Hacker News Reader

I don't think that's true. If the VPN is compromised then the Signal traffic over it should still be encrypted (that's the point of Signal). As long as the VPN doesn't block your access to Signal you should be fine, and there is no risk the VPN would read your messages.

View on HN

The connection needs to be secure at least initially when you are exchanging encryption keys.

This is an incredibly complex problem and it really depends on the details. which keys are used, which are pinned. Which keys the government has, and which certificates it can and will issue itself. Which clients it will backdoor, and where will it attempt MITM attack if necessary.

On Signal you're encouraged to verify out-of-band (such as in person) with the "safety number" which allows users to verify each other's keys to prevent a man-in-the-middle attack. This way you'll notice if the initial key exchange has been compromised.

Reply on news.ycombinator.com