So again by linking accounts to a device operated by police or customs in this case. Which for SMS confirmations, I understand can be intercepted and confirmed by authorities, but the QR exploit seems farther fetched (because who in their right mind would open a messenger and scan a random QR?); and of course if you have access to a target's unlocked device, it becomes trivial.

The iMessage trick? Nothing new but glad it see it get coverage and people made aware it's a design flaw of many end to end encrypted systems.

Signal requires your phones access code in addition to the QR code when adding sessions. That would defeat this in most cases like the first one.

That distinction matters: a device being added to an account can bypass the cryptography without breaking it. It also makes endpoint integrity and clear user-visible session/device auditing just as important as the cipher suite.

I am usually fan of netzpolitik.org but that one paragraph seems odd where they link the BSI notice about Signal an then cite that they "get additional access to messages of the last 45 days". I'm pretty sure that is wrong. After you link a new device you used to only get access to new messages an no past messages. Also the linked source doesn't mention the 45 days. Also I don't why we are sitting here discussing app security when the first example is a couple that gave the police voluntarily their unlocked device so that the police "can make screenshots" of their past chats with their daughter??? And now the scandal is that the police not only made screenshots but also linked their whatsapp web so that they can also read future messages. I am shocked!

Whoever thought a commercial app you cannot control would be secure deserves to get burned by any stupidity they commit over it.