You Can't Encrypt Your Way Out of Bad OPSEC
What the Signal Scandal Reveals About Real-World Security
I still remember the moment I got my security clearance. I was in my early twenties, fresh-faced, wide-eyed, and within minutes, drilled on operational security like my career (and freedom) depended on it. Because it did. Handling sensitive information isn't just a legal obligation; it's a moral one. And that's why the recent Signal scandal, where U.S. military strike plans in Yemen were accidentally shared with a journalist, hit like a gut punch not because of Signal, but because of how it was used.
In our post-pandemic world of remote work and global tensions, secure communications have never been more important. Government officials, journalists, activists, and everyday citizens rely on encrypted messaging apps, but the recent Signal scandal shows how easily that security can be undermined.
Signalgate: When Secure Messaging Meets Insecure Decision-Making
In March 2025, The Atlantic broke the story: senior Trump officials had used Signal to coordinate military strikes in Yemen. How’d we find out? National Security Adviser Michael Waltz mistakenly included a journalist in the Signal group chat. The chat consisted of several details including strike times, drone schedules, even weather reports. Quite literally the whole playbook.
The Signal app, renowned for its end-to-end encryption, was not at fault. This wasn't a crypto failure. This was human failure. This was a breach of trust and judgment, and it could've been catastrophic had the wrong eyes seen it. So while Signal was secure, the people using it failed to practice basic operational security (OPSEC), leading to a dangerous misconception in modern cybersecurity: if my apps are secure, I am secure.
The Most Secure Messaging Apps of 2025
I often get asked: "What's the most secure messaging app?" I still answer "Signal." But I immediately follow up with: "It's only as secure as the device it's running on."
Here's a list (in no particular order) of the most secure messaging apps in 2025 based on encryption, metadata handling, open-source audits, and protocol maturity:
Signal: Gold standard for encryption. Zero metadata retention. Fully open-source.
Wickr: Metadata shredding, no personal info required, AES-256 with forward secrecy.
Threema: Privacy-first, anonymous IDs, Swiss jurisdiction, open-source since 2020.
Wire: Open-source, Signal-style protocol, some metadata stored for sync.
Element: Decentralized, strong crypto, more setup required for full privacy.
All of these apps are technically secure, and I’d recommend them. But none can protect you from yourself.
The OS is the Real Battlefield
Here's the hard truth: if your device is compromised, the encryption of your messaging app doesn't matter. Attackers don't break encryption, they bypass it.
Mobile attacks rarely focus on cracking the encryption itself. Instead, malicious apps request excessive permissions, then use those to access your messaging data. OS vulnerabilities lead to root access, allowing attackers to see everything you do. Spyware like Pegasus doesn't need to break Signal's encryption, it simply reads messages after they're decrypted on your screen. Even your keyboard can betray you, logging what you type before encryption ever happens.
Desktop endpoint systems face similar threats. Memory-scraping malware reads decrypted messages right from RAM. Screen-capture tools silently record your conversations in real-time. Keyloggers capture your thoughts before they're protected. Supply chain attacks like SolarWinds can deliver trojanized app updates that look legitimate but contain hidden backdoors.
Encryption protects data in transit and at rest. But the moment you read it, type it, or view it? It's fair game if your system is compromised.
When One Platform Fails, They All Do
We tend to treat messaging apps like they're impenetrable, cryptographic fortresses. But attackers aren't climbing the walls. They're walking in the front door through your device.
Take the WhatsApp vulnerability from 2024, where maliciously crafted .lnk shortcut files—disguised as harmless attachments—could execute remote code when opened within WhatsApp Desktop. Even though WhatsApp uses the Signal Protocol for end-to-end encryption, it didn't matter. The issue wasn't with WhatsApp's crypto. It was that the desktop platform it ran on, Windows, was the weak link. The moment a user clicked a poisoned file, attackers had a foothold. Encryption never even got a chance to work.
It's the same pattern we've seen before. EncroChat was a secure phone network that law enforcement bypassed not by breaking the encryption, but by hacking the OS to collect messages before they were encrypted. Pegasus spyware has done the same to heads of state, journalists, and activists, reading encrypted messages by owning the phone itself. And keyloggers and rootkits remain wildly effective against desktops, especially when paired with phishing or poor privilege controls.
Different platforms. Same story: the app is only as secure as the system around it.
The Supply Chain Blindspot
While we focus on hardening our personal devices, many overlook the software supply chain. As discussed a few weeks ago, the SolarWinds attack showed how trusted software updates can become attack vectors. For messaging apps, the threat is equally real—a compromised update server can deliver malicious versions of trusted apps without users ever knowing.
Watch for unexpected app behavior after updates. Set up app-specific notification settings to detect unauthorized changes. Follow official channels to stay aware of security advisories. Remember that trust relationships between vendors and users create opportunities for attackers.
The Psychology of Secure Messaging
We often focus on technical controls while ignoring human psychology. The "Signal scandal" happened because people felt secure using a trusted app, leading to complacency. The feeling of security often leads to riskier behavior where we share more, check less, verify rarely. This false sense of security makes users less vigilant, more likely to overshare, less likely to double-check recipients.
I've seen many people make this mistake repeatedly throughout my career. They use the right tools but forget the right mindset. The secure app becomes a talisman, warding off the need for caution rather than complementing it. Train yourself to pause before sending anything sensitive, regardless of platform. Ask whether this needs to be sent at all. Verify recipients not once but twice.
Practical Steps for Secure Communication
If you're handling sensitive information, protect yourself by hardening your mobile device. Keep your OS and apps updated religiously. Lock down permissions for everything…and I mean everything: camera, microphone, location, storage. Use biometric authentication backed by a strong PIN, not just one or the other. Avoid sideloading apps or using unverified keyboards that could capture everything you type.
For desktops and laptops, full disk encryption isn't optional, it’s a must. Run as a standard user for daily operations, not as an administrator. Enabling memory protections like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) (...you can do this on Windows and macOS), which make it harder for attackers to exploit vulnerabilities. Consider disabling hibernation since memory dumps can leak decrypted content.
Your messaging app itself needs hardening too. Use self-destructing messages for truly sensitive communications. Disable cloud backups that might store message histories unencrypted. Lock the app with a separate PIN from your device. Verify safety numbers or security keys with trusted contacts in person whenever possible.
For truly sensitive communications like military operations or critical infrastructure, consider air-gapped devices that never connect to the internet. No messaging app, no matter how secure, can protect against network-based threats if your device is constantly online.
And handle sensitive communications in secure environments. Not in airport lounges. Not on jailbroken phones. Not from your gaming laptop with dubious software installed. Context matters as much as tools.
Where do we go from here?
Look, I'm not trying to rain on anyone's encryption parade here. Signal, Wickr, and the rest are fantastic tools. I use them daily and you should too. They're the best defense we have against mass surveillance and casual eavesdropping. But they're tools, not magic bullets.
Think of secure messaging like a three-legged barstool at your favorite pub. One leg is the app's encryption (pretty solid these days). Another is your device's security (often wobbly). The third is the human element you, me, and that one friend who uses "password123" for everything. If any leg gives way, you're going to spill your drink, no matter how fancy the glass.
The Signal scandal wasn't a crypto failure, it was a people failure. It was someone forgetting to check the recipient list before hitting send. It was the digital equivalent of accidentally CC'ing your boss on an email complaining about your boss. The best locks in the world can't save you if you hand out copies of the key.
So keep using encrypted apps. Just remember that security is a mindset, not just an app download. Patch your devices. Use strong passwords. Triple-check who you're messaging. And maybe don't put the your social security number in a group chat named "Weekend Plans 🚀."
Because at the end of the day, it's not just what you encrypt that matters—it's how you handle it once it's decrypted that counts.
Stay secure and stay curious my friends…and don't forward your war plans to a group chat.
Damien