Clippy trail of bits only had the two medium severity issues that were patched, what else would you think would give SimpleX Chat more credence?
As I wrote above, it's one thing for contractors hired by SimpleX to issue polite reports about it. And as I wrote above, that's not the same as endorsement by qualified experts not associated with (or paid by) the project.
For example, this one interview lists these people as endorsing Signal:
- EFF, Glenn Greenwald, Edward Snowden (though they are not cryptographers)
- Facebook Messenger, also WhatsApp (though they are users of the protocol, not the system)
- Tal Malkin and Allison Bishop, cryptographers at Columbia
- Cryptographers from Cisco, Waterloo, ETH Zurich (paper)
Here is a 2025 paper from Japanese cryptographers analyzing Signal's post-quantum extensions.
I'm not saying that everybody must use Signal, that Signal's phone-number issue isn't a genuine big issue, that nobody should use SimpleX, etc. What I'm saying is that a lot of qualified people have looked hard at Signal. That's good, because that's generally what it takes to end up with something secure.
The 2024 Trail of Bits report on SimpleX is based on one staff-week of effort (see page 6). Paying for that evaluation is a good step, and it's encouraging that it uncovered no dramatic problems, but I really don't think that's the same thing as the scrutiny that Signal has undergone.
SimpleX cryptography may be great, and I hope it is shown to be great, and many people may choose it over Signal because the phone-number issue matters more to them than the reduced amount of external expert scrutiny that SimpleX has undergone compared to Signal. But that doesn't mean that SimpleX has survived extended scrutiny by cryptographers around the world. Has it?