The "sealed sender" feature talked about in the article.

They did make some changes to protect against this one: https://sgaxe.com/files/SGAxe.pdf when it started to get attention, but there will be other exploits to get SGX protected data.

As always, the best way to secure private information is not the collect it and keep it in the cloud in the first place.

Just so we're clear: this is (a) a feature no other mainstream messenger has, meaning that the worst implication of it is that Signal is no more anonymous than alternatives, and (b) is a pretty straightforward traffic analysis attack. The server is oblivious to the identities of senders, but recipients reply to senders and can be correlated.

> Just so we're clear: this is (a) a feature no other mainstream messenger has, meaning that the worst implication of it is that Signal is no more anonymous than alternatives

No more anonymous than some alternatives, although likely no more than mainstream alternatives, but while also leaving users with a false sense of security since this feature was supposed to prevent the exact thing it's allowing.

> is a pretty straightforward traffic analysis attack.

"straightforward" traffic analysis attacks that expose people who would normally be protected by VPNs and/or TOR, but now aren't purely because of how Signal works.

I mean, not only did these researchers find and disclose the flaw for free, they also came up with and tested solutions to the problem but still signal is like "nah, we'll keep it broken!"