--- title: Signal adds new security feature to thwart... description: Signal has rolled out Automatic Key Verification, a new key transparency feature that uses Cloudflare and Trail of Bits as independent auditors to confirm the... canonical: https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Signal adds new security feature to thwart man-in-the-middle attacks | daily.dev og:description: Signal has rolled out Automatic Key Verification, a new key transparency feature that uses Cloudflare and Trail of Bits as independent auditors to confirm the... og:url: https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset og:image: https://api.daily.dev/og/posts/4VBe4lSET.png og:image:alt: Signal adds new security feature to thwart man-in-the-middle attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Signal adds new security feature to thwart man-in-the-middle attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Signal has rolled out Automatic Key Verification, a new key transparency feature that uses Cloudflare and Trail of Bits as independent auditors to confirm the integrity of encrypted chats without requiring manual safety number checks or in-person meetings. The feature can be toggled on under Settings > Privacy > Advanced, and shows a green checkmark and 'Encryption verified' message upon successful verification. It complements, rather than replaces, the existing manual safety number system, and follows earlier Signal updates adding phishing warnings after Russian state-sponsored hackers exploited the Linked Device feature to hijack accounts of high-profile users, prompting a $10 million U.S. bounty for information on the responsible hacker groups. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Signal's new Automatic Key Verification feature and how does it work? Automatic Key Verification is a Signal feature that uses a key transparency system with Cloudflare and Trail of Bits acting as independent third-party auditors to confirm that a phone number or username is consistently linked to the correct public encryption key across Signal's ecosystem. It provides the same assurance as manually verifying safety numbers but without needing an in-person meeting or secondary communication channel. _Developers building on encrypted messaging can follow verification approaches like this via daily.dev._ ### How do I enable Automatic Key Verification in Signal? Automatic Key Verification can be enabled by going to Settings > Privacy > Advanced and toggling it on. Users can also verify a specific contact's public key by selecting Verify Automatically on the safety number verification screen, which shows a green checkmark and an Encryption verified message when successful. Manual safety number verification remains available for those who prefer not to rely on Signal or its auditors. _Anyone tracking secure messaging updates can keep tabs on features like this through daily.dev._ ### Why did Signal add phishing warnings and what attacks prompted them? Signal added warning messages and in-app confirmations in May to counter social engineering and phishing attempts, after Russian state-sponsored hackers used fake 'Signal Support' alerts to exploit the Linked Device feature and hijack high-profile users' accounts, chats, and contacts. The FBI, German authorities, and the Dutch government all reported these attacks, and the U.S. State Department later offered up to $10 million for information on the UNC5792 and UNC4221 hacker groups behind similar phishing campaigns. _Teams securing messaging integrations can track threat responses like this on daily.dev._ ## Similar posts on daily.dev - [Signal adds security warnings for social engineering, phishing attacks](https://daily.dev/posts/signal-adds-security-warnings-for-social-engineering-phishing-attacks-msp1wsl3v) · BleepingComputer · 0 upvotes · 0 comments - [Key Transparency Comes to Messenger](https://daily.dev/posts/key-transparency-comes-to-messenger-amttyyxjj) · Facebook Engineering · 0 upvotes · 0 comments - [Verifying your devices is becoming mandatory](https://daily.dev/posts/verifying-your-devices-is-becoming-mandatory-4bkkptk7c) · Hacker News · 0 upvotes · 0 comments --- Tags: [#phishing](https://daily.dev/tags/phishing), [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Signal adds new security feature to thwart man-in-the-middle attacks","url":"https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset"},"datePublished":"2026-08-12T11:28:13.354Z","dateModified":"2026-08-13T13:57:25.025Z","description":"Signal has rolled out Automatic Key Verification, a new key transparency feature that uses Cloudflare and Trail of Bits as independent auditors to confirm the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56fa7b1e525c2274e36d8e05836af490?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/56fa7b1e525c2274e36d8e05836af490?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"phishing,encryption","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Signal adds new security feature to thwart man-in-the-middle attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/signal-adds-new-security-feature-to-thwart-man-in-the-middle-attacks-4vbe4lset#faq","mainEntity":[{"@type":"Question","name":"What is Signal's new Automatic Key Verification feature and how does it work?","acceptedAnswer":{"@type":"Answer","text":"Automatic Key Verification is a Signal feature that uses a key transparency system with Cloudflare and Trail of Bits acting as independent third-party auditors to confirm that a phone number or username is consistently linked to the correct public encryption key across Signal's ecosystem. It provides the same assurance as manually verifying safety numbers but without needing an in-person meeting or secondary communication channel. Developers building on encrypted messaging can follow verification approaches like this via daily.dev."}},{"@type":"Question","name":"How do I enable Automatic Key Verification in Signal?","acceptedAnswer":{"@type":"Answer","text":"Automatic Key Verification can be enabled by going to Settings > Privacy > Advanced and toggling it on. Users can also verify a specific contact's public key by selecting Verify Automatically on the safety number verification screen, which shows a green checkmark and an Encryption verified message when successful. Manual safety number verification remains available for those who prefer not to rely on Signal or its auditors. Anyone tracking secure messaging updates can keep tabs on features like this through daily.dev."}},{"@type":"Question","name":"Why did Signal add phishing warnings and what attacks prompted them?","acceptedAnswer":{"@type":"Answer","text":"Signal added warning messages and in-app confirmations in May to counter social engineering and phishing attempts, after Russian state-sponsored hackers used fake 'Signal Support' alerts to exploit the Linked Device feature and hijack high-profile users' accounts, chats, and contacts. The FBI, German authorities, and the Dutch government all reported these attacks, and the U.S. State Department later offered up to $10 million for information on the UNC5792 and UNC4221 hacker groups behind similar phishing campaigns. Teams securing messaging integrations can track threat responses like this on daily.dev."}}]} ```