Removal notice: On February 7, 2021, BleepingComputer published an article about a possible security problem that affected Signal’s alternative temporary censorship solution.
Since then, we have received reports disputing parts of the story.
The researchers’ original report on this alleged security problem was published publicly on GitHub, from where it was removed by Signal. BleepingComputer found that this was not done to suppress the discussion, but because it was posted in the wrong place.
Discussions on these issues should take place in the Signal community forum.
Readers also stated that the discussion did not take place in a respectful manner and violated Signal’s code of conduct.
Subsequently, the researchers republished the details of the original issue in a separate GitHub repository, but since the original issue of GitHub has been removed and is not archived, we cannot confirm the authenticity of this post.
In addition, we have been informed that the alleged security vulnerability is not an actual vulnerability in the Signal proxy implementation.
Signal founder Moxie Marlinspike has also tweeted several times [1, 2, 3] contesting the alleged security issue and why the researchers’ GitHub issues were removed.
Due to the conflicting information that BleepingComputer received, we removed our original article.