[ConcernedCitizen]

...

A lot of great information, and I agree with your points. However, my issue lies with the fact that people assume when an entity says their messages are encrypted, that they actually are. It takes one push of an update to change that. After all, Anom was advertised as encrypted but the FBI held a master key to decrypt messages the entire time.

The creator of Anom was originally arrested after running "Phantom Secure" and entered a plea deal. I'm merely suggesting that the same tactic could be applied to many other encrypted communications, whether they rely on updates or otherwise. Three letter organizations only need to have leverage on the operator.

The Signal app has been reviewed as well as the Sessions fork in separate audits, I believe. I read about the Anom app and I have to say it's not at all surprising that its users were caught, because they trusted one single app to keep their communications secure. SIGINT wouldn't be required to crack the messages of criminals that just blindly trusted a proprietary app. This is a huge failure in due diligence as well as encryption practices.