Fun topic.

Rule of thumbs are:

1. How interesting are you? Whistleblower like Snowden or Assange? Consider yourself burned. Or, just an average dude with unfavorable political opinions? Meh - you aren't worth the effort. Example: for high value targets, US gov't has been known to intercept laptops and phones between the retailer (Amazon,etc.) and the target to pre-install spyware. That's expensive and only done for high value targets.
   
2. Are you paying for the service? No? Then, you are not the customer - you are the product. Don't trust what you don't pay for. BUT: The exception to this is altruism: Some products are good (like Veracrypt) because the creators appears to have altruistic purposes. But, these are rare. AND - it is easier to put out a tool for altruistic purposes (like Veracrypt) vs running an ongoing service (like poal.co). Ongoing services are expensive to operate, so that's a red flag in itself.
   
3. Where is the physical server? If you are an American - use a Chinese server. If you are Chinese - use an American server. So - WeChat is safer for an American to use vs. a US based service that may be subject to search warrants.
   
4. Decentralization is key. Point to point encryption is worlds better than going across a central server.
   

So, specific to Signal:

• only you can answer #1
• you aren't paying for the service, what is their revenue model? A non profit asking for donations. Might be OK. If it is altruistic, then there may be hope. They are a non profit, so it would be of interest to look at their public records. (https://projects.propublica.org/nonprofits/organizations/463948126 ... looks like they got some large donations in 2013-2015 to build the tool. Would be interesting to dig and see who made those donations.)
  
• points #3 and #4 should be both covered here if it is truly end to end encryption w/o a central server. The good news is that signal is open source. SO ... to be safe: (1) download the source code, (2) review it, study the encryption and key handling, (3) compile the source code from the copy you downloaded and reviewed. There are security guys who do this for personal interest. And, they would be screaming if they found red flags in the code OR the compiled download versions didn't match what they compiled independently. I haven't heard anyone screaming on signal, so likely safe. But, always evaluate your risk level before using any tool.

I proffered on a similar question on VPNs a month ago. Might be of interest: https://poal.co/s/technology/477036/9788f0d9-12e5-489c-b2c3-192bd1152a85

Only as safe as the device themselves. Which are not safe.

Signal only provides privacy against carriers and internet transport. It will not protect you against three letter agencies or google or apple. Or any invasive keyboard you may have installed or comes factory.

Edit: think of it as a privacy app with superior texting, rather than a security app.

First off, this is a good thing to ask.

A more specific approach is, "what's safe about them, and what's unsafe about them" and you have to think about this in terms of what you're trying to protect yourself from.

So there's the idea of who you are concerned about, this can be - Hackers, with various motivations - Your ISP - Other internet infrastructure orgs - Whoever runs the platform in question - Your device/operating system provider/manufacturer - Copyright holding groups - Your school or employer - Law enforcement - Other government agencies - Other countries governments - Political activist groups - Family, friends, aquaintances - Other users of the platform - this list could go on

You basically have to look at each one that matters in the context of why you're concerned about safety.

Pirating movies for example? Main thing is to make sure the traffic is not clear to your isp and keep copyright holders from knowing an IP address that can be tied to you.

Racist talk and don't want to get doxed? The platform owners themselves must be both willing and able to resist political activist groups, and not expose information that can link back to you. People made this mistake with discord over and over for example.

Fedposting with intent? You need to evaluate for every layer on that list.

It's basically a whole project to determine safety specifically for each use-case. You can't really rely on a blanket answer. And also you need to keep in mind that things can change, and be ready for that when it happens.

I know this is probably a frustrating answer but it's the right way to approach it. If anyone knows of detailed security assessments that allows commenting and updates for any of these platforms that's basically the way to go about this. Like I said it's a whole project to figure this out for each use case.

There is no such thing as 'secure' on the internet.

Treat everything you type as public and archived.

Like so....

clears throat

Daniel Andrews can suck Winnie the Poohs honey covered cock, and needs to be slowly lowered into a woodchipper an inch at a time.

See? Now im either going to get disappeared by Absolutely Fantastic Plastic or not. Havent changed my tune in a couple of years and im still standing but knowing my luck ill get buttfucked in the end.

it is safe and effective^tm

For $2200 I'll build you a system that not even the NSA could mathematically break, using good old fashioned one time pads based on high entropy random numbers.

Fuck signal.

List of comm apps

https://web.archive.org/web/20201109040231/https://docs.google.com/spreadsheets/d/1-UlA4-tslROBDS9IqHalWVztqZo7uxlCeKPQ-8uoFOU/htmlview