Category Archives: Privacy_Security _Concerns

Signal 2.8.3 adds video calls and can of worms

By Russ Imrie March 25, 2017

Popular iOS 10+ encrypted messaging app Signal has added Video Calling to its toolkit–and no it’s not THAT bad. The first surprise you’ll see in your contacts (iOS contacts, not those in your signal app) when phone integration is activated is that a “signal” option is listed for contacts with an iPhone number. #1 below. Not to worry too much. Click on one and it doesn’t work unless they are one of your verified real Signal contacts and/or have Signal installed.

But wait, there’s more. Basically, what has happened is that Signal, to maximize convenience and video quality for video calls, has incorporated Apple’s CallKit. This makes various apps like Signal and Skype work better right through the phone app while still using data over your phone carrier, or wifi.

To quote Signal’s blog info on what this all means…

CallKit is an iOS 10 feature that brings apps like Signal to the same level as the native iOS calling experience. It makes Signal calls answerable with one touch directly from the lock screen, allows initiating Signal calls through the native contacts app, and displays Signal calls in the system’s “recent calls” list.

That “recent calls list” they mention above is the thing. So for the truly paranoid, what that COULD mean is that anyone digging through your unlocked phone can see you made some Signal Calls. There are options that can minimize information revealed then and that comes later. Also what a notification in your lock screen [about an incoming call or message] can reveal also has control options, that is if you have general preferences in iOS set to show notifications or not.

Another phone integration issue is that everything in your phone app is routinely backed up to iCloud. Apple COULD be compelled (or hacked) to reveal your call history, now including Signal’s. You might be ok with that, or not.

The Signal app’s setting panel is accessed by tapping the gear icon which opens the preferences pane, where you can control the new Signal. Privacy, Notifications, and Advanced are what you use.

2. Now, the Biggie: Activate Phone Integration in Privacy settings. Or not. You should turn this off immediately until the following settings are done right. You can turn it on later if you want. Here’s what that option looks like. “Off” pictured.

3. What your notifications can or can’t reveal if activated. Located in Notifications in preferences/settings pane/Background Notifications options.  I want NO information revealed in any notification, just a beep alert.

4. More privacy… I disable screen previews here. Also, and this can affect performance with video, I choose Always Relay via Signal’s proprietary server. Yes traffic is totally encrypted but is routed through the public networks. Signal’s server can be bogged down if you are pushing a video call through it. Your choice.

5. The dreaded “oops”… Clear history Logs will wipe everything in Signal – all your messages and your contacts will look as if they have vanished. But open a new message and there they are (contacts, that is – message are his-to-ry. And seriously, if you are in a bad space and want to totally (and remember Signal doesn’t do caches) kill all old messages, this is the one.

Require Approval is good – if for some reason one of your contacts deletes and re-installs the app. This makes absolutely sure you are not being pranked and the contact is genuine.

Questions? Suggestions? Stuff I missed? Send me what you think in the comments box below.

Now, if you want, go back and activate phone integration 

Russell Imrie is a  Networking and Content Specialist, craft beer enthusiast, webmaster and an American Indian blogger living in the Washington DC area. For a decade Imrie built systems and lived totally off the grid in the Santa Cruz Mountains of California near Silicon Valley. More opinion pieces are at China Daily Mail (under nom de blog supTweet)

Copyright Russell Imrie 2017