Opinion Signal’s Katherine Maher Problem - Is the integrity of the encrypted-messaging application compromised by its chairman of the board?

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.

CHRISTOPHER F. RUFO
MAY 07, 2024


The encrypted-messaging service Signal is the application of choice for dissenters around the world. The app has been downloaded by more than 100 million users and boasts high-profile endorsements from NSA leaker Edward Snowden and serial entrepreneur Elon Musk. Signal has created the perception that its users, including political dissidents, can communicate with one another without fear of government interception or persecution.

But the insider history of Signal raises questions about the app’s origins and its relationship with government—in particular, with the American intelligence apparatus. Such a relationship would be troubling, given how much we have learned, in recent years, about extensive efforts to control and censor information undertaken by technology companies, sometimes in tandem with American government officials.

First, the origin story. The technology behind Signal, which operates as a nonprofit foundation, was initially funded, in part, through a $3 million grant from the government-sponsored Open Technology Fund (OTF), which was spun off from Radio Free Asia, originally established as an anti-Communist information service during the Cold War. OTF funded Signal to provide “encrypted mobile communication tools” to “Internet freedom defenders globally.”

Some insiders have argued that the connection between OTF and U.S. intelligence is deeper than it appears. One person who has worked extensively with OTF but asked to remain anonymous told me that, over time, it became increasingly clear “that the project was actually a State Department-connected initiative that planned to wield open source Internet projects made by hacker communities as tools for American foreign policy goals”—including by empowering “activists [and] parties opposed to governments that the USA doesn’t like.” Whatever the merits of such efforts, the claim—if true—suggests a government involvement with Signal that deserves more scrutiny.

The other potential problem is the Signal Foundation’s current chairman of the board, Katherine Maher, who started her career as a U.S.-backed agent of regime change. During the Arab Spring period, for instance, Maher ran digital-communications initiatives in the Middle East and North Africa for the National Democratic Institute, a largely government-funded organization that works in concert with American foreign policy campaigns. Maher cultivated relationships with online dissidents and used American technologies to advance the interests of U.S.-supported Color Revolutions abroad.

Maher then became CEO of the Wikimedia Foundation in 2016, and, earlier this year, was named CEO of National Public Radio. At Wikipedia, Maher became a campaigner against “disinformation” and admitted to coordinating online censorship “through conversations with government.” She openly endorsed removing alleged “fascists,” including President Trump, from digital platforms, and described the First Amendment as “the number one challenge” to eliminating “bad information.”

According to the insider, a woman named Meredith Whittaker, who became president of the Signal Foundation in 2022, recruited Maher to become board chair because of their mutual connections to OTF, where Maher also serves as an advisor, and to nonprofits such as Access Now, which “defends and extends the digital rights of users at risk around the world,” including in the Middle East and North Africa. Whittaker, like Maher, is highly ideological. She previously worked in a high position at Google and organized left-wing campaigns within the company, culminating in the 2018 “Google Walkout,” which demanded MeToo-style sexual harassment policies and the hiring of a chief diversity officer.

So what does all this mean for American users—including conservative dissidents—who believe that Signal is a secure application for communication? It means that they should be cautious. “Maher’s presence on the board of Signal is alarming,” says national security analyst J. Michael Waller. “It makes sense that a Color Revolutionary like Maher would have interest in Signal as a secure means of communicating,” he says, but her past support for censorship and apparent intelligence connections raise doubts about Signal’s trustworthiness. David Heinemeier Hansson, creator of the popular Ruby on Rails web-development framework, agrees, saying that it had “suddenly become materially harder” to trust the Signal Foundation under Maher’s board leadership.

For those who believe in a free and open Internet, Maher’s Signal role should be a flashing warning sign. As she once explained, she abandoned the mission of a free and open Internet at Wikipedia, because those principles recapitulated a “white male Westernized construct” and “did not end up living into the intentionality of what openness can be.” The better path, in her view, is managed opinion, using, alternately, censorship and promotion of dissent—depending on context and goal—as the essential methods.

We’re entering a dangerous period in political technology, and Maher is in the thick of it. Under her ideology, “Internet freedom” is a tactic, not a principle, and “fighting disinformation” means speech suppression, including here at home. When people tell you who they are, believe them.
 
Signal is open-source, it's not like some wine mom on the board is going to tamper with it behind the scenes.

That aside: yes, secure communication methods often are government-funded, because the glowies also want to be able to glow privately when they're running their gayops. Tor is heavily government-funded too. But if anything, it helps that the government can't burn you without poking holes in their own security at the same time.
 
Signal is open-source, it's not like some wine mom on the board is going to tamper with it behind the scenes.
On his channel, Telegram founder Pavel Durov claimed that although Signal claims to be open source, there's no proof that the open source code they say they're using is the same code that's used in the app.

I'm probably saying that wrong. But it's the digital equivalent of saying, "this is vegan," when it contains egg and is cooked in bacon grease. You'd never know, but it's not what it's claimed to be.
 
On his channel, Telegram founder Pavel Durov claimed that although Signal claims to be open source, there's no proof that the open source code they say they're using is the same code that's used in the app.

I'm probably saying that wrong. But it's the digital equivalent of saying, "this is vegan," when it contains egg and is cooked in bacon grease. You'd never know, but it's not what it's claimed to be.
Open Sores also doesn't mean that every bit of code is being meticulously combed over by some nebulous community who will instantly find any backdoors the moment they are inserted.
 
On his channel, Telegram founder Pavel Durov claimed that although Signal claims to be open source, there's no proof that the open source code they say they're using is the same code that's used in the app.
Can't you build your own app with the code?

Obviously very few people do so, everyone else would be easy prey for the glowies, and the ones who do would highlight themselves as persons of interest. And you can never check which server software they run. But I don't see why end-to-end can't possibly be secure.
 
On his channel, Telegram founder Pavel Durov claimed that although Signal claims to be open source, there's no proof that the open source code they say they're using is the same code that's used in the app.

I'm probably saying that wrong. But it's the digital equivalent of saying, "this is vegan," when it contains egg and is cooked in bacon grease. You'd never know, but it's not what it's claimed to be.
It's a fair point. If you're using Signal for legit nation state tier purposes, you're going to want to build it yourself and install it manually. Likewise you're also going to want to commission a formal audit of the code and encryption algorithms.

But it's still a good basis to start from.
 
Likewise you're also going to want to commission a formal audit of the code and encryption algorithms.
Apparently they haven't audited Signal for over 10 years.

Here's a local archive of his post:
🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷

🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺

🕵️‍♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡

🕵️‍♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤

🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪
 
Can't you build your own app with the code?
Yeah and there are forked versions of the Signal client that work. The issue with Signal and FOSS came about in 2021 when they failed to update their repo for a long ass time and everyone freaked out https://github.com/signalapp/Signal-Android/issues/11101

This does point to an issue of the public repo not tracking their internal repo and there's basically no way to know what you see in there is what is being shipped via Google Play or whatever.

My sense is that Signal has stagnated, a lot of their momentum lost as they fuck around with useless features nobody asked for, such as the shitcoin integration called MobileCoin, while dropping useful features like SMS support. After years of complaining they just added username support a few months ago but they still require you to register with a phone number.
 
According to the insider, a woman named Meredith Whittaker, who became president of the Signal Foundation in 2022, recruited Maher to become board chair because of their mutual connections to OTF, where Maher also serves as an advisor, and to nonprofits such as Access Now, which “defends and extends the digital rights of users at risk around the world,” including in the Middle East and North Africa. Whittaker, like Maher, is highly ideological. She previously worked in a high position at Google and organized left-wing campaigns within the company, culminating in the 2018 “Google Walkout,” which demanded MeToo-style sexual harassment policies and the hiring of a chief diversity officer.

So what does all this mean for American users—including conservative dissidents—who believe that Signal is a secure application for communication? It means that they should be cautious. “Maher’s presence on the board of Signal is alarming,” says national security analyst J. Michael Waller. “It makes sense that a Color Revolutionary like Maher would have interest in Signal as a secure means of communicating,” he says, but her past support for censorship and apparent intelligence connections raise doubts about Signal’s trustworthiness. David Heinemeier Hansson, creator of the popular Ruby on Rails web-development framework, agrees, saying that it had “suddenly become materially harder” to trust the Signal Foundation under Maher’s board leadership.

For those who believe in a free and open Internet, Maher’s Signal role should be a flashing warning sign. As she once explained, she abandoned the mission of a free and open Internet at Wikipedia, because those principles recapitulated a “white male Westernized construct” and “did not end up living into the intentionality of what openness can be.” The better path, in her view, is managed opinion, using, alternately, censorship and promotion of dissent—depending on context and goal—as the essential methods.


These parts are what worries me here. As we've seen with these types of opinions before.. There is no room for context, they are almost certainly believers in these efforts across the board. Which will almost certainly lead to under the radar crap at the very least.

This is how activists capture organizations and companies. A whole world of people to hire but they all seem to pick the very worst! Bring in one and they instantly start multiplying.
 
She openly endorsed removing alleged “fascists,” including President Trump, from digital platforms, and described the First Amendment as “the number one challenge” to eliminating “bad information.”
It's like if Vaush had any power or influence anywhere that mattered.
As she once explained, she abandoned the mission of a free and open Internet at Wikipedia, because those principles recapitulated a “white male Westernized construct”
I guess she's not the only one at Wikipedo not dedicated to just the facts.
 
Uh-oh Signal bros, I don't feel so good:
signal1.pngsignal2.pngsignal3.png
source (a), source (a), source (a)

This flaw has been known about for YEARS (since 2018).

Signal Desktop Leaves Message Decryption Key in Plain Sight

(archive)

TL;DR: The desktop version of Signal is not secure against a PC compromise. The phone version is still secure even if your phone is compromised.
 
This design flaw is so severe that there's not much anyone can say that will convince me this is anything but intentional.

So all you have to do is copy the Signal directories, and you have access to the user's entire message history... AND can impersonate them?

Common sense would dictate that you need to tie the Signal key derivation function to the device and to the user
.

Even something as simple as hashing a system fingerprint into the asymmetric key generation process would make this impossible. Attaching Signal to the TPM would be another solution. Even requiring a fucking PIN every time the app starts that is part of key derivation at would solve this.

There are dozens of easy solutions here.

This flaw means that everything needed to describe and decrypt Signal messages is already present on the disk and is susceptible to cloning.

This is kind of like a replay attack, which was already well known in the 1990s but is even more retarded.

The fact that a security hole this severe has been sitting there for years is incredible to me.

Reminds me of the Microsoft NSA collaboration or _NSAKEY scandals in Windows, the NETSEC backdoor in NetBSD, or the CIA Vault 13 leaks.

Cui bono?
 
Last edited:
This design flaw is so severe that there's not much anyone can say that will convince me this is anything but intentional.

Common sense would dictate that you need to tie the Signal key derivation function to the device.

Even something as simple as hashing a system fingerprint into the asymmetric key process would make this impossible. Attaching Signal to the TPM would be another solution. There are dozens of easy solutions here.

The fact that a security hole this severe has been sitting there for years is incredible to me.

Reminds me of the Microsoft NSA collaboration or _NSAKEY scandals in Windows, the NETSEC backdoor in NetBSD, or the CIA Vault 13 leaks.

Cui bono?
My nigger its an encrypted messenger created using money from the State Department. What else is there to say?
 
Uh-oh Signal bros, I don't feel so good:
It's silly they make zero attempt to protect against this, but most applications don't protect against their application data getting copied to a new system. e.g. Telegram doesn't, I've reinstalled Windows so many times and every time I just copy the application data and Telegram doesn't bat an eyelid.

Really just shows Signal is a chat app pretending to be for secure messaging.
 
It's silly they make zero attempt to protect against this, but most applications don't protect against their application data getting copied to a new system. e.g. Telegram doesn't, I've reinstalled Windows so many times and every time I just copy the application data and Telegram doesn't bat an eyelid.

Really just shows Signal is a chat app pretending to be for secure messaging.
This is only true if you share the same machine ID in Windows (same thing a device product key is checked against on a new Windows install). If you copy the app data to a different machine, it will not work. I've tested as much myself (plus there was a 3rd party security audit which found the same thing).

On topic though, LMAO. You can't tell me this is a serious piece of software. There isn't even attempted obfuscation the shoddy crapware cleaners usually do. Guess they could've gone for the "Security in plain sight" concept. Although I remember reading blog posts from Signal marketing it mostly as a phone app, so the Desktop one was likely an afterthought.
 
But if anything, it helps that the government can't burn you without poking holes in their own security at the same time.
They get too big for their britches and they think they can play both games. Competency crisis, hubris, the eternal reoccurrence of 'security through obscurity', all that, make me wary of trusting they wouldn't shoot themselves in the foot trying to do something clever.
 
My nigger its an encrypted messenger created using money from the State Department. What else is there to say?
No. You are thinking of Tor which was taking large amounts of money from the State Department by 2012. Signal started privately in 2010 but then later took money from another shadowy government sponsored group - the BBG.

Signal was created by whitehat hacker Moxie Marlinspike (former head of Twitter security in the long long ago) back in 2010 when it was a product called TextSecure from Whisper Systems, before it was purchased by Twitter in 2011, and then Marlinspike relaunched TextSecure as Signal from nonprofit Open Whisper in 2013.

After 2013, Open Whisper took funding from the Broadcast Board of Governors (BBG) which is the Feds' official media operations soft-power group, and essentially a CIA front since they also ran CIA operations like Voice of America and Radio Free Europe. (BBG was later restructured and renamed by the 2017 military NDAA).

So different shadowy government money.

It's silly they make zero attempt to protect against this, but most applications don't protect against their application data getting copied to a new system. e.g. Telegram doesn't,

I think it's common knowledge that Telegram is an exploit-ridden pile of shit with closed-source servers.

Signal was advertised and sold to everyone as a high-security open-source software for political dissidents, created by security professionals.... A piece of software that had been refined for well over a decade.

Signal creator Moxie Marlinspike was the discoverer of major SSL protocol vulnerabilities, and even released the famous SSL man-in-the-middle attack tool sslstrip, so Signal had a certain cache with the hacker audience, rightly or wrongly.

The fact that this vulnerability was floating around since 2018, and nothing was done to address it speaks volumes.

Here's what Signal Community Support Manager Joshua Lund wrote in response to the bug being publicized back in 2018...

The core premise of the article is completely mistaken. The database key was never intended to be a secret. At-rest encryption is not something that Signal Desktop is currently trying to provide or has ever claimed to provide. Full-disk encryption can be enabled at the OS level on most desktop platforms.
Source

This is an absolutely ridiculous idea. Even the lowest crypto shitcoin lets you include a password or PIN in the key derivation function.

People have been asking (via formal feature requests) for a way to lock the Signal desktop app for SEVEN YEARS.
 
Last edited:
Back