Opinion Signal’s Katherine Maher Problem - Is the integrity of the encrypted-messaging application compromised by its chairman of the board?

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.

CHRISTOPHER F. RUFO
MAY 07, 2024


The encrypted-messaging service Signal is the application of choice for dissenters around the world. The app has been downloaded by more than 100 million users and boasts high-profile endorsements from NSA leaker Edward Snowden and serial entrepreneur Elon Musk. Signal has created the perception that its users, including political dissidents, can communicate with one another without fear of government interception or persecution.

But the insider history of Signal raises questions about the app’s origins and its relationship with government—in particular, with the American intelligence apparatus. Such a relationship would be troubling, given how much we have learned, in recent years, about extensive efforts to control and censor information undertaken by technology companies, sometimes in tandem with American government officials.

First, the origin story. The technology behind Signal, which operates as a nonprofit foundation, was initially funded, in part, through a $3 million grant from the government-sponsored Open Technology Fund (OTF), which was spun off from Radio Free Asia, originally established as an anti-Communist information service during the Cold War. OTF funded Signal to provide “encrypted mobile communication tools” to “Internet freedom defenders globally.”

Some insiders have argued that the connection between OTF and U.S. intelligence is deeper than it appears. One person who has worked extensively with OTF but asked to remain anonymous told me that, over time, it became increasingly clear “that the project was actually a State Department-connected initiative that planned to wield open source Internet projects made by hacker communities as tools for American foreign policy goals”—including by empowering “activists [and] parties opposed to governments that the USA doesn’t like.” Whatever the merits of such efforts, the claim—if true—suggests a government involvement with Signal that deserves more scrutiny.

The other potential problem is the Signal Foundation’s current chairman of the board, Katherine Maher, who started her career as a U.S.-backed agent of regime change. During the Arab Spring period, for instance, Maher ran digital-communications initiatives in the Middle East and North Africa for the National Democratic Institute, a largely government-funded organization that works in concert with American foreign policy campaigns. Maher cultivated relationships with online dissidents and used American technologies to advance the interests of U.S.-supported Color Revolutions abroad.

Maher then became CEO of the Wikimedia Foundation in 2016, and, earlier this year, was named CEO of National Public Radio. At Wikipedia, Maher became a campaigner against “disinformation” and admitted to coordinating online censorship “through conversations with government.” She openly endorsed removing alleged “fascists,” including President Trump, from digital platforms, and described the First Amendment as “the number one challenge” to eliminating “bad information.”

According to the insider, a woman named Meredith Whittaker, who became president of the Signal Foundation in 2022, recruited Maher to become board chair because of their mutual connections to OTF, where Maher also serves as an advisor, and to nonprofits such as Access Now, which “defends and extends the digital rights of users at risk around the world,” including in the Middle East and North Africa. Whittaker, like Maher, is highly ideological. She previously worked in a high position at Google and organized left-wing campaigns within the company, culminating in the 2018 “Google Walkout,” which demanded MeToo-style sexual harassment policies and the hiring of a chief diversity officer.

So what does all this mean for American users—including conservative dissidents—who believe that Signal is a secure application for communication? It means that they should be cautious. “Maher’s presence on the board of Signal is alarming,” says national security analyst J. Michael Waller. “It makes sense that a Color Revolutionary like Maher would have interest in Signal as a secure means of communicating,” he says, but her past support for censorship and apparent intelligence connections raise doubts about Signal’s trustworthiness. David Heinemeier Hansson, creator of the popular Ruby on Rails web-development framework, agrees, saying that it had “suddenly become materially harder” to trust the Signal Foundation under Maher’s board leadership.

For those who believe in a free and open Internet, Maher’s Signal role should be a flashing warning sign. As she once explained, she abandoned the mission of a free and open Internet at Wikipedia, because those principles recapitulated a “white male Westernized construct” and “did not end up living into the intentionality of what openness can be.” The better path, in her view, is managed opinion, using, alternately, censorship and promotion of dissent—depending on context and goal—as the essential methods.

We’re entering a dangerous period in political technology, and Maher is in the thick of it. Under her ideology, “Internet freedom” is a tactic, not a principle, and “fighting disinformation” means speech suppression, including here at home. When people tell you who they are, believe them.
 
This design flaw is so severe that there's not much anyone can say that will convince me this is anything but intentional.
I'd disagree it's a design flaw at all.

As with all devices, if it's compromised it's compromised. I don't use WhatsApp, but someone upthread mentioned that if you copy its local data, you will get the keys as well. I use GPG sometimes, and I can just copy my local keychain and access it somewhere else. My system keychain (Secret Service API) is in KeePass, and now I have easier access to everything stored there as well. I can now, for example, copy my browser installs and easily keep the cookies, which are encrypted by a key stored there. You can access the system keychain on Windows too, somehow.

It's your fucking computer. At the end of the day, you have access to it, and all the software you run (and give your trust to) will too. The alternative, as mentioned here, is TPMs on desktop and extremely locked down phone OSes, which are openly horrible and harmful to the user. "Secure" secret storage is, to be fair, one of the few more acceptable uses of such locked-down tech, but I do not trust such "trusted computing" solutions because they are designed against me, to lock me out of my own devices.

Of course I ought to have access to Signal's internal keys, because the computer trusts me. The alternative is to have my computer not trust me, but corporations, which is vile.
 
This is only true if you share the same machine ID in Windows (same thing a device product key is checked against on a new Windows install). If you copy the app data to a different machine, it will not work. I've tested as much myself (plus there was a 3rd party security audit which found the same thing).
I can't reproduce your results, for me it doesn't appear to be HWID bound. Just now tested this out by building a new Server 2022 VM, installed Telegram Desktop then copied %APPDATA%\Telegram Desktop\tdata from my PC to the VM, launched it and everything loaded up without complaint. I didn't test sending messages though, just loading historical chats. The VM is on separate hardware.

I searched for more info and found this chinky blog where the guy demonstrates Telegram session hijacking by copying only the session data out of the tdata folder. He explains the only way to prevent this with Telegram is to enable the "Local Passcode" feature as this will prevent the attacker from being able to unlock your session once stolen.
https://s4u2self.cc/telegram-session-hijacking.md?locale=en (archive)

The chink makes reference to Telegrab and that leads to an old article from Dec 2018 where Talos demonstrated the exploit with Signal that we're talking about here + the same for Telegram and WhatsApp https://blog.talosintelligence.com/secureim/ which is related to the Bleeping Computer article @Markass the Worst linked.

At least Telegram provides you the option of protecting your session with the passcode though I personally was not aware of it until reading that blog.
 

This goofy chart is from the OTFs website. The OTF gets money mainly from United States Agency for Global Media, The Department of State and Congress. So Signal has been propped up by various glow nigger entities its whole life. ☢️

https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems/

Funding to date​

$2,955,000​

2012$012 months
2013
$455,00018 months
2014
$900,00012 months
2015
$900,00012 months
2016
$700,0005 months
 

This goofy chart is from the OTFs website. The OTF gets money mainly from United States Agency for Global Media, The Department of State and Congress. So Signal has been propped up by various glow nigger entities its whole life. ☢️

https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems/

Funding to date​

$2,955,000​

2012$012 months
2013
$455,00018 months
2014
$900,00012 months
2015
$900,00012 months
2016
$700,0005 months


they really must have been looking for the niggercattle who wouldn't have batted an eye like Mental Outlaw with supposed Fed seizures
 
  • Like
Reactions: Tiny Chinaman
they really must have been looking for the niggercattle who wouldn't have batted an eye like Mental Outlaw with supposed Fed seizures
I think Signal is still somewhat safe, but I agree, if you are a state level target, they will be in favour of using backdoors in Signal.
I used Signal to speak to relatives and I was fortunate to only use it for calls and not fedposting.

I agree I was naive since I trusted signal during my high-school years, and only recently I got myself informed about the details.
 
Last edited:
  • Like
Reactions: Flaming Dumpster
I'd disagree it's a design flaw at all.

As with all devices, if it's compromised it's compromised.
I agree it's not particularly useful to try to protect Signal message history from the very device they're stored on. The bigger vulnerability is the ability to spoof that device—getting access to the history once shouldn't mean getting silent access to all future messages on a different device.
 
  • Agree
Reactions: Flaming Dumpster
At least Telegram provides you the option of protecting your session with the passcode though I personally was not aware of it until reading that blog.
Yeah, I think I got the order of things I researched a while back - wrong.
Initially, when I did the research I found that Telegram too, was insecure and found the tip for the local passcode. I just forgot what it was about with the time and just got used to typing it in.
Still, it is not very reassuring the Signal team doesn't even acknowledge it as an issue. You shouldn't just assume all end users have FDE as its actually still very rare. That's why I sometimes concede that phones are somewhat more secure than a laptop, for example.
 
  • Like
Reactions: Flaming Dumpster
they really must have been looking for the niggercattle who wouldn't have batted an eye like Mental Outlaw with supposed Fed seizures
I think the primary reason glow niggers are interested in platforms like this is monitoring their supporters and regime change operation activity outside of the US. I think they use their access to platforms like this to gather data to gauge the efficacy of certain campaigns abroad, as well as monitoring their puppets.
 
This is how local, passwordless applications work. What magic were people assuming Signal used to enable encryption at rest without any input from the user and without hooking into secure enclaves/keychains? This kind of hysteria happened after the CIA leaks where it was revealed the CIA had a tool to get Signal messages..... when they had access to the unlocked device. People were saying the same things.
People need to keep in mind companies have target demographics and making their product technically more secure on paper but off-putting to use by their target demo isn't an option.
 
First off, where is this $50 million dollars a year that the Signal Foundation is burning actually going?

Because it's definitely not going to Signal's app security or r&d.

Wait got it...
When benefits, HR services, taxes, recruiting, and salaries are included, this translates to around $19 million dollars per year. Source

Clearly it's going to a board full of 1A hating spooks from the Council on Foreign Relations, overpaid silicon valley managers, a bloated HR department, and a DEI president who quit Google because it wasn't left wing enough.

Almost half a million dollars per employee. Fifty employees.

This is joke in your country?


I'd disagree it's a design flaw at all
I disagree with your disagree.

It's definitely a design flaw.

If I design a phone's charger connector port to have a lifespan of 180 cycles, based on my opinion that people should get a new phone every six months, that doesn't make it any less of a design flaw when it breaks, even if I did it on purpose.

If 90% of this security problem with Signal could be easily solved with a PIN, and users have been asking for this feature for seven years, then why not implement it and give the user the option?

It's your fucking computer.
Your OS still implements a non-executable stack even if it is your fucking computer, just in case malware gets inside.

course I ought to have access to Signal's internal keys, because the computer trusts me
The computer may trust you, and Signal may trust the computer, but that's doesn't mean Signal should trust you - unless you provide the pin or password.

Signal's internal keys shouldn't be sitting on the disk in a way that allows replay, cloning, or other attacks by any malware that's just passing through town.

You shouldn't just assume all end users have FDE as its actually still very rare.
You're absolutely right. What percentage of Signal Windows users have fde? 1%? 5% tops?

motherboard breaks, lose access to your account forever
hate this idea
Not true.

There's lots of good solutions involving fingerprints that don't mean you're locked out of the account if the device breaks.

You can use the system fingerprint to generate a mnemonic tied to the device to prevent cloning attacks in case your device is stolen. Or use the device fingerprint as part of a distributed key revocation system to remotely shut the device off the network in the event the laptop is lost.

With the advancements in deterministic hierarchical keying (ie BIP-31) coupled with asymmetric + session keys and a PIN, you could make a very powerful distributed system resistant to a single point of failure.

It all starts with a single git commit... to add a PIN or password.
 
Stealers are known issue with the typical security model of desktop operating systems. Meanwhile on mobile Signal gets protection of such data for free. That being said, there are APIs designed for storing secrets. Windows has DPAPI, macOS has an API for the keychain, and desktop Linux has the freedesktop secret service API. Stealers now have to call an API to trigger a prompt to unlock the keychain. Well, except on Windows where a flag has to be set when encrypting to require a prompt on decryption.
 
Last edited:
What magic were people assuming Signal used to enable encryption at rest without any input from the user and without hooking into secure enclaves/keychains?
Idk, maybe something like what Telegram has been doing with sending login codes to your logged on mobile device (if it exists). You can have reliable "2FA" with another logged in device to prevent session hijacking at the very least.
AFAIK, the telegram local password option predates this, so its probably a legacy leftover feature. But even having that option is overall better than none at all.
 
Ok, so the TL;DR is Signal is run by the American government and Telegram is run by the Russian government.

You pays your money and you makes your choice.
 
  • Informative
Reactions: frozen_runner
BTW Katherine Maher worked for USAID.
Such mentions were scrubbed from her English Wikipedia page.
Screenshot_20250216_105848.jpeg
 
  • Informative
Reactions: Markass the Worst
Back