4 ms·

I was actually perplexed, after reading about signal, that I couldn't just download an APK. Are play services required for signal? If so, can I even install si

by usernam 10y ago

I was actually perplexed, after reading about signal, that I couldn't just download an APK. Are play services required for signal? If so, can I even install signal on a cyanogenmod phone? Can you do so by rebuilding it yourself? Does the build match the shipped binary on the play store? To me, Signal does look exactly in the same boat as whatsapp. The fact that WhisperSystems didn't cooperate harder to ship Signal in F-Droid is also a major let-down. Is any other app sharing the same protocol?

sschueller 10y ago
Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption. [1] https://wire.com/download/ https://wire.com/download/
- ycmbntrthrwaway 10y ago
  Wire uses Firebase Cloud Messaging (former Google Cloud Messaging) by default as it is the Google requirement. If you, as a developer, roll out your own solution, you simply get banned on Google Play. Claimed reason is that FCM/GCM delivers all your messages in batch, so it saves your phone power [0]. It is doubtful because your phone may enter Discontinuous Reception (DRX) state, so your cellular operator will deliver messages in batch anyway, but whatever. I think it is Google pushing developers to use their push servers while avoiding antitrust laws. GitHub message about fallback to WebSocket you are referring to is here: [1]. So you can remove all Google services from your phone and install APK, it will still work, but now Wire server pings your phone whenever it wants. TLDR on the thread is that APK is not uploaded to F-Droid due to dependency (not really) on Google services. [0] https://developer.android.com/training/monitoring-device-state/doze-standby.html https://developer.android.com/training/monitoring-device-sta... [1] https://github.com/wireapp/wire-android/issues/5#issuecomment-251411885 https://github.com/wireapp/wire-android/issues/5#issuecommen...
- zedred 10y ago
  They don't use the signal protocol, they don't even use X3DH or Double Ratchet. That citation of yours is just a download link, not an actual reference to your point. The project is also kind of a mess. Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar). Check out some of the code. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like searches, and rolled their own messaging crypto. They have been caught lying about what kind of encryption they provide[1], they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire are usually on Wire's marketing team. 1: http://www.pcworld.com/article/2855745/new-communications-app-wire-tones-down-encryption-claims.html http://www.pcworld.com/article/2855745/new-communications-ap...
  - sschueller 10y ago
    According to wikipedia "its instant messages with Proteus, a protocol that Wire Swiss developed based on the Signal Protocol" [1] so I guess it is just based on it. [1] https://en.wikipedia.org/wiki/Wire_Swiss https://en.wikipedia.org/wiki/Wire_Swiss
  - FabHK 10y ago
    I'm surprised at your negative take. The article you link is from 2014. They do encrypt chats now, and group chats, and voice, and video, all e2e, as far as I can tell. My understanding is that the developers sit in Berlin, but the legal entity is in Switzerland. Their privacy policy [1] states that they retain logs for 72h, and not much else. Only hashed contact info (emails/phone numbers) are uploaded, after opt-in. It all sounds very reasonable. Your argument seems to be that they're an untrustworthy mess - but I don't see much evidence of that, except for possibly some braggadocio in that old article. > Check out some of the code. Yes, it is on github [2], so you can do that, which is nice. [1] https://medium.com/wire-news/simple-privacy-policy-72-hour-log-retention-33d183ea0fb3#.oxksa5yf0 https://medium.com/wire-news/simple-privacy-policy-72-hour-l... [2] https://github.com/wireapp https://github.com/wireapp
mtreis86 10y ago
Used to be, called LibreSignal. They ran into legal issues. https://github.com/LibreSignal/LibreSignal https://github.com/LibreSignal/LibreSignal There is a bounty for modifying the signal app source to drop play services. https://www.bountysource.com/issues/35722527-create-proper-pull-request-to-add-libresignal-s-websocket-support-to-ows-signal https://www.bountysource.com/issues/35722527-create-proper-p...
- lucideer 10y ago
  Just to clarify on mtreis76's bountysource link, that work has already been completed and submitted by 8bitkid, and we're just waiting for it to be merged into Signal. Discussion on this here: https://github.com/WhisperSystems/Signal-Android/pull/5962 https://github.com/WhisperSystems/Signal-Android/pull/5962
- snowpanda 10y ago
  They can't use the name LibreSignal because it has the word Signal in it? Wow, even Microsoft didn't behave that juvenile about LibreOffice.
  - metaobject 10y ago
    Yeah, they just sued some high school kid because of the domain name he chose: https://en.m.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft https://en.m.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft
    - fapjacks 10y ago
      I don't know about Canadian trademark law, but at least in the States, if you don't put effort into defending your trademark, you lose it. Completely different country, I know, but perhaps there's something similar in their law.
- lucideer 10y ago
  Also - I don't think the naming issue with LibreSignal was necessarily a legal one per se. Moxie just expressed his opinion that he didn't like that they were using "Signal" in the name. He didn't specifically ask them to rename it. They offered to rename it, to which he replied that he'd appreciate that. (They didn't rename it since they just discontinued it instead).

by usernam 10y ago

sschueller 10y ago

Wire uses the signal protocol. [1] I am not sure if they require google play services but I thought saw something a while back on their github regarding a fallback if google services was not installed and battery consumption. [1] https://wire.com/download/ https://wire.com/download/

ycmbntrthrwaway 10y ago
Wire uses Firebase Cloud Messaging (former Google Cloud Messaging) by default as it is the Google requirement. If you, as a developer, roll out your own solution, you simply get banned on Google Play. Claimed reason is that FCM/GCM delivers all your messages in batch, so it saves your phone power [0]. It is doubtful because your phone may enter Discontinuous Reception (DRX) state, so your cellular operator will deliver messages in batch anyway, but whatever. I think it is Google pushing developers to use their push servers while avoiding antitrust laws. GitHub message about fallback to WebSocket you are referring to is here: [1]. So you can remove all Google services from your phone and install APK, it will still work, but now Wire server pings your phone whenever it wants. TLDR on the thread is that APK is not uploaded to F-Droid due to dependency (not really) on Google services. [0] https://developer.android.com/training/monitoring-device-state/doze-standby.html https://developer.android.com/training/monitoring-device-sta... [1] https://github.com/wireapp/wire-android/issues/5#issuecomment-251411885 https://github.com/wireapp/wire-android/issues/5#issuecommen...
zedred 10y ago
They don't use the signal protocol, they don't even use X3DH or Double Ratchet. That citation of yours is just a download link, not an actual reference to your point. The project is also kind of a mess. Check out their privacy policy, Wire maintains a server side copy of your entire contact list, all the groups that you're in, the plaintext metadata for your groups (membership, plaintext group title, plaintext group avatar). Check out some of the code. They have broken voice encryption, and leak enough data to reconstruct the audio of your calls. They leak tons of plaintext directly back to themselves, like searches, and rolled their own messaging crypto. They have been caught lying about what kind of encryption they provide[1], they lied about being open source for years, they lied about being based in switzerland. From what I can tell, the only people promoting Wire are usually on Wire's marketing team. 1: http://www.pcworld.com/article/2855745/new-communications-app-wire-tones-down-encryption-claims.html http://www.pcworld.com/article/2855745/new-communications-ap...
- sschueller 10y ago
  According to wikipedia "its instant messages with Proteus, a protocol that Wire Swiss developed based on the Signal Protocol" [1] so I guess it is just based on it. [1] https://en.wikipedia.org/wiki/Wire_Swiss https://en.wikipedia.org/wiki/Wire_Swiss
- FabHK 10y ago
  I'm surprised at your negative take. The article you link is from 2014. They do encrypt chats now, and group chats, and voice, and video, all e2e, as far as I can tell. My understanding is that the developers sit in Berlin, but the legal entity is in Switzerland. Their privacy policy [1] states that they retain logs for 72h, and not much else. Only hashed contact info (emails/phone numbers) are uploaded, after opt-in. It all sounds very reasonable. Your argument seems to be that they're an untrustworthy mess - but I don't see much evidence of that, except for possibly some braggadocio in that old article. > Check out some of the code. Yes, it is on github [2], so you can do that, which is nice. [1] https://medium.com/wire-news/simple-privacy-policy-72-hour-log-retention-33d183ea0fb3#.oxksa5yf0 https://medium.com/wire-news/simple-privacy-policy-72-hour-l... [2] https://github.com/wireapp https://github.com/wireapp

mtreis86 10y ago

Used to be, called LibreSignal. They ran into legal issues. https://github.com/LibreSignal/LibreSignal https://github.com/LibreSignal/LibreSignal There is a bounty for modifying the signal app source to drop play services. https://www.bountysource.com/issues/35722527-create-proper-pull-request-to-add-libresignal-s-websocket-support-to-ows-signal https://www.bountysource.com/issues/35722527-create-proper-p...

lucideer 10y ago
Just to clarify on mtreis76's bountysource link, that work has already been completed and submitted by 8bitkid, and we're just waiting for it to be merged into Signal. Discussion on this here: https://github.com/WhisperSystems/Signal-Android/pull/5962 https://github.com/WhisperSystems/Signal-Android/pull/5962
snowpanda 10y ago
They can't use the name LibreSignal because it has the word Signal in it? Wow, even Microsoft didn't behave that juvenile about LibreOffice.
- metaobject 10y ago
  Yeah, they just sued some high school kid because of the domain name he chose: https://en.m.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft https://en.m.wikipedia.org/wiki/Microsoft_vs._MikeRoweSoft
  - fapjacks 10y ago
    I don't know about Canadian trademark law, but at least in the States, if you don't put effort into defending your trademark, you lose it. Completely different country, I know, but perhaps there's something similar in their law.
lucideer 10y ago
Also - I don't think the naming issue with LibreSignal was necessarily a legal one per se. Moxie just expressed his opinion that he didn't like that they were using "Signal" in the name. He didn't specifically ask them to rename it. They offered to rename it, to which he replied that he'd appreciate that. (They didn't rename it since they just discontinued it instead).