This means that if the server is compromised or goes rogue (which can easily be achieved by a government serving Signal a subpoena or the like), then it can easily modify the javascript files served to the client in a way that allows them to intercept the communications.

However, the larger problem here is that the SSL connection, as well as the content being served, is controlled by the Signal server. However, in such a case, the employer owns the machine and would probably just install a keylogger on it, so you would have bigger problems. Well, if a (possibly state-level) attacker controls/compromises a CA, they could issue a fraudulent certificate for the Signal server and attempt to MitM the SSL connection (this threat is limited, but not eliminated, by the use of certificate transparency.) As pointed out, TLS inspection proxies at workplaces are a much more likely form of MiTM and could cause problems if your employer was interested in compromising your private conversation. So who exactly can control the SSL connection? Which means that anyone who can control the SSL connection to the server can now intercept and eavesdrop on your e2ee communications. This effectively reduces the security of your end-to-end encrypted communication to that of your SSL connection to the server The thread doesn't say that the web app will be completely insecure, instead it says You can send messages, exchange files, voice notes, etc using the Signal desktop app.Yes HTTPS is used. Step 7: You can now select a name for your linked device on your phone.Īfter completing the above setup, you will start receiving messages on the Signal desktop app. Step 6: Then, tap the ‘plus’ sign on your Android phone or ‘link new device’ on the iPhone. Step 5: In order to scan the QR code, go to the setting of Signal and then tap on ‘linked devices’. Step 4: After installation, connect Signal Desktop with your phone by scanning the QR code shown on the screen of your laptop or PC. If you are installing on macOS, you need to move Signal to your Applications folder.įor Linux, follow on-screen instructions to install the Signal. Step 3: Follow the on-screen instructions to download the app on your Windows laptop or PC. Step 2: Then, install the Signal Desktop on your computer or PC.

Signal messenger web client