Signal rolls out automatic key verification against man-in-the-middle attacks

Signal has introduced a new security feature — Automatic Key Verification — that gives users an additional way to make sure their encrypted conversations haven't been intercepted.

The feature is part of a “key transparency” system. In it, Cloudflare and Trail of Bits act as independent, trusted auditors: they help verify the integrity of conversations in Signal.

How it works

According to Signal engineer Katherine Yen, the checks are carried out jointly by the user, their contacts and third-party auditors. Together, this provides the same guarantee as manually comparing safety numbers, but unlike that method it requires neither an in-person meeting nor a separate communication channel.

The system guarantees that the link between a phone number (or username) and its public encryption key stays consistent and transparent for everyone in the Signal ecosystem. This protects against scenarios where a key is swapped out without the owner's knowledge — for example, if an attacker compromises Signal itself and attaches someone else's key to your contact's number.

You can enable the feature under “Settings → Privacy → Advanced” by toggling the Automatic Key Verification switch. You can also verify a contact's public key right from the safety number comparison screen by tapping “Verify automatically”: on a successful check, the app shows a green checkmark and the message “Encryption verified.”

Those who don't want to rely on either Signal or third-party auditors can turn the feature off and keep using the familiar manual comparison of safety numbers. The company stresses that the new check complements the previous system rather than replacing it.

Against a backdrop of attacks on users

The change continues a string of security measures. In May, Signal added warnings and in-app confirmations that give users time to assess the safety of external requests — as protection against phishing and social engineering. The move was prompted by attacks attributed to Russian state-sponsored hackers: disguised as fake “Signal Support” notifications, victims were tricked into linking a third-party device via the Linked Device feature, giving the attackers access to the account, chats and contact list. These campaigns were reported by the FBI as well as the German and Dutch authorities.

A month later, the U.S. State Department announced a reward of up to $10 million for information helping to identify or locate members of the hacking groups UNC5792 and UNC4221, linked to large-scale phishing campaigns against Signal users.

Source: Bleeping Computer