I never give apps I distrust permission to my photos, I instead select the photos in my gallery app and share them with the app. And as a side note, many users have cloud backups enabled, whether intentionally or accidentally (having clicked “accept” once, instead of “ask me later”); so big-tech likely stores a copy of the actual pictures, and depending on how lackluster the defaults are regarding privacy, have full access to it.

Western governments should look in the mirror, instead of solely putting the blame at information-campaigns from foreign actors. The whole reason why these theories seem plausible to your own citizens, is because they have no faith in you; because you have a track record of acting against their best interests. An increasing number of people are sick of hearing one-sided, fearmongering, and escalating narratives, where anything that challenges that, be it truthful or not, may resonate with this group. And good luck discerning disinformation from misinformation, where the only difference is intent; which will be challenging to substantiate.

So for RSA without padding, a threat actor could request lots of tokens (without getting rate-limited?), and use that as information to more precisely focus efforts to brute-force the key, and thereby reducing the number of operations required to do so? Or am I misunderstanding it?

If you leave them to choose between WhatsApp and Signal, they’ll pick what they already have and what they’re familiar with. I deleted WhatsApp after they introduced MetaAI, and told people close to me, that they could only message me using Signal going forward. Just make sure you support people that have difficulty installing and using the app. When removing malware from my grandma’s smartphone, I also made sure to install Signal, and she now comfortably contacts me through it for minor things. It’s not like you’re inconveniencing them much: it’s just an app installation and basic setup, while the workflow is nearly identical; especially if you allow them to find you through your phone number (which I have disabled).