Valid Signal privacy issues shrugged off while patches quietly rolled out

• TextSecure

  985 24,864 9.9 Java

  A private messenger for Android.

  

I raised a similar issue 4 years ago - https://github.com/signalapp/Signal-Android/issues/6703

Signal used to silently fail if you changed device. I guess not much has changed.

• libsignal

  24 2,877 9.7 Rust

  Home to the Signal Protocol as well as other cryptographic primitives which make Signal possible.

  

> The "safety number" also encodes both participants' phone numbers

Um, not that I know of. A quick check, though, the QR code is a bunch of binary data, so I dove into the source code: https://github.com/signalapp/libsignal-client/blob/4446b648f...

> very amused that the author censored part of the QR code, but not the human readable text below it containing the exact same data

So what is it now, does it contain the phone numbers or not? Since any phone numbers are censored, only the safety number is not. But the QR code doesn't contain the phone number, as you just saw in the source code (assuming I correctly identified the relevant part, I just looked for uses of qr codes, found getScannableFingerprint and followed the trail through libsignal from there).

It's also, strictly speaking, not the same as the text below: the safety number below doesn't appear to include a version number (same file, lines 14-16).

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project