--- title: Cloudflare and Trail of Bits now audit who Signal says... description: Signal has launched automatic key verification, a feature that lets the app confirm the phone number or username tied to a public key is globally consistent,... canonical: https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare and Trail of Bits now audit who Signal says you are talking to | daily.dev og:description: Signal has launched automatic key verification, a feature that lets the app confirm the phone number or username tied to a public key is globally consistent,... og:url: https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8 og:image: https://api.daily.dev/og/posts/duxuXxCm8.png og:image:alt: Cloudflare and Trail of Bits now audit who Signal says you are talking to og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare and Trail of Bits now audit who Signal says you are talking to **[The Next Web](https://daily.dev/sources/tnw)** · 6 min read · 0 upvotes · 0 comments ## Summary Signal has launched automatic key verification, a feature that lets the app confirm the phone number or username tied to a public key is globally consistent, without requiring users to manually compare safety numbers in person. The system relies on a tamper-evident log tree independently audited by Cloudflare and Trail of Bits, so no single party can present different log versions to different users. Cloudflare, which already runs the same key-transparency infrastructure for WhatsApp since September 2024, built the system in Rust on Workers using an append-only method from Meta's open-source key directory library. The feature has real limits: it can't confirm who actually controls a phone number, doesn't work with username-only contacts, breaks if a contact changes numbers, and can be toggled off in Settings under Privacy and Advanced. The piece also raises a concentration concern, since Cloudflare now audits key transparency for both of the world's largest end-to-end encrypted messaging platforms. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Signal's automatic key verification feature and how does it work? Automatic key verification is a Signal feature, introduced by software engineer Katherine Yen, that confirms the link between a phone number or username and its public key is globally consistent, without requiring an in-person safety number comparison. It relies on a tamper-evident log tree with prefix trees recording registrations and account changes, checked automatically and periodically by the app itself. _Track how messaging platforms tighten identity verification by following security updates like this on daily.dev._ ### Who audits Signal's key transparency log and what can they see? Cloudflare and Trail of Bits independently sign Signal's tamper-evident log, so no single party can show different versions to different users. Cloudflare pulls batches of updates, cryptographically verifies consistency, and signs them, but it works only over cryptographic proofs and never sees phone numbers, usernames, public keys, or message contents. Cloudflare has run equivalent infrastructure for WhatsApp since September 2024. _Developers evaluating trust and audit models for encrypted systems can keep up with cases like this on daily.dev._ ### What are the limitations of Signal's automatic key verification? It proves a key belongs to a given identifier, not that the identifier belongs to the person you think, so it cannot confirm who actually controls a phone number. It requires the contact's phone number, doesn't work with username-only discovery, stops working if a contact changes their number, and can be disabled under Settings, Privacy, then Advanced. _Anyone assessing encrypted messaging trade-offs can track these nuances via daily.dev._ ## Similar posts on daily.dev - [Key Transparency Comes to Messenger](https://daily.dev/posts/key-transparency-comes-to-messenger-amttyyxjj) · Facebook Engineering · 0 upvotes · 0 comments - [Signal knows who you’re talking to – Sane Security Guy](https://daily.dev/posts/signal-knows-who-you-re-talking-to-sane-security-guy-a9jz0t6an) · Hacker News · 0 upvotes · 0 comments - [Bringing more transparency to post-quantum usage, encrypted messaging, and routing security](https://daily.dev/posts/bringing-more-transparency-to-post-quantum-usage-encrypted-messaging-and-routing-security-w3obninqi) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#cryptography](https://daily.dev/tags/cryptography), [#encryption](https://daily.dev/tags/encryption), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cloudflare and Trail of Bits now audit who Signal says you are talking to","url":"https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8"},"datePublished":"2026-08-13T15:27:43.247Z","dateModified":"2026-08-13T15:28:33.423Z","description":"Signal has launched automatic key verification, a feature that lets the app confirm the phone number or username tied to a public key is globally consistent,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fcced03e58f09d4b95359c9496f5bddf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fcced03e58f09d4b95359c9496f5bddf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cryptography,encryption,cloudflare","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Cloudflare and Trail of Bits now audit who Signal says you are talking to"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cloudflare-and-trail-of-bits-now-audit-who-signal-says-you-are-talking-to-duxuxxcm8#faq","mainEntity":[{"@type":"Question","name":"What is Signal's automatic key verification feature and how does it work?","acceptedAnswer":{"@type":"Answer","text":"Automatic key verification is a Signal feature, introduced by software engineer Katherine Yen, that confirms the link between a phone number or username and its public key is globally consistent, without requiring an in-person safety number comparison. It relies on a tamper-evident log tree with prefix trees recording registrations and account changes, checked automatically and periodically by the app itself. Track how messaging platforms tighten identity verification by following security updates like this on daily.dev."}},{"@type":"Question","name":"Who audits Signal's key transparency log and what can they see?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare and Trail of Bits independently sign Signal's tamper-evident log, so no single party can show different versions to different users. Cloudflare pulls batches of updates, cryptographically verifies consistency, and signs them, but it works only over cryptographic proofs and never sees phone numbers, usernames, public keys, or message contents. Cloudflare has run equivalent infrastructure for WhatsApp since September 2024. Developers evaluating trust and audit models for encrypted systems can keep up with cases like this on daily.dev."}},{"@type":"Question","name":"What are the limitations of Signal's automatic key verification?","acceptedAnswer":{"@type":"Answer","text":"It proves a key belongs to a given identifier, not that the identifier belongs to the person you think, so it cannot confirm who actually controls a phone number. It requires the contact's phone number, doesn't work with username-only discovery, stops working if a contact changes their number, and can be disabled under Settings, Privacy, then Advanced. Anyone assessing encrypted messaging trade-offs can track these nuances via daily.dev."}}]} ```