Signal Adds Automatic Key Verification to Protect Encrypted Chats

Summary

Signal’s Automatic Key Verification uses key transparency and independent audits by Cloudflare and Trail of Bits to check that contacts’ phone numbers or usernames match their public keys, complementing manual safety-number checks.

Key points

Automatic Key Verification checks that a phone number or username is consistently associated with the correct public encryption key, helping identify unauthorized key changes.
Signal says the system combines verification by users, their contacts, and independent auditors Cloudflare and Trail of Bits.
Users can enable the feature in Settings > Privacy > Advanced or verify a chat from its safety-number screen.
Successful verification displays a green checkmark and an “Encryption verified” message; users can disable automatic verification and continue checking safety numbers manually.
The feature follows phishing and social-engineering campaigns targeting Signal users. The article says attacks abusing Signal’s Linked Device feature were attributed to Russian state-sponsored hackers by authorities.
The U.S. State Department announced bounties of up to $10 million for information identifying or locating UNC5792 and UNC4221, which it linked to widespread phishing campaigns targeting Signal users.

Article Details

Event Type: Signal launched Automatic Key Verification, a key-transparency security feature for encrypted chats.
Impact: The feature helps users verify that a phone number or username remains associated with the correct public encryption key, reducing the risk of undetected key substitution and man-in-the-middle attacks. It complements manual safety-number checks and follows phishing campaigns targeting Signal users.