Recent searches
Search options
I tried to find when #Signal has published the most recent #security audit, and it turns out they either never published an audit or their code was never audited at all.
The closest thing I found is the list
https://community.signalusers.org/t/overview-of-third-party-security-audits/13243
which only cites research papers and some evidence that in 2018 Signal paid Doyensec, but nothing got published as the result. Even then, it looks like the apps were not audited for more than 5 years since then.
Signal Community · Overview of third-party security auditsNew paper from RWC 2024 demonstrating an injection attack against signals (on-device/offline) backup: paper RWC 2024 talk recording Signal already fixed this: Signal acknowledged our vulnerability and have already included hiding boundaries between ciphertexts in their v1 revision to their Android backup file format.