Signal's new security feature checks if your encrypted chats were tampered with
Signal adds automatic key verification, a key-transparency system audited by Cloudflare and Trail of Bits that detects key-directory tampering in E2EE chats.
Signal launched automatic key verification, a key-transparency system that confirms a phone number or username remains bound to a consistent encryption key across Signal's key directory. Cloudflare and Trail of Bits independently audit the system, with cryptographic protection preventing auditors from seeing users' identifiers in plaintext. The feature mitigates key substitution by a compromised directory or privileged insider, though it currently requires the contact's phone number and users can fall back to manual Safety Number verification.
- Automatic verification replaces in-person safety-number checks, showing a green checkmark on verified contacts.
- Cloudflare and Trail of Bits act as independent third-party auditors of the key-transparency log.
- Defense targets attacker-controlled or insider key-directory substitution, framed by Signal as an unlikely scenario.
- Verification is unavailable for username-only contacts; manual Safety Numbers remain as a fallback.
- Products
- Signal
- Organizations
- SignalCloudflareTrail of Bits
From the original article
2 min read at helpnetsecurity.com
Signal has introduced a feature called automatic key verification, giving users a new way to confirm that nobody has secretly interfered with their encrypted chats.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.