Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.3K
active users

ioc.exchange: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

Quiet public
Michał "rysiek" Woźniak · 🇺🇦

@Avitus @makdaam Cloudflare fixed *an* issue that allowed the researcher to more easily target individual datacenters.

*The* issue is not "fixed", as that is still possible by using a VPN and cycling through exit locations, or by using one's own nodes in these locations, etc.

Signal's statement is behind a loginwall.

Quiet public
Cassandra Granade 🏳️‍⚧️

@rysiek @Avitus @makdaam IIRC, 404 uses a loginwall to prevent AI scraping, for the most part. Anyway, Signal's alleged statement from the article:

404 Media first asked Signal for comment in early December. The organization did not provide a statement in time for publication, but daniel shared their response to his bug report. “What you're describing (observing cache hits and misses) is a generic property of how Content Distribution Networks function. Signal's use of CDNs is neither unique nor alarming, and also doesn't impact Signal's end-to-end encryption. CDNs are utilized by every popular application and website on the internet, and they are essential for high-performance and reliability while serving a global audience,” Signal’s security team wrote.
“There is already a large body of existing work that explores this topic in detail, but if someone needs to completely obscure their network location (especially at a level as coarse and imprecise as the example that appears in your video) a VPN is absolutely necessary. That functionality falls outside of Signal's scope. Signal protects the privacy of your messages and calls, but it has never attempted to fully replicate the set of network-layer anonymity features that projects like Wireguard, Tor, and other open-source VPN software can provide,” it added.
Quiet public
Michał "rysiek" Woźniak · 🇺🇦

@xgranade @Avitus @makdaam that's the statement from the gist. I'd like a statement directly from Signal somewhere.

👊🇺🇸🔥

@rysiek @xgranade @makdaam Signal made a direct statement to the bug bounty hunter, which was provided to 404 Media and published. So the statement given to the bug bounty hunter is the statement from Signal.

Jan 26, 2025, 06:31 PM·Quiet public
0boosts·0favorites
Quiet public
Michał "rysiek" Woźniak · 🇺🇦

@Avitus @xgranade @makdaam I would still like to hear more directly from Signal, not via the bounty hunter.

ExploreLive feeds
About