Hackers who previously targeted Uyghurs evaded Google Play security checks to push a fake Signal app for Android. It uses a never previously-documented method to spy on the encrypted comms tool.

TL;DR: Don't install @signalapp for macOS, it is not secure.

I carried out this small experiment:

- I wrote a simple Python script that copies the directory of Signal's local storage to another location (to mimic a malicious script or app)
- I ran the script…

TeleMessage, a company that makes a modified version of Signal that archives messages for government agencies, was hacked.

Signal (and many other messengers) stores push tokens in their database in plain text. Which allows law enforcement to subpoena them (though signal has never publicly admitted this happening) and then law enforcement uses these push tokens to subpoena apple…