In a blog post published on Halloween, Open Whisper Systems, the developers of the free and open source Signal encrypted communications app, announced that they had released a new standalone desktop version of their app for Linux, Mac OS X, and Microsoft Windows. Signal is largely used on mobile devices, however the release of the new Signal Desktop app is not the first time that Open Whisper Systems made their powerful end-to-end encrypted communications app available to people who use desktop and laptop computers. Prior to the launch of the new standalone Signal desktop app Open Whisper Systems enabled people to login and use their Signal account on their computer by downloading an app for Google Chrome and other Chromium based web browsers. The Chrome app, called Signal Private Messenger in the Chrome Web Store, is now considered to be deprecated. The catalyst for ending development of the Signal Chrome App and instead turning it into a standalone app was Google’s announcement last year that they were going to phase out all Chrome apps over a two year period. To help transition to the new Signal Desktop, users are able to import data that has been exported from the Signal Chrome app.
As DeepDotWeb concluded in a review of secure messaging apps from last year, Signal is an excellent choice for users who want to protect the content of their communications. Signal makes using effective encryption so simple that anyone who can use a phone can use Signal. Signal’s source code has been independently audited, and even NSA whistleblower Edward Snowden encourages people to use it. Early last month after a gag order was lifted, Signal was able to reveal that they were subpoenaed by a federal grand jury, which was requesting information on two Signal users. The company proved they do not store data on users, other than the date that a user registers with Signal and the last date they used Signal.
Both the new Signal Desktop app and the earlier Signal Chrome app required users to first create a Signal account by using a phone number that they have access to for verification purposes. The Android version of the mobile Signal app can be found on the Google Play Store, and the version for Apple’s iOS can be found on the iPhone’s App Store. Alternatively, Android users can download the app from Signal’s website and then verify that the APK file signing certificate matches the SHA256 fingerprint on the website, however Open Whisper Systems tells users that the safest and easiest way to install Signal on Android is to obtain it from the Google Play Store. Because all of the source code to all versions of Signals apps are free and open source, users are also free to build Signal from the source code. Signal makes their source code available through their repository on GitHub. To verify a phone number and register it as your Signal number, the mobile Signal app can either send you an SMS text message with a verification code, or it can make an automated phone call and read the verification code to you. Verification by phone call enables a user to create an account using the number of a landline.
To download Open Whisper Systems new standalone Signal Desktop app, go to https://signal.org/download/ and download the version of Signal Desktop that is compatible with your operating system. If you are serious about ensuring your privacy and security, and seeing as you are reading this you probably are, you might want to make sure you encrypt the drive or directory that you store and run Signal Desktop from, or alternatively store and run the app from within an encrypted container using software such as VeraCrypt. By encrypting you are making it difficult, if not very impractical, to get access to the app data and conversations. The Android version of Signal includes the ability to enable a lock screen on the app that requires a password to see the messages. Curiously this feature is absent from the iOS version of Signal, but the developers argue that it isn’t a big deal because iPhone’s are encrypted and use a password protected lock screen by default, whereas in many versions of Android, encryption is not enabled by default. The Signal Desktop app, like the iOS app, does not include the ability to enable a password protected lock screen. So it is important to make sure your operating system has a password protected lock screen enabled to further protect the content of your communications on Signal Desktop.
To add your Signal account to your computer open the Signal Desktop app, then at the same time open the mobile Signal app, tap on the button at the top right that displays 3 vertical dots, and then tap on Settings, tap on Linked Devices which you’ll find near the bottom of the screen, and finally tap on the + symbol at the bottom right of the screen. You can now link your account to your computer by pointing your mobile device’s camera at the QR code that is being displayed by Signal Desktop on the computer’s screen.
Signal Desktop, like its Chrome app predecessor, does not have all of the same features as the mobile versions of Signal. You cannot make video calls or phone calls with Signal Desktop, however users are able to easily record and send short audio messages from within the app. The user selects a contact or group chat they want to send an audio message to and then clicks on the button with the microphone icon located on the right side of the text box. To import all contacts and group chats from the mobile Signal app into Signal Desktop, click on the icon of the 3 vertical dots on the desktop app near the top left of the screen, this brings up a menu where you then click on Settings. Once you’re in the settings, near the bottom of the app, under Contacts, click on Import now, and all contacts and chats from your mobile device will be synced to your computer. The desktop version also retains the ability to enable and disable disappearing messages, allowing users to set the timer for how long they want the messages in each chat to be visible for once they are received and read. Users can also choose what kind of notifications are displayed, or disable notifications altogether.
Early last month Signal was updated to include optional read receipts that let the people you’re chatting with know if the message has been read. This month the mobile versions of Signal were updated to include expanded animated GIF searches. Another feature that is being developed for Signal is the ability to recognize which people in your phone’s address book are Signal users without disclosing the phone numbers to Signal. Currently, SHA256 hashes of each phone number in your address book are sent to Signal to determine which of your contacts uses Signal. The developers hope to find a more private and secure way of identifying contacts who use Signal.
Be sure to check out DeepDotWeb tips on how to securely use the mobile versions of Signal.