Your questions, answered by Cybernews: Signal uses Google servers, but is your data safe?

Signal is using Google infrastructure. Does this mean that people searching for privacy are unwittingly falling back into the trap? Our team has selected one pressing and common reader issue and deconstructed it to help you stay safe online.

Each week, we take one of your internet-fueled anxieties and pull it apart to see what’s really going on behind the screen. This week’s question bubbled up from a Reddit thread about the popular secure messaging app, Signal.

One Redditor stumbled upon a curious case on their iPhone. When they tried to send a photo through Signal, something weird happened. Their phone tried connecting to Google servers, specifically clients3.google.com.

The privacy-conscious user had blocked all Google-related domains and had no Google apps on their device, which is why, previously, they had experienced problems sending photos over Signal.

“I blocked all Google-related domains,” they wrote, “but when I allowed those servers, my Signal photos went through. Now I have a question: What are those domains used for? And are they privacy-friendly?”

Encryption hides your messages from Google

Our research team decided to cut through the noise. Here’s what’s actually happening.

“Signal likely uses AWS, Azure, and Google Cloud for certain bandwidth-intensive features, such as sharing voice messages and photos, since they are some of the only options that can handle that much data for the user base as large as Signal's,” said Cybernews researchers.

However, this doesn’t mean all privacy advocates should shy away from using the app. Signal’s data is end-to-end encrypted (E2EE), after all.

This means that as long as encryption remains intact, Google (or anyone else) can’t see what’s inside your messages. The data that passes through their infrastructure is encrypted gibberish and unreadable without your private key.

What Signal says

Signal, for its part, didn’t exactly deny it. In a blog post, the non-profit behind the app explains that it rents cloud infrastructure from major providers, including Google Cloud, Amazon AWS, and Microsoft Azure.

“Because everything in Signal is end-to-end encrypted,” it wrote, “we can rent server infrastructure from a variety of providers while ensuring that your messages and calls remain private. We can’t access them, and neither can the companies that provide the infrastructure.”

Curious what others think about this story? Contribute your thoughts to the debate below.

In other words, yes, Signal uses Google’s servers, but only as the plumbing. According to the post, as a small nonprofit organization, Signal cannot afford to purchase the physical computers necessary to support all its users worldwide and place them in independent data centers.

“Only a select few of the very largest companies globally are still capable of doing this, which is a hallmark of a troublingly concentrated industry,” wrote Signal.

What do Redditors think?

The Reddit crowd split into two camps. Some took the practical route: “Signal is a highly available service that’s used globally. There are only three options for that scale of service: AWS, Azure, and Google Cloud.”

“Google is one of the biggest cloud providers out there. If Signal is truly end-to-end encrypted, then only those with access to a client at the endpoints should be able to see those messages,” said another.

“Encryption means private. The infrastructure does not matter,” put one Redditor bluntly.

Another added: “When using E2EE, the server is irrelevant. Even if it were to be hosted by the feds or CCP. That's the whole point of E2EE, it assumes the server is as hostile as possible and only both ends can see the message.”

Some commenters expressed doubts about whether it is even possible to break encryption and whether Google could access messages.

Others weren’t so easily convinced. One commenter argued: “What people don't get about Signal is that the protocol is good. The cryptography is good. However, the rest of the app has had plenty of vulnerabilities, such as allowing remote code execution.”

Unlock more exclusive Cybernews content on YouTube.