We Need to Talk About Signal: Secure Messaging and OPSEC | HelpMeRob | BSides312 2026

Designed for both technical professionals and non-technical activists, this talk provides practical frameworks for defining shared threat models, negotiating risk trade-offs, bootstrapping secure group communications, and recognizing when compromise risk has become unacceptable. Participants will leave with concrete guidance for aligning expectations, reducing group exposure, and, when necessary, dissolving and rebuilding a chain of trust before damage becomes irreversible. --- About HelpMeRob: Hacker The presenter is a hacker and cybersecurity professional with over 30 years of experience in technical security, networking, and digital forensics. With a background spanning federal law enforcement, military cyber defense, and leading roles in corporate security, their expertise blends deep technical knowledge with hands-on experimentation. Recorded live at BSides312 2026. --- Chapters: 0:00 What Do We Even Mean by "Signal"? 1:24 Why the Definition Matters 2:11 Who This Talk Is For 3:22 A Starting Point, Not a Destination 4:56 Prioritizing Your Security Goals 5:41 Segmentation and the Blast Radius 6:27 Data You Don't Have Can't Be Stolen 7:06 The Cast: Alice, Bob, Carol 7:41 Eve, the Passive Eavesdropper 9:01 Mallory and Wendy 9:56 Alice and Bob Start With SMS 10:25 Why SMS Isn't Secure 11:19 But SMS 2FA Still Beats a Password 11:41 Threat Modeling: Six Very Different Scenarios 13:56 Trusting the App's Supply Chain 15:06 Device Security and Beacon Tracking 16:24 The Protocol: TextSecure and RedPhone 17:26 Why OTR Over SMS Failed 18:07 Merged, Rebranded, and Internet-Dependent 18:57 What the Signal Application Actually Is 19:12 The Phone Number Requirement 20:08 Group Chat and Attack Surface 21:21 WhatsApp and Google Messages 22:33 Why So Many Implementations Exist 23:10 Enterprise Variants and the TeleMessage Breach 24:18 Modified Clients That Retain Everything 25:29 The Screenshot Checkbox and Windows Recall 26:32 Phone Book Enumeration, Disclosed at HushCon 27:41 Usernames Give a False Sense of Security 28:37 Use a Number That Isn't Yours 29:43 Google Voice and Recycled Numbers 30:38 Burner Numbers Raise Suspicion 32:04 Why This Talk: I Deleted My Account 32:41 The Desktop Copy Kept Everything 33:16 Shenanigans: Rejoining From a New Number 34:11 "Safety Number Changed" Gets Ignored 34:32 Deleted Accounts Stay in Group Chats 35:35 Group Links Were the Low-Hanging Fruit 36:28 Getting Added Back to Private Groups 37:26 The "Unknown Contact" Problem 38:35 Both Unknown Contacts Are Me 39:31 Three Accounts, Two With Admin 40:56 Security Is a Process, Not an App 42:16 How Much Risk Is Acceptable? 43:10 Signals Intelligence and Beaconing 44:36 Meshtastic 45:05 No Substitute for Face-to-Face 45:47 Q&A --- Mentioned in this talk: - Signal Protocol - TextSecure and RedPhone - OTR / XMPP - Meshtastic - TeleMessage breach (May 2025) Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw