Perhaps Signal’s most well-touted security and privacy feature is its ability to set disappearing messages. Messages can be set to expire in periods ranging from seconds to weeks. A default expiration time for all messages can be selected, and specific groups and conversations can be set to custom retention times. To minimize risk, set retention times to the shortest amount feasible — minutes or hours, instead of days or weeks.
Signal’s disappearing messages don’t remove evidence that communications between parties occurred in the first place.
Keep in mind that Signal’s disappearing messages delete the contents of a message, but they don’t remove evidence that communications between parties occurred in the first place. This means that even if a group has enabled disappearing messages, someone who gains access to a member’s device could later determine with whom they were chatting. Therefore it’s safest to regularly delete entire groups and chats, not just the messages themselves.
Переведу на человеческий: если кто-то (в данном случае американские силовики) получит физический доступ к телефону с установленным Сигналом, то этот кто-то сможет установить факт коммуникаций (содержимое коммуникаций останется недоступным). Даже в группах и в чатах, где установлены сгорающие сообщения. Повторюсь: факт коммуникаций, а не содержимое этих коммуникаций.
А вот способы защиты (я уверен, что сам Сигнал зачистит эту багу сам):
On iPhones, Signal can integrate its call history into the iPhone’s regular call history. This privacy-eroding feature can be disabled on Signal on iOS by tapping your profile circle on the top-left corner of the app, clicking on Settings, then Privacy, then disabling “Show Calls in Recents.”
Additionally for Signal on iPhones, you’ll also likely want to disable settings like “Share Contacts with iOS” and “Use Phone Contact Photos” (for Android users, the equivalent is “Use address book photos”), which can be found under Settings, then Chats.
Such precautions may sound extreme, but in a recent case, authorities were able to recover deleted incoming Signal messages based on old push notifications that were archived on iPhones (the latest iPhone update fixes this issue, highlighting the importance of keeping your devices up to date). On that note, remember to either turn off Signal notifications entirely or have them display only the names of people sending messages — which should be pseudonyms, not real names.
Ну и линк на саму статью - без пейвола.