> Signal does not have access to your social graph

Their contact discovery uses SGX, which has a long list of vulnerabilities [1], and is even deprecated by Intel.

With access to the server, my guess is that getting someone's social graph is not entirely impossible.

[1]: https://en.wikipedia.org/wiki/Software_Guard_Extensions#List...