48 lines
3.3 KiB
MySQL
48 lines
3.3 KiB
MySQL
|
-- =====================================================================
|
||
|
|
-- 0003 — the rumor ledger, 2026-10-29
|
||
|
|
--
|
||
|
|
-- Christian's question: can we score Signal higher, or dispel the rumors?
|
||
|
|
--
|
||
|
|
-- The honest answer is that debunking rumors must NOT raise a score, or the
|
||
|
|
-- instrument rewards public relations. What the rumors do is correct one
|
||
|
|
-- dimension that was under-informed: incident_record. The 2026 "Signal was
|
||
|
|
-- hacked" panic is a documented phishing campaign, and the FBI and CISA say so
|
||
|
|
-- independently. That is evidence of good incident handling, so it earns exactly
|
||
|
|
-- one point on one dimension: 7 -> 8, which moves the total by half a point.
|
||
|
|
--
|
||
|
|
-- Everything else in the rumor set is already priced in. The OTF funding was
|
||
|
|
-- already docked under ownership_jurisdiction. The phone number was already
|
||
|
|
-- docked under user_control_exit.
|
||
|
|
-- =====================================================================
|
||
|
|
|
||
|
|
UPDATE score
|
||
|
|
SET value = 8,
|
||
|
|
rationale = 'Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as "Signal hacked"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.'
|
||
|
|
WHERE assessment_id = 'A-2026-10-29-SIGNAL-DESKTOP'
|
||
|
|
AND dimension_id = 'incident_record';
|
||
|
|
|
||
|
|
UPDATE assessment
|
||
|
|
SET weighted_total = 76.4
|
||
|
|
WHERE id = 'A-2026-10-29-SIGNAL-DESKTOP';
|
||
|
|
|
||
|
|
INSERT INTO evidence (assessment_id, dimension_id, claim, tier, kind, artifact, sha256, observed_at) VALUES
|
||
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record',
|
||
|
|
'FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.',
|
||
|
|
2, 'advisory', 'https://www.ic3.gov/PSA/2026/PSA260626',
|
||
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
||
|
|
|
||
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record',
|
||
|
|
'Signal statement, 28 April 2026: "Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised." Additional linkage confirmations shipped 13 May 2026.',
|
||
|
|
2, 'record', 'https://x.com/signalapp/status/2048866663580246302',
|
||
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
||
|
|
|
||
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction',
|
||
|
|
'Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the "US government funded Signal" claim, and it is already reflected in the two points docked on this dimension.',
|
||
|
|
2, 'record', 'https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems',
|
||
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
||
|
|
|
||
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'user_control_exit',
|
||
|
|
'Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.',
|
||
|
|
2, 'record', 'https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/',
|
||
|
|
NULL, '2026-10-29T15:26:00-05:00');
|