Totally! Probably for a restaurant menu or something. . . It also seems likely that they added Jeffrey Goldberg, (the Atlantic's editor-in-chief) to the chat as the outlet, so the whole thing would become public. . . .
You guys are forgetting that you have to scan the QR code from Signal's "link new device" menu, and then approve the new device, which is a somewhat uncommon thing for a restaurant menu to ask you to do.
“… the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance.”
“ These QR codes are known to masquerade as group invites, security alerts, or legitimate device pairing instructions from the Signal website.”
Also
“ Last week, Microsoft and Volexity also revealed that multiple Russian threat actors are taking advantage of a technique called device code phishing to log into victims' accounts by targeting them via messaging apps like WhatsApp, Signal, and Microsoft Teams.”
Signal could make the pairing attack impossible by eliminating the device pairing feature, but that would also reduce its appeal and harm its mission of bringing secure communication to a broad audience. It could add steps to setting up a group chat and inviting additional members to make it less likely users will invite the wrong person, but that, too would hurt its popularity.
Security is a process and a spectrum, not a binary that can be guaranteed by using a certain product or service.
I agree. There are official channels that already exist for discussing sensitive information, and it does not appear Signal is one of them. These officials using any device or software not approved for that purpose constitutes a serious breach of protocol.
Signal probably shouldn't be approved for that purpose because it does trade some foolproofness for convenience. Secure communication should also be limited to dedicated devices, which probably wouldn't have journalists stored in their contacts.
Acrylic table menus have inserts which can be easily replaced.