Loading story…
Signal has added Automatic Key Verification to help users detect server-side key substitution and other man-in-the-middle risks in one-to-one chats. The feature uses key transparency so Signal clients can periodically confirm that the public keys tied to an account are globally consistent and actually belong to that user’s devices, warning users if verification fails. Trail of Bits said it built and operates one of three external auditors for the system, alongside Signal and Cloudflare, with each auditor maintaining a local Merkle-tree copy of the key map and signing consistent tree heads so clients can detect split-view behavior from a malicious server.
The new mechanism complements Signal’s existing safety number protections rather than replacing them. Safety numbers remain unique to each one-to-one conversation and are used to manually verify end-to-end encryption, with Signal alerting users when a number changes—most often after a contact changes phones or reinstalls the app—and requiring approval before new messages are sent. Signal clients reportedly require recent signatures from all three auditors within seven days, limiting how long a compromised or malicious server could hide an inconsistent key view, and users are advised to fall back to manual safety number comparison if automatic verification does not succeed.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Trail of Bits disclosed how its auditor works, including that clients require signatures from all three auditors within the last seven days and that a fully malicious server could hide an inconsistent view for at most about one week before warnings appear. The post also published the auditor's current public key and noted the code is open source.
Signal announced a redesign of its verification system that replaced older per-user fingerprint comparisons with per-conversation safety numbers using localized numeric encoding and simpler QR-based verification. In the same release, Signal removed embedded user identifiers from QR codes after recognizing that some users had exposed phone numbers by publicly sharing screenshots, and added an optional advisory mode for safety number changes.
Trail of Bits built and operates one of the three external auditors used by Signal's Automatic Key Verification system. Its independently implemented auditor maintains a local Merkle-tree copy of the key map and signs consistent tree heads so clients can detect split-view behavior.
Signal introduced Automatic Key Verification as an alternative to manual safety number comparison, using key transparency to detect server-side key substitution and other hidden inconsistencies. The system relies on three auditors—Signal, Cloudflare, and Trail of Bits—and warns users if verification fails.
Signal's support documentation explains that each one-to-one chat has a unique safety number used to verify the security of messages and calls, and that users are alerted when a safety number changes. The guidance says changes commonly occur after a contact switches phones or reinstalls the app, and recommends manual comparison for sensitive conversations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceblog.trailofbits.com
Open sourcesignal.org
Open sourcesignal.org
Open sourcesupport.signal.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp has begun a limited beta rollout of **Scam Alert**, an optional feature that uses on-device machine learning to flag likely scam messages from non-contacts while preserving end-to-end encryption. Users can decide whether to block, report, continue, or trust a flagged conversation, and can review Scam Alert activity in the app. WhatsApp said message content does not leave the device for classification, and the company has expanded its bug bounty program to cover the new feature, including its model weights and analytics pipeline. To reduce privacy risks and targeted manipulation, WhatsApp said it verifies model releases through a transparency process that publishes each version’s `SHA-256` hash to a third-party append-only ledger before deployment, while model downloads are routed through OHTTP relays with anonymous credentials. The company also said it measures effectiveness through a confidential federated analytics pipeline using Trusted Execution Environments, anonymous aggregation, and differential privacy, and may let users optionally share the last five messages from trusted chats to improve model accuracy. The rollout comes as Signal has also introduced automatic key verification based on key transparency logs and independent auditing to detect unauthorized public key changes in encrypted conversations.
Aug 19, 2026
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
A recent independent study by Incogni evaluated the privacy practices of major messaging apps, ranking platforms such as Discord, Telegram, Snapchat, Facebook Messenger, and WhatsApp based on 18 privacy criteria. The study highlighted that while Discord scored highest for privacy overall, the rankings can shift depending on which criteria are prioritized, and users are cautioned not to make decisions based solely on aggregate scores. The analysis emphasized the importance of understanding how messaging apps handle user data, respond to law enforcement requests, and protect against social engineering attacks. In parallel, Meta has introduced new anti-scam features for WhatsApp and Messenger to bolster user security. These updates include advanced scam-detection tools in Messenger that warn users about suspicious chats and allow for AI-based scam reviews, as well as new warnings in WhatsApp to prevent users from sharing their screens with untrusted contacts. Additional features notify users when they are contacted by unknown individuals or added to group chats by strangers, providing context and safety tips to help users avoid scams. These developments reflect a broader industry trend toward improving both privacy and security in messaging platforms.
Jul 12, 2026