Light

Episode #1024 Quiz

Don't Blame Signal
Date: 2025-05-06 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Microsoft has officially moved to passwordless authentication for new accounts, promoting Passkeys secured by biometrics to enhance security and speed. Meanwhile, a modified Signal clone, TM SGNL by TeleMessage, introduced insecure message archiving that was hacked, exposing sensitive U.S. government chats and demonstrating risks of third-party modifications breaching end-to-end encryption.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the fundamental security issue with the 'TM SGNL' app used by some U.S. administration officials as discussed in Episode 1024?

Question 1

What is the fundamental security issue with the 'TM SGNL' app used by some U.S. administration officials as discussed in Episode 1024?

It is a modified version of Signal that archives messages unencrypted on remote servers, breaking end-to-end encryption guarantees. It lacks a PIN verification step, allowing unauthorized physical access to conversations. It does not support group chats, limiting communication to direct messages only. It uses a proprietary encryption protocol incompatible with standard Signal servers, causing message loss.

Question 2: According to the episode, what is Microsoft's major advancement in user authentication rolled out by the end of April 2025?

Question 2

According to the episode, what is Microsoft's major advancement in user authentication rolled out by the end of April 2025?

Making all new Microsoft consumer accounts passwordless by default with Passkey-first authentication support. Enforcing mandatory two-factor authentication for all Microsoft account sign-ins without exception. Introducing biometric-only login for all existing Microsoft accounts without fallback options. Requiring users to create longer and more complex passwords with mandatory character variety.

Question 3: What practical security benefit does running SSH servers on non-default ports provide, according to the discussion in Episode 1024?

Question 3

What practical security benefit does running SSH servers on non-default ports provide, according to the discussion in Episode 1024?

Reduces unsolicited connection attempts and scanning noise by adversaries, lowering unnecessary server load. Prevents attackers from discovering the server's IP address. Provides cryptographic security by encrypting the SSH port communications uniquely. Eliminates the need for key-based or password authentication by obscurity.

Question 4: What is the main reason TeleMessage’s modified Signal app (TM SGNL) violates the security guarantees of authentic Signal, as explained in the episode?

Question 4

What is the main reason TeleMessage’s modified Signal app (TM SGNL) violates the security guarantees of authentic Signal, as explained in the episode?

It disables the use of PINs, making unauthorized access trivial. It never encrypts messages during transit between sender and receiver. It requires users to share messages publicly on social media platforms. It sends copies of all incoming and outgoing messages to a third-party archive without preserving end-to-end encryption on the stored data.

Question 5: What was the key finding about the eCommerce backdoors found in Magento plugins from 2019, as reported in the episode?

Question 5

What was the key finding about the eCommerce backdoors found in Magento plugins from 2019, as reported in the episode?

Plugins contained secret backdoors dormant for six years enabling remote command execution when activated. The backdoors were immediately detected and patched by developers upon release in 2019. The compromised files were configuration files harmless to system integrity and security. Only one Magento plugin was compromised, affecting less than ten online stores worldwide.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.