Signal's backup recovery key.

On June 26, the FBI and CISA updated a warning about Russian intelligence operators targeting Signal users. Posing as Signal support, they walk the target through turning on backups, opening the recovery key, and pasting it into the chat.

A recovery key is a single secret that can rebuild your entire message history on a new device. Think of it as a spare house key that also hands over copies of everything inside. Once the attacker has it, they restore the backup, read past messages, and take over the account. The key keeps working, even against a new account made with the same number.

Signal's encryption held. Every message stayed protected in transit. The break is in recovery, where a secret a person can be talked into pasting anywhere undoes the rest.