Misleading posts claiming Signal is vulnerable are getting thousands, if not millions, of impressions. This happens frequently, there are attempts to undermine Signal and scare users away from safety. Signal is one of the most secure apps ever made. Please watch out and let family and friends know. - ThreadSky

badinternet.oracularhades.com • 65 days ago

Misleading posts claiming Signal is vulnerable are getting thousands, if not millions, of impressions. This happens frequently, there are attempts to undermine Signal and scare users away from safety. Signal is one of the most secure apps ever made.

Please watch out and let family and friends know.

Comments

againstkookery.bsky.social•65 days ago

Signal's source code is not known to have any vulnerabilities. (It may have cleverly-hidden vulnerabilities).

Signal's binaries on your device's app store, though? Could be completely compromised.

againstkookery.bsky.social•65 days ago

Or rather, they could both be safe and free from any vulnerabilities that anyone knows about; or either could have vulnerabilities that somebody knows about and has not disclosed.

It's likely safe, but who knows for sure?

badinternet.oracularhades.com•65 days ago

You can match binaries to source code, and binaries are signed by Signal. This is pretty conspiratorial. A lot of work has gone into OSes to prevent those issues.

againstkookery.bsky.social•65 days ago

Can you do this on Android and iOS though? (Genuine question, since I'm not a mobile developer).

There's been a recent example of a hostile developer working his way into a project's confidence, only to purposely introduce vulnerabilities. It's not common, sure, but it's not unheard of.

againstkookery.bsky.social•65 days ago

And to be clear, I'm not alleging that the Signal project is corrupt or that a malicious developer has introduced vulnerabilities into Signal at this time; only that it's a possibility to consider when using the app or any app.

badinternet.oracularhades.com•65 days ago

Yes. iOS only runs signed code, developers must create signing certificates. Android is the same from my understanding.

againstkookery.bsky.social•64 days ago

What I mean is: Can you compile your own version from source and compare it to the app store binary and see that they match? If you can't do that, you don't really know that the app store binary is unaltered from the public source code.

badinternet.oracularhades.com•65 days ago

Comments

Posting Rules

Reply