It's really crucial to understand how badly framed this is. There is no Signal vulnerability. The Pentagon email did a bad job explaining a Google report from a month ago and NPR repeated it.
This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability.
This is like saying because you got a phishing email at your Gmail address, there's a Google vulnerability.
Reposted from
David Folkenflik
News: NPR’s Tom Bowman reports of a Pentagon-wide warning about Signal’s security vulnerability - one week ago 👇🏼
Comments
I'd only add that whoever uses signal knows the Truth.
I'm pretty sure I heard about this simple signal layer8 phishing attack before.
Probably sometime last year or early this year, but I can't quite pinpoint or find it.
This is just embarrassing. Zero OpSec. The US is fucked.
In case you don't hear it, the whole world is laughing. 🫣😔
A. Signal helped with, and
B. Literally doesn't find a vulnerability in how Signal works. It's about how users can be tricked, as Signal is now used enough in Ukraine, securely, that Russia is poking for workarounds.
Resident Immortal Sociopath here, I have insight to offer.
Rule 1 - Humans are fscking stupid.
Rule not yet numbered - Humans will do completely horrible things to protect the "image" of something, even if what they do completely betrays that image.
See also: Churches, Cops, SCOTUS
User error is a confirmed Signal vulnerability.
Kinda like how an apartment building is secure until somebody props the door with a brick for a delivery.
Nothing wrong with the lock, but the system still allows for that vulnerability.
Any security feature has vulnerabilities that can be exploited. Parsing how the vulnerability is framed is one thing, but pretending it isn't still a vulnerability is wrong