Signal version 8.30 finalizes the deployment of its secure backup feature across Android, iOS, Linux, macOS, and Windows. Users can create end-to-end encrypted backups either hosted by Signal or stored locally on their devices. Hosted backups have size limits and use a supplemental rotating key inside a Trusted Execution Environment for forward secrecy, while local backups have no size restrictions but rely on a single recovery key that can decrypt all past backups. The update adds local encrypted backups to iOS and desktop apps and standardizes Android backups to the same format. Media files are stored separately to avoid duplication, and paying users can purge old media locally while retaining thumbnails. Disappearing messages set to vanish within 24 hours are excluded from backups. The iOS app now supports direct encrypted transfers between iPhones using Wi-Fi Aware. Signal engineers will now focus on improving other systems beyond backups.

The feature enhances user data protection by enabling encrypted backups that require a recovery key for decryption, reducing risk of unauthorized access to chat histories. The use of a rotating supplemental key for hosted backups adds forward secrecy. However, the recovery key for local backups can decrypt all past backups, making it a valuable target for threat actors. The exclusion of disappearing messages set to vanish within 24 hours prevents their inclusion in backups, preserving intended message ephemerality. The update improves backup reliability and efficiency across platforms. There are no reports of active exploitation or vulnerabilities associated with this feature as of the information provided.

No specific vulnerability or exploit is reported in this update. Users should securely store their backup recovery keys to prevent unauthorized access to their encrypted backups. Since this is a new feature rollout, users should follow Signal's official guidance on backup creation and recovery. There is no indication of required patches or fixes related to security issues in this release.