Hardcoded credentials in the Signal archiving tool used by the White House is a five-alarm security dumpster fire.
Reposted from
Micah Lee
The source code for the TM SGNL apps (basically a backdoored version of Signal used by Trump officials) is public! Since it's open source, I've pushed it to github for easier research micahflee.com/heres-the-so...
Comments
https://bsky.app/profile/chrismardell.bsky.social/post/3lo5igf7ifs2x
https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/
https://www.wired.com/story/tm-signal-telemessage-plaintext-message-archive/
I wouldn't be surprised if things like the contents of messages were logged.
• This is 4-D chess hacker-proof.
• The really sensitive stuff used regular Signal, not the TM version.
• Nothing, because the people who would try to spin it won't even understand.
I still don't like any credentials being available easily though.
It’s a dumb crew
Now all they have to do is sit back and allow us to elect the dumbest fucking human beings in existence.
NO! NO! NO! BAD DEVELOPER! BAD BAD DEVELOPER!
*log4j peaks over the wall*
Ah. Well. Okay then.
Within the code was hard-coded username and password, publicly visible to all.
If it's to help China it's only because they're allied with Russia.
Whatever you call it, the UN is full of people you want to keep secrets from. You need serious security there too.
Imagine using this like it’s still *Signal* but then… doing this to it.
Our government is run by incompetent clowns.
Hardcoded credentials? Probably just kill me now….