Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger

1. mollyim-android-unifiedpush

   1 2 110 0.0 Kotlin

   Discontinued Molly with UnifiedPush support (Archived).

   

   There is still Molly as a fork, but no idea how hardened it actually is.

   After Moxie's statement at the time I kind of ditched everything regarding Signal's ecosystem. I understand the business perspective of it, but it's kind of pointless trying to say this is open source when it's illegal to press the Fork button on GitHub, you know.

   https://github.com/mollyim/mollyim-android-unifiedpush

2. CodeRabbit

   coderabbit.ai featured

   CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

   

3. simplex-chat

   2 266 8,368 9.9 Kotlin

   SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!

   

   I found SimpleX recently (https://simplex.chat/), which got my attention because it uses a unique account schema that doesn't have any individual account identifiers. It's got some interesting features. Not sure about user-friendliness since I don't use other messaging apps to know what to expect.

   It's mostly just interesting to me that they did away with the username entirely and they instead have users connect exclusively through shared secrets like they're Diffie and Hellman.

4. tfc

   3 56 1,263 0.8 Python

   Tinfoil Chat - Onion-routed, endpoint secure messaging system

   

   I'll feel pessimistic like this, but then something like Tinfoil Chat [0] comes along and sparks my interest again. It's still all just theoretical to me, but at least I don't feel so bad about things.

   With a little bit of hardware you could get a lot of assurance back: "Optical repeater inside the optocouplers of the data diode enforce direction of data transmission with the fundamental laws of physics."

   [0] https://github.com/maqp/tfc

5. noscript

   4 63 916 9.4 JavaScript

   The popular NoScript Security Suite browser extension.

   

   > In each of the fake group invites, JavaScript code that typically redirects the user to join a Signal group has been replaced by a malicious block containing the Uniform Resource Identifier (URI) used by Signal to link a new device to Signal (i.e., "sgnl://linkdevice?uuid="), tricking victims into linking their Signal accounts to a device controlled by UNC5792.

   Missing from their recommendations: Install No Script: https://noscript.net/

Suggest a related project