We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists.
-
my car is just a few months before ecall was implemented (and it doesn't even work on some cars as 3G got ceased here), and some of the more modern cameras around these days would show I'm obviously driving solo and often at unusual hours of the night.
Although any tracking would also show I take the same route every day between either my home and workplace, or sometimes the coastal town where some of our staff are.
There is /some/ monitoring of social care workers as during Covid there were a few drugdealers pretending to be them (even getting uniforms etc), as well as healthcare workers themselves going rogue (I've noticed our staff are getting more attention from the Police recently, checking their cars are 100% legal)
@vfrmedia I mean in any juristictions it's legal for police to randomly pull over cars, check license & registration and ask for mandatory safety equient like Warning Triangle, First Aid Kit and Retroflective Vest to be presented.
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
- I mean, police do it all the time whenever they feel like it, and whilst theybdon't admit to it, I'm pretty shure they check way more plates than they pull over because they prefer to skip all the uninteresting ones…
- Cuz lets face it: It'll only waste time if they pull over some retirement-aged women who's only negative data on file - a parking ticket in the 1990s - is long expunged from records vs. someone with a decent record driving suspiciously orderly…
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
-
To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN.
We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup.
@signalapp@mastodon.world #Alt4You Better alt-text
A SMS message from Signal, reads:
SIGNAL code: 751912. Do not share this code with anyone. If anyone asks it's a SCAM. Our reps will NEVER ask for it. -
@vfrmedia I mean in any juristictions it's legal for police to randomly pull over cars, check license & registration and ask for mandatory safety equient like Warning Triangle, First Aid Kit and Retroflective Vest to be presented.
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
- I mean, police do it all the time whenever they feel like it, and whilst theybdon't admit to it, I'm pretty shure they check way more plates than they pull over because they prefer to skip all the uninteresting ones…
- Cuz lets face it: It'll only waste time if they pull over some retirement-aged women who's only negative data on file - a parking ticket in the 1990s - is long expunged from records vs. someone with a decent record driving suspiciously orderly…
@kkarhan here they tend to use ANPR hits and sometimes "public concerns" (there's a lot of nosey white folk reporting all the social carers for perceived bad driving simply because the carers are Black and brown)
UK just needs valid inspection record, tax and insurance (which cops can often check via mobile data terminals without going near the car), we aren't required to have the triangle, first aid kit and hi vis (although I carry these things anyway simply as it makes sense to have them)
- And that is being used by the police to both gather intelligence as well as annoy individuals (i.e. motorists joyriding) out of an area.
-
While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone.
@signalapp SMS!?
-
We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.
To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts.
@signalapp it is perfectly clear. RUP to the people who got duped's accounts
-
We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.
To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN – to gain access to users’ accounts.
They also get your phone number, and all the information attached to it.
Do not use Signal, or any other app that demands a phone number.
-
While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone.
@signalapp implementing authentication using more secure methods (passkeys, physical security keys) could eliminate that risk.
-
@ExcelAnalytics @signalapp not only that, the entire concept of demaning a #PhoneNumber to use #Signal is inherently and irredeemably wrong to begin with!
@kkarhan
This has always struck me as the strangest complaint about Signal.You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
-
@kkarhan
This has always struck me as the strangest complaint about Signal.You don't need to distribute your phone number to actually communicate with other signal users.
Presumably you want some form of 2fa, because losing your account would be bad.
And you don't want to be tied to some cloud based email provider.
And it's literally a phone app so every single user has the dependency.
@lackthereof it's not a "strange complaint", but a massive problem, because it creates dependency on a proven insecure network that is more often than not controlled if not run by hostile actors…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
- And if you trust noone, you can just host your eMail Server on a Rasberry Pi at home. It'll certainly be less convenient and more expensive but the you also get all the benefits of it being not possible to seize it without breaking into your home.
@signalapp mandating #PhoneNumners is a huge red flag because at best any #PhoneNumber is pseudonymous like a #Shitcoin-Wallet and that any #privacy is broken the moment it has any (even remotely circumstantial) connection to someone.
- Because even if you ain't forced into #SelfDoxxing to obtain a #Prepaid - #SIM (aka. "#KYC") and/or Phone Number it is still a bad design.
Not to mention #Signal's #App is a huge shitshow…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
-
@lackthereof it's not a "strange complaint", but a massive problem, because it creates dependency on a proven insecure network that is more often than not controlled if not run by hostile actors…
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
- And if you trust noone, you can just host your eMail Server on a Rasberry Pi at home. It'll certainly be less convenient and more expensive but the you also get all the benefits of it being not possible to seize it without breaking into your home.
@signalapp mandating #PhoneNumners is a huge red flag because at best any #PhoneNumber is pseudonymous like a #Shitcoin-Wallet and that any #privacy is broken the moment it has any (even remotely circumstantial) connection to someone.
- Because even if you ain't forced into #SelfDoxxing to obtain a #Prepaid - #SIM (aka. "#KYC") and/or Phone Number it is still a bad design.
Not to mention #Signal's #App is a huge shitshow…
@kkarhan
Email is, in practice, a privacy shit show equal to or greater than phone numbers. Either you self-host, which means you have an isp and a DNS provider at minimum who can reveal your identity on their whims, even if you lie on a whois record. Or you use one of the mega free providers with all their conflicts of interest and data mining. Or you use a paid provider which opens up all the payment chain to trace back to you on top of everything elseTo get a phone number I can walk to the corner convenience store and, with cash payment and no ID, purchase a prepaid SIM card. I can pay cash to refill it every month.
- Also #eMail, like #XMPP+#OMEMO, is based around #OpenStandards so you ain't forced to use any provider that is subject to #CloudAct nor known to snitch on customers without a valid domestic warrant…
-
S strit@mastodon.social shared this topic
