Signal's new feature that allows users to store certain data on their servers for recovery purposes has some security experts threatening to stop using the app
The popular encrypted app is now going to store your contacts in the cloud. Experts are worried this compromises users' privacy. Tweets: @abortu , @lorenzofb , @motherboard , and @drfranksauer Tweets: @abortu : @seanodiggity I knew I didn't like that pin crap. Removed signal over it. Now this article. Thoughts? https://www.vice.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : New: Signal is going to store your contacts in the cloud protecting them with a PIN and cybersecurity experts are worried this new feature compromises users' privacy. We break down and explain this debate here. https://www.vice.com/...? @motherboard : The popular encrypted app is now going to store your contacts in the cloud. Experts are worried this compromises users' privacy. https://www.vice.com/... Frank Sauer / @drfranksauer : “The changes Signal has made show how there can be a tension between messenger usability and feature set and security. It's too early to say whether you should stop using the messenger. For most users' threat models, it's still one of the best options.” https://www.vice.com/...
Context & Ripple Effects
Signal built its reputation on storing almost nothing, so a feature that keeps contacts on its servers cuts against its own history: back in 2017, Open Whisper Systems was testing contact scanning with provable deletion from its servers. Since then, a deliberate mainstream push — iPad support, ephemeral media, stickers, reactions — set the stage for the PIN-protected cloud contacts backup that VICE reports drew immediate pushback from security experts like Frank Sauer.
The stakes are timing as much as design. Signal's downloads surged as it became an app of choice for protesters, dissidents, and journalists, and its later post-WhatsApp-exodus growth brought internal staff worries that new features would be misused. For an app whose only product is trust, every server-side retention decision is now scrutinized by exactly the users who vouched for it.
First-order effects
- Security experts are publicly threatening to abandon the app — some say they already deleted Signal over the earlier PIN rollout — turning the recovery feature into a loyalty test for Signal's most credible advocates.
- Users face a direct tradeoff: opt into cloud contacts storage protected by a PIN for account recovery, or keep their contact graph off Signal's servers entirely.
Second-order effects
- As Signal scales beyond its core audience — first protest-driven growth, then the wave of users fleeing WhatsApp's privacy changes — each convenience feature raises the cost of maintaining the minimal-data posture that differentiated it from WhatsApp.
- Rivals and privacy-conscious alternatives gain an opening to court the expert community Signal risks alienating, since these users are the ones who recommend encrypted apps to at-risk populations.
Third-order effects
- If the pattern holds, encrypted messaging splits structurally into two camps: consumer-friendly apps that accept server-side conveniences and metadata tradeoffs, and maximalist tools that refuse them — forcing users to choose which threat model they actually live under.
- Trust itself becomes the contested infrastructure: for apps like Signal, product decisions are no longer just UX choices but credibility liabilities, because the expert community that supplies legitimacy can withdraw it publicly, tweet by tweet.
The trend: Encrypted messaging apps are trading minimal-data purity for mainstream usability, converting every retained byte of user data into a test of the trust that underpins their brand.