83cca68965
Christian: 'If we can give it a higher rating or if we can dispel rumors, then we need to make that part of our first post.' Discipline first: debunking a rumor must not buy score, or the instrument becomes a PR department with a database attached. What the rumors actually did was correct one under-informed dimension. - incident_record 7 -> 8. The 2026 'Signal was hacked' panic is a documented phishing campaign. FBI/CISA PSA260626 says plainly that the app and its encryption were not compromised, Signal published a precise correction within days and shipped linkage confirmations by 2026-05-13. Fast, accurate, independently corroborated. - Total 75.9 -> 76.4. Half a point. That is the correct size. - Everything else was already priced in: the OTF funding was already docked under ownership, the phone number already docked under user control. Evidence rows added for the FBI advisory, Signal's statement, the itemised ,955,000 OTF funding record (2013-2016), and the UK/Sweden exit commitments. The recompute gate verified 76.4 from the weights and scores, not from trust.
47 lines
3.3 KiB
SQL
47 lines
3.3 KiB
SQL
-- =====================================================================
|
|
-- 0003 — the rumor ledger, 2026-10-29
|
|
--
|
|
-- Christian's question: can we score Signal higher, or dispel the rumors?
|
|
--
|
|
-- The honest answer is that debunking rumors must NOT raise a score, or the
|
|
-- instrument rewards public relations. What the rumors do is correct one
|
|
-- dimension that was under-informed: incident_record. The 2026 "Signal was
|
|
-- hacked" panic is a documented phishing campaign, and the FBI and CISA say so
|
|
-- independently. That is evidence of good incident handling, so it earns exactly
|
|
-- one point on one dimension: 7 -> 8, which moves the total by half a point.
|
|
--
|
|
-- Everything else in the rumor set is already priced in. The OTF funding was
|
|
-- already docked under ownership_jurisdiction. The phone number was already
|
|
-- docked under user_control_exit.
|
|
-- =====================================================================
|
|
|
|
UPDATE score
|
|
SET value = 8,
|
|
rationale = 'Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as "Signal hacked"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.'
|
|
WHERE assessment_id = 'A-2026-10-29-SIGNAL-DESKTOP'
|
|
AND dimension_id = 'incident_record';
|
|
|
|
UPDATE assessment
|
|
SET weighted_total = 76.4
|
|
WHERE id = 'A-2026-10-29-SIGNAL-DESKTOP';
|
|
|
|
INSERT INTO evidence (assessment_id, dimension_id, claim, tier, kind, artifact, sha256, observed_at) VALUES
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record',
|
|
'FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.',
|
|
2, 'advisory', 'https://www.ic3.gov/PSA/2026/PSA260626',
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
|
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'incident_record',
|
|
'Signal statement, 28 April 2026: "Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised." Additional linkage confirmations shipped 13 May 2026.',
|
|
2, 'record', 'https://x.com/signalapp/status/2048866663580246302',
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
|
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'ownership_jurisdiction',
|
|
'Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the "US government funded Signal" claim, and it is already reflected in the two points docked on this dimension.',
|
|
2, 'record', 'https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems',
|
|
NULL, '2026-10-29T15:26:00-05:00'),
|
|
|
|
('A-2026-10-29-SIGNAL-DESKTOP', 'user_control_exit',
|
|
'Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.',
|
|
2, 'record', 'https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/',
|
|
NULL, '2026-10-29T15:26:00-05:00');
|