On November 4, 2014, the Electronic Frontier Foundation (EFF) listed iMessage on its "Secure Messaging Scorecard", giving it a score of 5 out of 7 points. It received points for having communications encrypted in transit, having communications encrypted with keys the provider doesn't have access to (end-to-end encryption), having past communications secure if the keys are stolen (forward secrecy), having their security designs well-documented, and having a recent independent security audit. It missed points because users can not verify contacts' identities and because the source code is not open to independent review.[28] In September 2015, Matthew Green noted that, because iMessage does not display key fingerprints for out-of-band verification, users are unable to verify that a man-in-the-middle attack has not occurred.