2 ms·
Signal is installed from the platform stores, which have the ability to push updates. As far as we can tell, the compromise was done via a pushed update. It's
by kybernetikos 6y ago
Signal is installed from the platform stores, which have the ability to push updates. As far as we can tell, the compromise was done via a pushed update. It's likely that Signal wouldn't have helped.
- cesarb 6y agoOn Android, I recall that updates to a package must be signed by the same key as the package being updated, otherwise the device itself will reject the update. Doesn't that mean that only the Signal developers (who are the ones who signed the original package) would be able to create a compromised update?
- kybernetikos 6y agoThat is likely what happened in this situation (although I don't have details).