Signal

Since Signal is a centralized permissioned system without self-custody of digital identities, any user can be deplatformed at any time. That's the core reason it is slave tech.

Signal lacks robust metadata protection. Its "sealed sender" is falsely marketed as complete metadata protection, yet it does nothing to hide network-level identifiers like IP addresses and ping or prevent timestamp-based metadata analysis. Additionally, Signal enforces delivery receipts that cannot be disabled (don't confuse with read receipts). This allows trivial sender clustering and identification through a simple analysis, which Tor cannot prevent. Besides, most modern messengers also encrypt the sender, so the "sealed sender" is the basic expectation similar to e2e encryption.

All traffic funnels through servers controlled by one company, enabling invasive metadata surveillance that extends far beyond message tracking, exposing your online patterns, sleep, work habits, and physical location through device connection. In other words, Signal is similar to regular corporate spyware, even when accessed via alternative FOSS clients like Molly. Using VPN and Tor doesn't help much either because it can only hide your exact location.

Signal requires a phone number to create an account, which immediately compromises privacy of regular non-savvy users who use their KYCed SIMs. Furthermore, virtually no modern device permits IMEI changes and tampering with IMEI is illegal in many police states. Thus, using a non-KYC burner SIM on a primary phone will not mitigate this issue since a burner SIM will be associated with a primary KYCed SIM through IMEI.

Unlike Session, Status, or PGP where users directly exchange public keys (the ID is the key), Signal relies on centralized servers to map phone numbers and usernames to encryption keys, creating a Man-in-the-Middle vulnerability where various adversaries and the server itself could swap keys and decrypt all messages without detection. This risk is only mitigated by manually verifying the pubkey fingerprint (Safety Number), but most users never do that.

By default, Signal tries to access all contacts on your phone.

"Nonprofit" is a buzzword that hides Signal's flawed architecture, which enables censorship, data collection, and discrimination based on a country code. Ultimately, a nonprofit is still a compliant entity that can be coerced to cooperate with adversaries, and it has to generate enough money to pay the bills.