In late June 2017, Psiphon continued to prove its commitment to open source development (you can access our code repository here), by commissioning Cure53 to perform a security audit of our services. The security review took 22 days and a total of 9 testers to complete what was described as a review with a “vast scope” and the Cure53 testers were very thorough. This is our 2nd security audit of this kind in 3 years (you can see the results of the 1st one, performed by iSec here).

A severe security vulnerability in the Android AOSP browser has been disclosed: http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html The Psiphon team has determined that the built-in browser ("browser-only mode") in our Psiphon app is affected, on Android versions 3.0 to 4.3, through its use of Android AOSP browser via the WebView component. There is no known mitigation for this security vulnerability other than to disable JavaScript in our built-in browser WebView components. We are releasing Psiphon for Android version 62 which will disable JavaScript in the built-in browser on these versions of Android.