Why is Lochbox better than using Signal?

Modified on Fri, 3 Feb, 2023 at 4:53 PM

Signal is point to point, meaning that a business owner cannot ‘own’ or control a communication.

While Lochbox and Signal both use point-to-point encryption and content encryption, unlike Signal:

Lochbox provides the business owner the management and backup/recovery of the content encryption keys.
Lochbox allows the business to reassigned communications to different employees if needed.
Lochbox ensures all parties in the communication are authenticated, including the use of multi-factor authentication (MFA).
Lochbox ensures that the business’ access control to content is enforced.

Signal is based upon an endpoint’s phone number, which comprises the following problems:

A phone number can be SIMjacked, then the threat actor is able to divert the Signal communications without the participants being notified of the ongoing breach.
Centrally Signal collects the meta-data of which phone numbers are communicating with which other phone numbers. The FBI routinely subpoenas this information. When they do, Signal hand waves to distract you that there is no content that can be disclosed to the FBI, … the ACLU is brought in to further grand-stand and distract. Meanwhile, the FBI obtains the sufficiently damaging information of who is talking to who. In part because, without your awareness, the FBI also routinely subpoenas the full customer records from each of the various cellular carriers, enabling them to match a Signal phone number to an actual person and their actual address. The FBI can also match each phone number and time of Signal communication with the time‑logged GPS data that the carriers also provide to the FBI.

Unlike Signal:

Lochbox is agnostic of the device’s phone number; its operation is not affected when the device is SIMJacked.
From phone devices, Lochbox uses either WiFi, or the carrier’s data channel, completely hiding communication activities from the carrier or the SS7 attacker that is spying on the carrier’s network. Lochbox even provides some protection at the local Starbuck’s public WiFi; though you shouldn’t public WiFi for many other reasons.
Lochbox can remove trust from a lost or stolen or device.
Lochbox alerts users when foreign devices attempt to use their account.

Signal, when allowed to access your phone’s contact list, will collect fully centrally. Additionally, Signal spams those in your contact list that also have Signal accounts, telling them that you have joined, regardless of relationship. Though Signal touts that these are stored in ‘Secure Enclaves’, that Signal employees do not have access to, this does not mean that the FBI, or other alphabet agencies, do not have access to it.

Unlike Signal, Lochbox will only access your phone’s contact list temporarily, as a convenience to the user, but does not harvest or collect this information in any way. In this regard, Lochbox better respects your privacy.