LastPsyOp: Read the Full Brief
Objectives
- State what Signal holds and what it does not
- Name the four things end-to-end encryption does not protect
Lesson
Signal is run by a nonprofit foundation, encrypts everything by default, and publishes what it can produce under legal process: the date an account was created and the date it last connected. That is the list. Not content, not contacts, not group membership, not profile data — because it does not hold them. That is a fact about the design rather than a promise about behavior, which is the distinction worth teaching.
The comparisons matter because the defaults differ. WhatsApp encrypts content by default and keeps a substantial record around it: numbers, who messaged whom and when, devices, groups.
iMessage encrypts between Apple devices, but the standard iCloud backup is encrypted with a key Apple holds and can therefore be produced. Advanced Data Protection closes that, and it is off unless you turn it on. Telegram is the one people get wrong: ordinary chats, including every group, are not end-to-end encrypted; only opt-in Secret Chats are, and those are one-to-one and device-bound.
Plain SMS is not encrypted. RCS is the successor carriers are using. A cross-platform encryption standard was agreed in March 2025 and was still rolling out in 2026. Check what your own devices negotiate.
Then the limits, which are more important than the comparison. A compromised device beats all of it: the message is decrypted on the screen at both ends, and anything with access to that screen reads it. The other participant is not a protocol — they can screenshot, forward, or tell someone.
An unencrypted cloud backup of an encrypted chat is the whole chat, held by somebody else, and one participant's backup setting exposes both sides. And metadata is content: who, when, how often and from where is frequently more revealing than the words.
The features worth using: verify safety numbers with the two or three people who matter, turn on the registration lock so that taking over your phone number does not take over your account, and decide deliberately about backups rather than by default. Disappearing messages are useful and are not a control over the other person.