not defending the Trump administration's law-keeping in general. I'm asking about this specific set of communications.)

Record keeping rules.

https://www.archives.gov/about/laws/presidential-records.htm...

The Vice President of the United States cannot use Signal "disappearing messages" to correspond with anyone for any purpose.

Ah. Those rules.

What you say is true. But if a technique makes it so that 1) they don't preserve a record for the future, and 2) they do leak (or risk leaking) information that can kill service people, I personally care more about #2.

(Ironic that, in trying to not leak to future investigators/prosecutors, they increased the risk of leaking to foreign adversaries. Shows which threat they're focused on.)

How could anyone know, unless they have contributed to Signal's repo ?

Presumably within Signal, there are plenty of weak points. And certainly Signal's ability to modify their app as they please doesn't fit within the OPSEC guidelines.

The question is: why would one of the most powerful militaries on the planet use a consumer app, regardless of its reputation ?

And the answer is: because the Trump administration is compromised.

> And the answer is: because the Trump administration is compromised.

By whom, exactly? Who benefits? Russia, somehow?

It seems more likely that the administration officials fear being monitored and their conversations leaked by staffers, and they wanted to avoid official recordkeeping requirements. The former may have some merit (though I doubt anyone is going to leak plans to attack Houthis, regardless of their feelings about the Trump administration), the latter is likely illegal and deserving of investigation.

Originally, I thought it was Russia.

Lately I've been wondering if its Israel or Saudi Arabia

It isn’t less secure than it was before the messaging scandal.

What will reporters use moving forward? Facebook messenger? /s

come on dude.

"unsecured" as in "not a secure comms system managed and approved by the NSA", which for the US government is normally considered a bad thing.

for normal people who don't want the NSA to be managing their comms then Signal is approximately the best possible choice, along with not being a fucking idiot while using it.

The issue isn't the cryptographic strength—the issue is that it doesn't provide capabilities for an organization to manage it (such as preventing unknown parties from being added to group chats).

1) Those Alex Horton and Missy Ryan do owe an apology to Signal project. Their publication was incorrect and caused misinformation regarding one of the most secure platforms on Earth.

2) As for Gov officials - I understand they used Signal on 1) Government issued devices, without a doubt running NSA built OS; 2) preinstalled Signal App, without a doubt audited by NSA line by line; 3) tactical OP information which has very close expiry date.

3) That "journalist", IMO, is guilty of high treason. They must have immediately notified the group about their presence and they must have not publish any of the secrets they accidentally got privy to. And even more, from professional POV, the actions of journalist were deeply non-ethical. I dare say, un-American and definitely not something that any US Citizen can be expected to do.

4) The "deep state" is furious because they can't leak Signal chat messages. IMO, it's a good choice. They (Administration) just need to carefully audit the groups and distribution lists. That was a very bad call.

I personally will _continue_ using Signal, even with more confidence now.

The journalist published proof that Hegseth texted detailed military attack plans via Signal two hours prior to the attack (the secrets) after multiple participants on the Signal chain lied to congress in a public hearing and claimed it didn’t happen. Would letting those lies stand have been the ethical thing for a journalist to do? Exposing a bunch of liars at the highest level of government is absolutely American and something all US citizens should be expected to do. Sadly, about half of Americans will still believe the lies even now that they have been exposed.

You very conveniently ignored my demand for official apology to Signal team. Why? What you have against them? Or everything should burn because half of America hates Trump? ;-) What about my point of running Signal on officially issued by Whitehouse phones? Do you disagree with that? Or we are ignoring the facts again, to make TDS the center of our conversation? And, what I _really_ want to know - will you continue using Signal or, as result of that stupid publication, you would ditch it? Thank you and please don't take my post wrong - I respect your views very much, I am just appalled how Signal is getting hurt among all that. It's unfair to Developers and great people workingin Signal team.

I didn’t realize that in order to comment I needed to address all of your points. Your take on the journalist (point 3) is the only one objectionable enough to warrant comment. But in the spirit of mutual respect, here you go: 1) Should the Washington Post apologize for calling Signal “unsecure, commercially available messaging platform.” Well, first, I think we can agree it’s a commercially available messaging platform. We might even agree that it is one of the most secure commercially available messaging platforms on Earth. But, as you can gather from other comments in this thread, “secure” is not a black and white thing. The padlock on my shed is secure against my kids. It is not secure against my neighbor who owns bolt cutters. Whether or not something is secure depends on the threat profile. What is the threat profile in this case? Furthermore, if some critical aspect of a system (such as the underlying cryptography) is secure that doesn’t necessarily mean the system as a whole is secure. For example, what if it is possible for an unintended party to be part of a secure conversation? Well, that by definition would not be secure. What if it is possible to screenshot classified information from a Signal conversations? That might be a security flaw. We could go on about challenges Signal faces, like their software runs on hardware they cannot control, on an OS they cannot control, compiled by a compiler they cannot control, distributed through app stores they cannot control. Or we could talk about how secure systems are only secure if used in a secure manner. We might agree that Signal is as secure as it possibly can be, given those limitations. But whether or not Signal is “secure” is not the question we should be asking. We should be asking whether it is “secure enough” for the context under discussion. The answer is no. The conversation leaked to a journalist. That is not secure. We might rightly say that Signal is apparently unsecure. I don’t expect journalists to understand crypto systems. I do expect them to recognize a security breach when it stares them in the face, and it makes sense to me that they might consider that unsecure. So, no, no apology necessary. 2) You are making a lot of assumptions here. Do you know that all 19 participants were using Signal on a govt issued device with NSA installed OS? How do you know that? All 19? If this were the proper system for communicating classified information, wouldn’t they have claimed as much? They can’t make that claim, so they are claiming it wasn’t classified information. And they are doubling down after the nature of the information has been revealed. Ask the pilots if it’s classified. And your contention that it was surely audited by the NSA line by line? Well, that has two problems: a) that would require Signal to be unsecure, and b) maybe only 18 NSA employees showed up to work that day, because they missed the journalist. The lack of any potential for NSA oversight is part of the problem. If the NSA were listening in, they could have moved the conversation to a SCIF as soon as the Fox News guy started texting F-18 launch times. 3) See my original comment. 4) By deep state, I guess you are referring to people who are actually qualified for their jobs, who understand that attack plans (including weapon systems, launch times, bomb detonation times) are classified information that if compromised could lead to mission failure and loss of life. No, these people aren’t furious that Signal prevents them from leaking information. They are furious that their unqualified superiors used Signal and did leak information. And to your question, sure I will keep using Signal. It is secure enough for my needs. But if I ever need to keep anyone updated about pending military strikes, I’ll go to a SCIF.

I am not a friend of how the story is currently being spun and I am not from the US. But by stereotype alone that wouldn't at be at all "unamerican" if the US really wants to be the leader of the free world in contrast to the usual autocracies.

On the contrary that would be the real duty of a journalist. Patriotic you could say.

Reply on news.ycombinator.com