All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them.

[harrysintonen@infosec.exchange]

All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them. Good people have tried to forward my concern to them (and I am thankful for your efforts and help), yet this has been to no avail.

I am disappointed in the lack of communication from Signal. I will be disclosing the full details of the issue later today (with end-user mitigations), after the six-month anniversary of the initial report.

[vieiro@mastodon.social]

@harrysintonen

They are here in the fediverse at
@signalapp

[harrysintonen@infosec.exchange]

@vieiro @signalapp Indeed, they are.

[catraxx@tech.lgbt]

@harrysintonen That's odd. I had no idea Signal was ignoring reports? They have a rather good reputation.

[gvs@rebelbase.site]

@harrysintonen Signal was once a great app, but in recent years, they've screwed their users over too many times. The sealed sender hoax, usernames only client side, the crypto scam, keeping server source code back for over a year. There are way better alternatives today that as a bonus aren't locked to AWS, are not centralized and don't require a SIM card.

@element works well, @xmpp remains a strong choice (except on IOS) and @simplex is the future IMP (once they fix the reliability of connections)