Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows).
The feature, introduced on Android nearly a year ago, lets users create end-to-end encrypted backups of their chats and restore them on other devices if they lose their phone.
The backup system supports two options: Signal-hosted backups, limited to 45 days of media and 128 KB per message for free users (100 GB in paid plans), and on-device, local backups, with no size restrictions.
Backups for both options are encrypted and require a recovery key to decrypt, but hosted backups also have a supplemental key that rotates daily inside a Trusted Execution Environment for additional protection and forward secrecy.
According to Signal, an on-device backup recovery key can decrypt all past backup files it encrypted, regardless of where they are stored.
Threat actors have already taken notice of the key’s value and incorporated it into their targeting scope shortly after Signal introduced the feature.
The latest update brings on-device backups to iOS and desktop, and revamps Android backups to use the same cross-platform format.
Source: Signal
Now, when linking a new device from the primary device, the new one will retrieve older attachments missing from the chat.
Signal also says that media is now stored separately from the backup archive, and duplicate files are stored only once, eliminating excessive backing up and syncing.
Additionally, paying users will get a new option to purge old media from local storage and keep only thumbnails, while automatically retrieving them in full from hosted backups.
The backup system will ignore ‘disappearing messages’ set to vanish within 24 hours on both backup methods, preventing them from being included in the archive.
For users who take both hosted and on-device backups, it is noted that the former does not wipe the latter. However, during restoration, expired disappearing messages from local backups will be skipped.
The 8.30 iOS client release enables direct iPhone-to-iPhone transfer, using a local end-to-end encrypted Wi-Fi Aware link that Signal says improves speed and reliability.
Signal says this rollout completes its first phase of the backups project, and its engineers will now focus on improving non-backup systems.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
