Reading Signal without breaking it

Almost every argument about encrypted messaging assumes an attacker has to get past the encryption. Documents published by the German outlet netzpolitik.org describe a method that never tries. The Zollkriminalamt — Germany's customs investigation office — began testing what its own paperwork calls Messenger‑Überwachung at the end of 2023, as a pilot. According to the reporting, the pilot moved into regular operation on 1 August 2025. WhatsApp, Telegram, Signal and Threema are all named. No trojan is installed on the phone. No key is recovered. No cipher is weakened.

What happens instead, as described in the documents, is mundane: investigators open WhatsApp Web on a police computer and pair it with the target's phone by scanning the QR code. From then on the second screen receives the conversation, and what lands there is not a trickle of future messages but an archive of the account.

What the QR code actually does

Linking a device is not wiretapping. The new screen is not listening in on the old one; it becomes a full member of the account, with its own key, and the sender's app encrypts a separate copy for it. Every guarantee holds. The message is still end-to-end encrypted. The end just moved.

The cost to the attacker is the striking part. Not an exploit, not a supply-chain implant, not a court order served on a company — a few seconds with an unlocked phone. A border control, a traffic stop, a desk you walked away from. And it does not require hands on the device at all: on 20 March 2026 France's CERT‑FR published an alert (CERTFR‑2026‑ALE‑003) on campaigns doing the same thing remotely: a message invites you to join a group by scanning a QR code, and the code links a device the attacker controls. The alert names officials, politicians and journalists among the targets.

The strongest cryptography in the world protects a conversation between endpoints. It has nothing to say about how many endpoints there are.

The list that nobody opens

Every one of these apps already has the defence. Signal has Linked devices. WhatsApp has Linked devices. The intruder is right there, listed honestly, with the date it joined. You can remove it with one tap.

And it does not work — not because the screen lies, but because it is passive. It asks you to go looking. There is no badge, no banner, no notification when a device appears. A control that only fires when consulted protects the people who already suspected something, which is the smallest and least urgent group of users there is. CERT‑FR's own advice is to review the list regularly; that advice is correct, and it is also an admission that the app will not tell you.

Where OSHI was wrong

This is the point where I have to stop describing other people's software. OSHI had exactly the same gap. It listed linked web sessions, and it could revoke any of them. It never told you one had appeared. The list was accurate and it was silent — the identical failure, ours.

That is fixed. On iOS it ships in 1.0.45, submitted for review on 13 September 2026, and on Android the same day: a new linked session now announces itself instead of waiting to be discovered.

One piece is still open, and it is better said here than found later. GET /api/web/sessions answers without a signature. Anyone who knows a user's public address can ask our server which devices that user has linked, and get an answer. No message content is exposed and nothing can be linked or revoked this way — but on a product like this, whether you run a desktop session and when it appeared is not nothing. A server-side owner gate is deployed. It is running in permissive mode while traffic is measured, which means that for now it records what it would have refused and refuses nothing. Until it is switched to enforcing, that leak is live.

What to do this evening

Open the linked-devices screen in every messenger you use and look at it once, properly. Then treat an unexpected QR code for what it is: a request to add a device to your account, made by someone who is not you. Legitimate pairing always starts from inside the app, on your initiative, because you went to that menu.

The threat model moved to the endpoint years ago. Nobody needs to break the encryption when the account will politely hand out another key.