Post B45YR7jifjXleJDB7Q by scathach@stereophonic.space
 (DIR) More posts by scathach@stereophonic.space
 (DIR) Post #B45UgFAOveU9Dle6ZU by signalapp@mastodon.world
       0 likes, 2 repeats
       
       We are aware of recent reports regarding targeted phishing attacks that have resulted in account takeovers of some Signal users, including government officials and journalists. We take this very seriously.To be clear: Signal’s encryption and infrastructure have not been compromised and remain robust. These attacks were executed via sophisticated phishing campaigns, designed to trick users into sharing information – SMS codes and/or Signal PIN –  to gain access to users’ accounts.
       
 (DIR) Post #B45UgG6tQBH09B0ok4 by signalapp@mastodon.world
       0 likes, 0 repeats
       
       These attacks, like all phishing, rely on social engineering. Attackers impersonate trusted contacts or services (such as the non-existent “Signal Support Bot”) to trick victims into handing over their login credentials or other information. To help prevent this, remember that your Signal SMS verification code is only ever needed when you are first signing up for the Signal app.
       
 (DIR) Post #B45UgGb1c9NNed6si0 by signalapp@mastodon.world
       0 likes, 0 repeats
       
       To protect people from such phishing, Signal actively warns users against sharing their SMS code and PIN. We also want to emphasize that Signal Support will *never* initiate contact via in-app messages, SMS, or social media to ask for your verification code or PIN. If anyone asks for any Signal related code, it is a scam. We make this clear when users receive their SMS code during initial signup.
       
 (DIR) Post #B45UgH3jtOLR5gXoSu by signalapp@mastodon.world
       0 likes, 0 repeats
       
       While we build robust technical safeguards, user vigilance is ultimately the best defense against phishing. We will continue to work on mitigating these risks via interface design and signposting throughout the app. In the meantime, please stay alert, and never share your SMS verification code or Signal PIN with anyone. https://support.signal.org/hc/en-us/articles/9932566320410-Staying-Safe-from-Phishing-Scams-and-Impersonation
       
 (DIR) Post #B45YR7jifjXleJDB7Q by scathach@stereophonic.space
       1 likes, 0 repeats
       
       @signalapp These attacks wouldn't be possible if you stopped requiring phone numbers