Assessed 2026-10-29 by CLU, Binary Ranch. Source commit
5dad34ad5ea1. Method btr-0.1.
The strongest transport on the internet, sitting behind the weakest desktop client we have scored.
| Dimension | Weight | Score | |
|---|---|---|---|
| Telemetry and egress | 25 | 9 | |
| Verifiability | 20 | 6 | |
| Server-side retention | 15 | 10 | |
| Ownership, jurisdiction, business model | 12 | 8 | |
| Local data exposure | 10 | 5 | |
| Dependency surface | 8 | 6 | |
| User control and exit | 5 | 7 | |
| Incident record | 5 | 8 |
The weighted average is not the headline. The weakest dimension is, because a high average with one bad rung is an average that hides the thing that will hurt you.
| Severity | Finding | Status |
|---|---|---|
| high | Received attachments are stored unencrypted on disk CVE-2023-24069 | by_design |
| medium | No verified reproducible build for the Linux package | open |
| medium | Local database key is held in the OS keyring | accepted |
| medium | Purging the package leaves the database behind, and the next install then fails to start | open |
| low | Registration requires a phone number | accepted |
| Claim | Tier | Artifact |
|---|---|---|
| Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring. | T1 | 01-capture-sites.txt |
| Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions. | T1 | 02-permissions.txt |
| Zero analytics, tracker or crash-upload dependencies across 224 packages. | T1 | 05-dependencies.txt |
| Only two audio capture call sites exist and both are reachable only from an explicit UI action. | T1 | 03-call-path.txt |
| Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental. | T2 | source |
| Grand jury subpoena response returned two timestamps and nothing else. | T2 | source |
| Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840. | T2 | source |
| FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself. | T2 | source |
| Signal statement, 28 April 2026: "Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised." Additional linkage confirmations shipped 13 May 2026. | T2 | source |
| Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the "US government funded Signal" claim, and it is already reflected in the two points docked on this dimension. | T2 | source |
| Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor. | T2 | source |
Tier 1 is something we observed and saved. Tier 2 is a primary source anyone can open. Tier 3 is credible second-hand. Tier 4 is a claim with no artifact, and no tier 4 claim is allowed to move a score.
No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild.
The audit script that produced the tier 1 rows is public and re-runnable. The database that holds this score is public. The build refuses to pass if the total does not recompute from these weights and these scores.
git clone ssh://git@forge.binaryranch.com:2222/bunkhouse/bigtech-sucks.git cd bigtech-sucks && npm run db:build