cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

  • BillionaireStew@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    9 hours ago

    It’s just forward secrecy, not “perfect forward secrecy”, unless you are writing Signal press material. (Edit: Parent comment was edited to use the correct term.)

    https://en.wikipedia.org/wiki/Forward_secrecy

    I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.

    Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal’s reliance on a fixed identity that complicates the matter of rotating keys.

    In other words, Signal is not better because it has “perfect forward secrecy”. It is worse because it needs it.

    Even so, it is such a talking point that Session does intend to implement “perfect forward secrecy”.

    https://getsession.org/blog/session-protocol-v2

    As for “store all messages in a blockchain”, I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren’t, someone would be replying in your stead and complaining that Session does not allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.

    I find it strange that you condemn Session’s use of a blockchain but are apparently unconcerned by Signal’s bundling a cryptocurrency wallet and linking it to users’ Signal accounts.

    https://en.wikipedia.org/wiki/MobileCoin#Signal_Integration

    https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_requirements_pin