NewsPublished 12 Aug 2026

Signal adds new security feature to thwart man-in-the-middle attacks

Source Bleeping Computer

Description

Signal has introduced Automatic Key Verification, a new security feature designed to help users ensure their encrypted chats have not been intercepted by man-in-the-middle attackers. This feature is part of a key transparency system that leverages independent third-party auditors to verify the integrity of Signal conversations. It automates the verification of public encryption keys without requiring manual safety number checks or in-person meetings. Users can enable or disable this feature in the app settings. This enhancement complements Signal's existing safety number system and aims to protect against key substitution attacks. The feature is a proactive security improvement rather than a response to a specific vulnerability or exploit.

Impact

The feature reduces the risk of man-in-the-middle attacks by ensuring that encryption keys are consistent and have not been maliciously replaced. It strengthens the integrity of Signal's end-to-end encryption by providing automated, transparent verification of public keys. This mitigates the risk of attackers intercepting or altering encrypted communications without detection. However, this is a security enhancement feature rather than a vulnerability or exploit, so it does not represent an active threat but rather an improvement in security posture.

Defensive guidance

Users should enable Automatic Key Verification in Signal's privacy settings to benefit from automated key integrity checks. This feature complements existing manual safety number verification and does not require additional action beyond enabling it. Users who prefer can continue to use manual verification. No urgent remediation or patching is required as this is a new security feature, not a vulnerability. Signal manages this feature within the app, and no external patching is necessary.

Summary

Signal's Automatic Key Verification introduces a key transparency mechanism involving Cloudflare and Trail of Bits as trusted third-party auditors to independently verify the association between a user's phone number or username and their public encryption key. This system ensures global consistency and transparency of encryption keys across the Signal ecosystem, preventing scenarios where a malicious actor could swap keys without the owner's knowledge. Verification is performed automatically and independently by the user, their contacts, and auditors, providing assurance equivalent to manual safety number verification but without requiring secondary communication channels. Users retain the option to disable this feature and continue manual verification. This feature enhances Signal's defense against man-in-the-middle attacks by improving key integrity verification.

References

bleepingcomputer.com/news/security/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Aug 2026, 11:41 UTC

References

Community reviews