From 83cca68965f0ce75c35d86cb7ea268ee86932b39 Mon Sep 17 00:00:00 2001 From: CLU Date: Thu, 29 Oct 2026 15:30:00 -0500 Subject: [PATCH] feat: the Signal rumor ledger, and the half point it earned Christian: 'If we can give it a higher rating or if we can dispel rumors, then we need to make that part of our first post.' Discipline first: debunking a rumor must not buy score, or the instrument becomes a PR department with a database attached. What the rumors actually did was correct one under-informed dimension. - incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented phishing campaign. FBI/CISA PSA260626 says plainly that the app and its encryption were not compromised, Signal published a precise correction within days and shipped linkage confirmations by 2026-05-13. Fast, accurate, independently corroborated. - Total 75.9 -> 76.4. Half a point. That is the correct size. - Everything else was already priced in: the OTF funding was already docked under ownership, the phone number already docked under user control. Evidence rows added for the FBI advisory, Signal's statement, the itemised ,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments. The recompute gate verified 76.4 from the weights and scores, not from trust. --- packages/core/db/seed/0003-signal-rumors.sql | 47 ++++++++++++ packages/core/src/data/generated/catalog.json | 76 +++++++++++++++---- packages/core/src/data/generated/catalog.ts | 76 +++++++++++++++---- packages/web/public/catalog.json | 76 +++++++++++++++---- packages/web/public/oath.json | 6 +- 5 files changed, 230 insertions(+), 51 deletions(-) create mode 100644 packages/core/db/seed/0003-signal-rumors.sql diff --git a/packages/core/db/seed/0003-signal-rumors.sql b/packages/core/db/seed/0003-signal-rumors.sql new file mode 100644 index 0000000..a695705 --- /dev/null +++ b/packages/core/db/seed/0003-signal-rumors.sql @@ -0,0 +1,47 @@ +-- ===================================================================== +-- 0003 — the rumor ledger, 2026-10-29 +-- +-- Christian's question: can we score Signal higher, or dispel the rumors? +-- +-- The honest answer is that debunking rumors must NOT raise a score, or the +-- instrument rewards public relations. What the rumors do is correct one +-- dimension that was under-informed: incident_record. The 2026 "Signal was +-- hacked" panic is a documented phishing campaign, and the FBI and CISA say so +-- independently. That is evidence of good incident handling, so it earns exactly +-- one point on one dimension: 7 -> 8, which moves the total by half a point. +-- +-- Everything else in the rumor set is already priced in. The OTF funding was +-- already docked under ownership_jurisdiction. The phone number was already +-- docked under user_control_exit. +-- ===================================================================== + +UPDATE score + SET value = 8, + rationale = 'Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as "Signal hacked"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.' + WHERE assessment_id = 'A-2026-10-29-SIGNAL-DESKTOP' + AND dimension_id = 'incident_record'; + +UPDATE assessment + SET weighted_total = 76.4 + WHERE id = 'A-2026-10-29-SIGNAL-DESKTOP'; + +INSERT INTO evidence (assessment_id, dimension_id, claim, tier, kind, artifact, sha256, observed_at) VALUES + ('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record', + 'FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.', + 2, 'advisory', 'https://www.ic3.gov/PSA/2026/PSA260626', + NULL, '2026-10-29T15:26:00-05:00'), + + ('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record', + 'Signal statement, 28 April 2026: "Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised." Additional linkage confirmations shipped 13 May 2026.', + 2, 'record', 'https://x.com/signalapp/status/2048866663580246302', + NULL, '2026-10-29T15:26:00-05:00'), + + ('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction', + 'Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the "US government funded Signal" claim, and it is already reflected in the two points docked on this dimension.', + 2, 'record', 'https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems', + NULL, '2026-10-29T15:26:00-05:00'), + + ('A-2026-10-29-SIGNAL-DESKTOP', 'user_control_exit', + 'Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.', + 2, 'record', 'https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/', + NULL, '2026-10-29T15:26:00-05:00'); diff --git a/packages/core/src/data/generated/catalog.json b/packages/core/src/data/generated/catalog.json index 3945b6c..d339154 100644 --- a/packages/core/src/data/generated/catalog.json +++ b/packages/core/src/data/generated/catalog.json @@ -1,5 +1,5 @@ { - "generated_at": "2026-10-29T20:23:11.576Z", + "generated_at": "2026-10-29T20:29:36.195Z", "method_version": "btr-0.1", "dimensions": [ { @@ -1504,7 +1504,7 @@ "entity_type": "nonprofit", "jurisdiction": "US", "business_model": "none", - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "policy": 85, "infra": 58, @@ -2776,7 +2776,7 @@ "assessed_on": "2026-10-29", "method_version": "btr-0.1", "reproducible_build": 1, - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", @@ -2843,15 +2843,15 @@ { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", - "value": 7, - "rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.", + "value": 8, + "rationale": "Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as \"Signal hacked\"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.", "label": "Incident record", "weight": 5 } ], "evidence": [ { - "id": 15, + "id": 22, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.", @@ -2862,7 +2862,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 16, + "id": 23, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.", @@ -2873,7 +2873,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 17, + "id": 24, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.", @@ -2884,7 +2884,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 18, + "id": 25, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.", @@ -2895,7 +2895,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 19, + "id": 26, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.", @@ -2906,7 +2906,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 20, + "id": 27, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "claim": "Grand jury subpoena response returned two timestamps and nothing else.", @@ -2917,7 +2917,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 21, + "id": 28, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.", @@ -2926,11 +2926,55 @@ "artifact": "https://projects.propublica.org/nonprofits/organizations/824506840", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" + }, + { + "id": 29, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.", + "tier": 2, + "kind": "advisory", + "artifact": "https://www.ic3.gov/PSA/2026/PSA260626", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 30, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.", + "tier": 2, + "kind": "record", + "artifact": "https://x.com/signalapp/status/2048866663580246302", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 31, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "ownership_jurisdiction", + "claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.", + "tier": 2, + "kind": "record", + "artifact": "https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 32, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "user_control_exit", + "claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.", + "tier": 2, + "kind": "record", + "artifact": "https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" } ], "findings": [ { - "id": 9, + "id": 13, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "high", "title": "Received attachments are stored unencrypted on disk", @@ -2939,7 +2983,7 @@ "cve": "CVE-2023-24069" }, { - "id": 10, + "id": 14, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "No verified reproducible build for the Linux package", @@ -2948,7 +2992,7 @@ "cve": null }, { - "id": 11, + "id": 15, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "Local database key is held in the OS keyring", @@ -2957,7 +3001,7 @@ "cve": null }, { - "id": 12, + "id": 16, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "low", "title": "Registration requires a phone number", diff --git a/packages/core/src/data/generated/catalog.ts b/packages/core/src/data/generated/catalog.ts index 1b3ca15..5a7367f 100644 --- a/packages/core/src/data/generated/catalog.ts +++ b/packages/core/src/data/generated/catalog.ts @@ -39,7 +39,7 @@ export interface CatalogDimension { } export const catalog = { - "generated_at": "2026-10-29T20:23:11.576Z", + "generated_at": "2026-10-29T20:29:36.195Z", "method_version": "btr-0.1", "dimensions": [ { @@ -1544,7 +1544,7 @@ export const catalog = { "entity_type": "nonprofit", "jurisdiction": "US", "business_model": "none", - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "policy": 85, "infra": 58, @@ -2816,7 +2816,7 @@ export const catalog = { "assessed_on": "2026-10-29", "method_version": "btr-0.1", "reproducible_build": 1, - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", @@ -2883,15 +2883,15 @@ export const catalog = { { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", - "value": 7, - "rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.", + "value": 8, + "rationale": "Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as \"Signal hacked\"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.", "label": "Incident record", "weight": 5 } ], "evidence": [ { - "id": 15, + "id": 22, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.", @@ -2902,7 +2902,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 16, + "id": 23, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.", @@ -2913,7 +2913,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 17, + "id": 24, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.", @@ -2924,7 +2924,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 18, + "id": 25, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.", @@ -2935,7 +2935,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 19, + "id": 26, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.", @@ -2946,7 +2946,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 20, + "id": 27, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "claim": "Grand jury subpoena response returned two timestamps and nothing else.", @@ -2957,7 +2957,7 @@ export const catalog = { "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 21, + "id": 28, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.", @@ -2966,11 +2966,55 @@ export const catalog = { "artifact": "https://projects.propublica.org/nonprofits/organizations/824506840", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" + }, + { + "id": 29, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.", + "tier": 2, + "kind": "advisory", + "artifact": "https://www.ic3.gov/PSA/2026/PSA260626", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 30, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.", + "tier": 2, + "kind": "record", + "artifact": "https://x.com/signalapp/status/2048866663580246302", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 31, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "ownership_jurisdiction", + "claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.", + "tier": 2, + "kind": "record", + "artifact": "https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 32, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "user_control_exit", + "claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.", + "tier": 2, + "kind": "record", + "artifact": "https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" } ], "findings": [ { - "id": 9, + "id": 13, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "high", "title": "Received attachments are stored unencrypted on disk", @@ -2979,7 +3023,7 @@ export const catalog = { "cve": "CVE-2023-24069" }, { - "id": 10, + "id": 14, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "No verified reproducible build for the Linux package", @@ -2988,7 +3032,7 @@ export const catalog = { "cve": null }, { - "id": 11, + "id": 15, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "Local database key is held in the OS keyring", @@ -2997,7 +3041,7 @@ export const catalog = { "cve": null }, { - "id": 12, + "id": 16, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "low", "title": "Registration requires a phone number", diff --git a/packages/web/public/catalog.json b/packages/web/public/catalog.json index 3945b6c..d339154 100644 --- a/packages/web/public/catalog.json +++ b/packages/web/public/catalog.json @@ -1,5 +1,5 @@ { - "generated_at": "2026-10-29T20:23:11.576Z", + "generated_at": "2026-10-29T20:29:36.195Z", "method_version": "btr-0.1", "dimensions": [ { @@ -1504,7 +1504,7 @@ "entity_type": "nonprofit", "jurisdiction": "US", "business_model": "none", - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "policy": 85, "infra": 58, @@ -2776,7 +2776,7 @@ "assessed_on": "2026-10-29", "method_version": "btr-0.1", "reproducible_build": 1, - "weighted_total": 75.9, + "weighted_total": 76.4, "grade": "B", "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", @@ -2843,15 +2843,15 @@ { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", - "value": 7, - "rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.", + "value": 8, + "rationale": "Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as \"Signal hacked\"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.", "label": "Incident record", "weight": 5 } ], "evidence": [ { - "id": 15, + "id": 22, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.", @@ -2862,7 +2862,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 16, + "id": 23, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.", @@ -2873,7 +2873,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 17, + "id": 24, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.", @@ -2884,7 +2884,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 18, + "id": 25, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.", @@ -2895,7 +2895,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 19, + "id": 26, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.", @@ -2906,7 +2906,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 20, + "id": 27, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "claim": "Grand jury subpoena response returned two timestamps and nothing else.", @@ -2917,7 +2917,7 @@ "observed_at": "2026-10-29T13:13:56-05:00" }, { - "id": 21, + "id": 28, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.", @@ -2926,11 +2926,55 @@ "artifact": "https://projects.propublica.org/nonprofits/organizations/824506840", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" + }, + { + "id": 29, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.", + "tier": 2, + "kind": "advisory", + "artifact": "https://www.ic3.gov/PSA/2026/PSA260626", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 30, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "incident_record", + "claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.", + "tier": 2, + "kind": "record", + "artifact": "https://x.com/signalapp/status/2048866663580246302", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 31, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "ownership_jurisdiction", + "claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.", + "tier": 2, + "kind": "record", + "artifact": "https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" + }, + { + "id": 32, + "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", + "dimension_id": "user_control_exit", + "claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.", + "tier": 2, + "kind": "record", + "artifact": "https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/", + "sha256": null, + "observed_at": "2026-10-29T15:26:00-05:00" } ], "findings": [ { - "id": 9, + "id": 13, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "high", "title": "Received attachments are stored unencrypted on disk", @@ -2939,7 +2983,7 @@ "cve": "CVE-2023-24069" }, { - "id": 10, + "id": 14, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "No verified reproducible build for the Linux package", @@ -2948,7 +2992,7 @@ "cve": null }, { - "id": 11, + "id": 15, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "Local database key is held in the OS keyring", @@ -2957,7 +3001,7 @@ "cve": null }, { - "id": 12, + "id": 16, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "low", "title": "Registration requires a phone number", diff --git a/packages/web/public/oath.json b/packages/web/public/oath.json index 3e6856b..6f107e2 100644 --- a/packages/web/public/oath.json +++ b/packages/web/public/oath.json @@ -1,9 +1,9 @@ { - "digest": "37a9774dc7569335d8135828aa5b97d294e26252185b0b31dc4a8f4dadde59db", + "digest": "ac0af0fe41910baecd8394bc837a623abdeae38ad851118ae37eb8862961248b", "algorithm": "sha256", "file": "catalog.json", - "byte_length": 80389, - "rebuilt_at": "2026-10-29T20:23:11.578Z", + "byte_length": 82952, + "rebuilt_at": "2026-10-29T20:29:36.197Z", "method_version": "btr-0.1", "products": 123, "assessed": 1