Problem with private messenger apps on phones. Why you should NOT use " Signal " app

TG1 · Nov 28, 2015

I’ve had a few people message me recently and asking about private messenger applications for smart phones. As I have always stated before the most trusted app is Wickr. Now a new one has come on the field called Signal and its cause for some concern.

Signal Private Messenger is from Open Whisper Systems. The background behind the company was the developer had multiple smart phones taken at the airport so he decided to create a fully encrypted phone. He wrote the program for the Nexus One (at the time guessing its what he was using) and developed 2 apps called Silent Text and Redphone. Both were extremely good apps and were praised in the community (which was alot smaller years ago) until… he got bought out. No one really knew who bought out the company but support for both apps stopped.

My personal belief is a secure messenger app should have as little information about you (the user) as possible. It does need access to your location, to change things, etc. SO a quick download of the apps and lets look at both apps. What do using the apps give them access to?

Wickr.
Permissions for Wickr are as follows:

Read phone status and identity
Code:
```
take pictures and videos
```
Code:
```
record audio
```
Code:
```
read your contacts
```

Code:

modify or delete contents of USB storage

Code:
```
find accounts on the device
```

Code:

full network access- receive data from internet and view network connections

Code:
```
run at startup
```

Code:

control vibration- prevent phone from sleeping

Ok, so not too bad. It doesnt want your location at all. Because why would it need it??

Now lets look at Signal Private Messenger
Permissions for Signal are as follows:

Directly call phone numbers
Code:
```
read phone status and identity
```
Code:
```
reroute outgoing calls
```
Code:
```
edit your text messages
```
Code:
```
read your text messages
```
Code:
```
receive text messages
```
Code:
```
send sms messages
```
Code:
```
take pictures and videos
```
Code:
```
record audio
```
Code:
```
approximate location (network-based)
```

Code:

precise location (GPS and Network based)

Code:
```
modify your contacts
```
Code:
```
read call log
```
Code:
```
read your contacts
```
Code:
```
write call log
```

Code:

add or modify calendar events and send email to guests without owners knowledge

Code:
```
modify your own contact card
```

Code:

read calendar events plus confidential information

Code:
```
read your own contact card
```

Code:

modify or delete the contents of your USB storage

Code:
```
read the contents of your USB storage
```
Code:
```
disable your screen lock
```
Code:
```
create accounts and set passwords
```
Code:
```
find accounts on this device
```
Code:
```
use accounts on this device
```
Code:
```
change network connectivity
```
Code:
```
connect and disconnect from wifi
```
Code:
```
full network access
```
Code:
```
receive data from internet
```
Code:
```
view network connections
```
Code:
```
view wifi connections
```
Code:
```
pair with bluetooth devices
```
Code:
```
run at startup
```

Code:

control vibration- prevent phone from sleeping

Code:
```
set wallpaper
```
Code:
```
change your audio settings
```
Code:
```
read sync settings
```
Code:
```
toggle sync on and off
```
Code:
```
send sticky broadcast
```

So signal requires access to a multitude of things it has no reason to access. How secure is it to entrust secure private messages and information on your phone to a company that is trying to market itself to people that want safer and more secure communication. Red flags should go off on why this app would need this info. To check any app go to your phone settings, go to application manager, and go the app you want, click on it and read the full list of permissions that app is using.

Problem with private messenger apps on phones. Why you should NOT use " Signal " app

TG1