Many people are moving to Signal, the messaging application. But, how secure is it? Can we trust that messages sent on it will remain private?

My name is Ryan, and I am an agorist. Today, we are talking about Signal, the messaging application. Can we trust it?

I have used and enjoyed Signal for years. It is the only messaging application that I trust for much of my business and personal communications. I have tirelessly recommended it to friends and family over the years, yet only now are so many people finally trying it out. Over the last week, almost everyone I know has moved to Signal. It's wild, and from what I have seen, it shouldn't be a surprise that their servers were temporarily overloaded last week. But, seriously, better late than never.

Along with the increase in users has come an increase in articles about Signal. Everyone has their opinions, but as I read the things people send me the more I realize how little people understand Signal the orgnization, protocol, and application.

Signal was created by a guy who goes by the name Moxie Marlinspike. But, before he created Signal he was the founder of Open Whisper Systems, and that was when I first began following him and his work. They released an application called TextSecure and even more importantly, they built and published the protocol behind it. This TextSecure protocol was the best of the best, implementing tried and true elliptic-curve Diffie-Hellman key exchanges plus a brilliant, double-ratcheting algorithm.

Using this algorithm, every message sent on the platform is encrypted with a brand new key. But, like a ratchet, it only goes one way. If you were somehow able to capture and decrypt a message along the way, you couldn't use that to decrypt the previous messages. The ratcheting only works one way and after a key is used, it is destroyed. So, as users send messages back and forth they both ratchet forward in unison with each new message.

The TextSecure app eventually morphed into the Signal app, and the TextSecure protocol became the Signal protocol. It set the new standard for end-to-end encryption. There were other apps out there, like Transmission, which claimed strong end-to-end encryption. But, when push came to shove they refused to publish their protocol because they feared that it would risk security! Rule #1 of security is that obscurity is not the same a security. If your protocol's security depends on people not knowing it, then by definition it isn't a secure protocol.

The Signal protocol, on the other hand, was and is completely open-source. If I wanted to, I could build an application today using it. Because the protocol is open, it has also had many eyes on it, many people testing its bounds and trying to break it. The protocol has been thoroughly tested by experts and found to be as secure as it sounds. And apart from peer-reviews and auditing of the protocol itself, there have been multiple third-party audits of Signal's implementation of the protocol. They have all passed with flying colors.

It is no surprise that Signal over the years has garnered praise from cryptographers who I respect like the great Bruce Schnier, and other crypto experts like Steve Gibson, plus other notable names like Edward Snowden.

If you haven't already, you will likely soon see articles about how Signal is some sort of CIA or NSA plot or something. They will make wild claims and warn people not to use Signal. But, let me tell you something, we can only go by what we know. We can only make decisions in life by what we know. If we make decisions based on wild speculation and things that we don't know, then we remove logic and reason from our decision-making. That is how you go crazy. Don't do that.

What we do know, is that Moxie Marlinspike is an old-school cypherpunk who helped created the best asynchronous, end-to-end encrypted messaging protocol in the history of the world. What we know is that this protocol and the double-ratcheting algorithm it uses are completely open-source. What we do know that both the protocol and Signal's implementation of it have been rigorously peer-reviewed and audited on multiple occasions by third parties. What we do know is that the best cryptographers out there agree that Signal is the best of the best and that is why so many other companies are implementing the same protocol in their applications.

What we also know is that in 2016 they received a subpoena for all of the information that they had on one of their users. Faced with the threat of law, they turned over all of the information that they had, which was 1) the date that the user created their account and the 2) last day that the user had connected to their service. That was it! That was all they had!

From what we know, Signal has done everything right. If I was going to create a brand new secure messaging protocol and service which I wanted people to trust, I would do what they have done, nothing more and nothing less. Until I am proven wrong, until we find out that they were lying all along, that the peer-reviewers and auditors were all paid off and that Moxie is actually a CIA plant, I will continue to use and enjoy Signal.

I can only make decisions based on what I know, and I'd suggest that you do the same. Put in the time, make informed decisions, and then go live your life. That's the best that any of us can do.

This is TechnoAgorist, episode 51.