Phone number and trust-on-first-use for most people, with out-of-band fingerprint verification for the paranoid. It really depends on the threat model and the security practices/awareness of your colleagues, but a link shared on some social media or lower-security chat network is more vulnerable to a man-in-the-middle attack than a phone number for your average Joe. There are a lot of ways a person could get a manipulated invite link.

Either he was arrested with no record of the arrest (i.e “disappeared”) which is a new line for the administration to cross, or he disappeared for another reason (by himself, or with help or coercion by a foreign entity like the CCP), and the FBI is investigating.

I hope journalists keep on this because the first option would be a huge problem that everyone needs to know about, but without more information, the second is also a possibility. The CCP is known to have agents in western countries that manipulate and pressure ex-pats to return to China. Keeping an open mind now will also strengthen the argument if evidence for the former comes to light.

Might be easiest to just drill out the mic and camera, and use a usb headset for calls. I also suggest specific threat modelling and learning about opsec as that may help you feel more in control. After that, please look after your mental well-being. We all should.

Out of band key exchange is great -as long as people can physically meet and exchange QR codes. In reality, they are often sent via less secure means. As always, the humans are the weakest security link.

It does, I tried it. Though, that may have been an addition since the attacks started.

Though, in that specific case - Russian agents conducting espionage via targeted individuals - it’s very likely they surveil their targets long enough to catch their device PIN before they nab the phone and return it. In the end, there is very little recourse to defend against this type of Evil Maid attack. Signal is really better at protecting against mass surveillance, but for individuals directly targeted by state espionage? You would need serious opsec, using air-gapped computers kept in safes or guarded by humans 24x7 and other crazy stuff. They have rules about what can be physically done with devices containing top secret information for a good reason.

The exact reason why it’s bad for top secret communications is why individuals should use it or something like it. That is government auditability.