Static + dynamic analysis of Signal's APK. The good news first: Signal is genuinely exceptional.

Rust core (libsignal_jni.so), post-quantum hybrid Double Ratchet (Kyber-1024 + X25519), Direct ByteBuffers with immediate zeroing after PIN/username hashing, Intel SGX attestation for SVR — MREnclave verification means even a compromised Signal server can't extract your PIN hash.

But two things stood out:

1. Firebase is always there. Google receives IP + notification timestamps regardless of message content. If you need metadata privacy, Signal still leaks presence data to Google's infrastructure.

2. Certificate revocation endpoints hit http://g.symcd.com in plaintext. An ISP or state-level observer can fingerprint Signal usage from DNS queries and HTTP traffic to those CAs — without touching message content.

Conclusion: strongest crypto engineering in consumer messaging. The attack surface isn't the cryptography. It's the operational dependencies.

Soon the full analysis

#infosec #AndroidSecurity #Signal #privacy #ReverseEngineering #postquantum #mobileforensics

Ein Bundestagsabgeordneter.

Der AfD.

Verschickt.

Rechtsextreme Comics.

An GRUNDSCHULEN.

WAS? DENN? NOCH?

AfD-Verbot JETZT!

https://www.ndr.de/nachrichten/mecklenburg-vorpommern/afd-abgeordneter-grimm-schickt-rechtsextreme-comics-an-grundschulen,afd-1050.html

[EDIT: now sorted thank you SO MUCH!]

Heads up my dudes, my son needs to do work experience this summer and he's a programmer. Nearly 15, can do 3 decent languages, main in Java, been programming since 4. All he wants to do is be a developer. Anyone offer work experience these days? Two weeks in July. London or Dartford way or anywhere in between. Ta! Retoots appreciated!

#workexperience #help

zomg I *just* realized:

LLMings 🤣

It was there the whole time!

(apologies if y'all figured out that joke already long ago…it literally just occurred to me!)