What stands out to me is that #Signal uses secret URLs to distribute encrypted attachments. Given their strong security claims and threat model, I would have anticipated a more robust user authentication mechanism to ensure that only intended recipients can access these files.

Also, it should be fairly easy to mitigate this – simply by using Tor (with apps like Advanced Privacy or InviZible) or a trustworthy VPN like @mullvadnet 🤷

So if you’re using a VPN, your location per the Cloudflare server is the outlet node.