A few thoughts about Signal’s Secure Value Recovery

[InfoSec News <alerts () infosecnews org>]

https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/

By Matthew Green
July 10, 2020

Over the past several months, Signal has been rolling out a raft of new 
features to make its app more usable. One of those features has recently been 
raising a bit of controversy with users. This is a contact list backup feature 
based on a new system called Secure Value Recovery, or SVR. The SVR feature 
allows Signal to upload your contacts into Signal’s servers without — 
ostensibly — even Signal itself being able to access it.

The new Signal approach has created some trauma with security people, due to 
the fact that it was recently enabled without a particularly clear explanation. 
For a shorter summary of the issue, see this article. In this post, I want to 
delve a little bit deeper into why these decisions have made me so concerned, 
and what Signal is doing to try to mitigate those concerns.


What’s Signal, and why does it matter?

For those who aren’t familiar with it, Signal is an open-source app developed 
by Moxie Marlinkspike’s Signal Technology Foundation. Signal has received a lot 
of love from the security community. There are basically two reasons for this. 
First: the Signal app has served as a sort of technology demo for the Signal 
Protocol, which is the fundamental underlying cryptography that powers popular 
apps like Facebook Messenger and WhatsApp, and all their billions of users.

Second, the Signal app itself is popular with security-minded people, mostly 
because the app, with its relatively smaller and more technical user base, has 
tended towards a no-compromises approach to the security experience. Wherever 
usability concerns have come into conflict with security, Signal has 
historically chosen the more cautious and safer approach — as compared to more 
commercial alternatives like WhatsApp. As a strategy for obtaining large-scale 
adoption, this is a lousy one. If your goal is to build a really secure 
messaging product, it’s very impressive.

[...]

--
Subscribe to InfoSec News
https://www.infosecnews.org/subscribe-to-infosec-news/
Follow InfoSec News on Twitter
https://twitter.com/infosecnews_
Follow InfoSec News on LinkedIn
https://www.linkedin.com/company/infosecnews/