On iOS you can set an app to require additional credentials to open, to prevent this situation. I'd imagine Android had something similar. I did it for all my important apps, just in case. Don't want someone able to access my bank account or nudes.

I'll never understand why people accept SMS 2FA as any kind of security. Might as well put it as an ad in a newspaper. 🤦🏻‍♂️

Signal doesn’t offer anything except sms 2fa and requires a phone number. It’s a terrible choice considering LEO can do what they did here and just get legal access to MITM your sms messages, spoof the 2fa, and take over your account, impersonating you. The other ones aren’t encrypted. So none of these they broke into are great choices for truly secure messaging.

I think you're the only person here so far who read the linked article.

I also found the netzpolitik article that was referenced but not linked to in the original article.

This describes police adding a linked device to a person's WhatsApp account while gathering evidence (translated with Google Translate).

On January 12, 2020, Mr. and Mrs. P. were questioned. During the questioning, they voluntarily handed over the mobile phones they were carrying to the interviewing officers for a brief period so that messages from their daughter contained on the devices could be viewed and, among other things, photographed.

While the photographs were being taken, the computer-based application WhatsApp Web was covertly activated via a website made available online by the Federal Criminal Police Office (BKA), allowing the messages to be read on a BKA computer (sic!). This did not involve any intrusion via a Trojan horse or similar software.

The only link to Signal here is the nation state campaign which used social engineering via a phishing message from 'Signal Support'.

This nation state campaign was originally reported by a researcher at Citizen Lab.

Almost. More like they asked to use the bathroom then unlatched the bathroom window, left, and returned later through that window when the homeowner wasn't paying attention

Except they had to get the keys, at least for Signal, as described in the article. Only you can allow a new device. If you get a notification for a new device and you go "sure, let me flash that code for you", you're giving the key. And a moron.

Can't say about the other services.

for signal, that is still required. if you look, they used linked devices to get the messages

doesn’t help if you’re in custody and your device is in a lab

Remailer (Mixmaster) were meant to address that problem back when E-Mails were more popular.

They are a bit vague on this but I suspect all of these attack vectors start with LEOs having physical access to the unlocked phone. They then set up a trusted desktop without the phone owners knowing.

Which is clever, to be fair. Whether or not that's legal is already a court case. The law is so frightfully grey.