5 ms·

Originally, I didn't install signal because i have a google-free android smartphone, and signal depends/depended HARD on the play framework, even though that's

by jabot 9y ago

Originally, I didn't install signal because i have a google-free android smartphone, and signal depends/depended HARD on the play framework, even though that's not necessary. [1] > Marlinspike reiterated that the whole point of end-to-end encryption is that users no longer need to trust anyone if the protocol works — and Signal does. But it depended on the google play framework - and I don't trust google. So where does that leave me? EDIT: To reiterate: As far as I can tell Signal itself is secure enough. However, the most secure chat app is insecure if it is run on an insecure operating system. Now, I don't want to start a discussion about android security. But: - The update situation is quite bad, leaving (for example) my phone with exploitable bluetooth - Google itself ... could at least be coerced by a state actor into compromising anyone's privacy With those two facts given, the practical difference between signal and telegram seems... less relevant. [1]: Look at the "conversations" app. Yes, it is for XMPP, which is old and uncool - but it (a) doesn't use the play framework either and (b) uses very little battery on my phone, despite holding an open connection most of the time. That IMO proves that depending on the play framework is unnecessary in this case.

ultra2d 9y ago
It no longer has a hard dependency: "since Signal 3.30.0 that is not a hard dependency anymore." [1]. [1] https://copperhead.co/android/docs/usage_guide#signal https://copperhead.co/android/docs/usage_guide#signal
m3adow 9y ago
Isn't the dependency gone now? I think I read something about using WebSockets instead, although with more battery drain.
- jabot 9y ago
  Yes, someone below commented that telegram can now be built without dependency on the play framework, apparently since at least 6 months ago. I think that is a good thing, kudos to them. The thing that would make me really happy is a play-framework-free build on f-droid. I'm not holding my breath, though...
  - sasvari 9y ago
    The apk can be directly downloaded on their website [0]. It is signed by OWS, runs without gapps installed via websockets and should be 'auto-updating'. f-droid would be nice, I agree. I did not really follow the whole political discussion about why moxie refuses to cooperate, but at least I can use signal again after some years without gapps. [0] https://signal.org/android/apk/ https://signal.org/android/apk/
    - kuschku 9y ago
      > I did not really follow the whole political discussion about why moxie refuses to cooperate, but at least I can use signal again after some years without gapps. F-Droid offers two options (a) they build your app, or (b) you use reproducible builds, they rebuild your app, and verify that it produces the same result. Moxie raged that people should trust him instead of F-Droid for builds, so (a) wouldn’t be an option, and was awfully silent about (b), especially considering that Signal now has reproducible builds, but he refuses to allow that option, too.
  - masklinn 9y ago
    > someone below commented that telegram can now be built without dependency on the play framework Do you mean "signal"? Telegram is very specifically the pseudo-secure messenger shit-talking Signal and Marlinspike.
    - jabot 9y ago
      Yes. My bad, i meant signal. m(
- lucb1e 9y ago
  > although with more battery drain. Telegram doesn't drain battery at all and doesn't need Google. Not sure what Signal and others do, but of Wire I know that they drain battery as fast as if I had a game running constantly in the background. Signal I'd use, but it (still) doesn't work on my phone because I've got many Google software firewalled. When reporting this bug years ago it was a WONTFIX. I also heard they removed that dependency months ago and I keep trying every few months, but Signal won't even let me confirm my phone number because it relies on Google so deeply, so I can't use it. So unfortunately Telegram is still my messenger of choice: high usability, everyone has it, it's not owned by some big corporation and it's not of the USA, and optional encryption (for non-group chats) is better than nothing.
  - bubblethink 9y ago
    Have you tried CopperheadOS ? It doesn't include any google services, and signal/noise still works on it from what I've read. So the dependence on google might be a superficial misconfiguration.
  - magic_quotes 9y ago
    > optional encryption is better than nothing It's strictly worse than nothing. Opting to use optional end-to-end encryption basically shouts to your local friendly dictatorship, "Hey, look at this person!" Would you like that kind of attention? There are no such concerns with mandatory end-to-end encryption. It probably would be banned altogether, but that's a different problem.

by jabot 9y ago

ultra2d 9y ago

It no longer has a hard dependency: "since Signal 3.30.0 that is not a hard dependency anymore." [1]. [1] https://copperhead.co/android/docs/usage_guide#signal https://copperhead.co/android/docs/usage_guide#signal

m3adow 9y ago

Isn't the dependency gone now? I think I read something about using WebSockets instead, although with more battery drain.

jabot 9y ago
Yes, someone below commented that telegram can now be built without dependency on the play framework, apparently since at least 6 months ago. I think that is a good thing, kudos to them. The thing that would make me really happy is a play-framework-free build on f-droid. I'm not holding my breath, though...
- sasvari 9y ago
  The apk can be directly downloaded on their website [0]. It is signed by OWS, runs without gapps installed via websockets and should be 'auto-updating'. f-droid would be nice, I agree. I did not really follow the whole political discussion about why moxie refuses to cooperate, but at least I can use signal again after some years without gapps. [0] https://signal.org/android/apk/ https://signal.org/android/apk/
  - kuschku 9y ago
    > I did not really follow the whole political discussion about why moxie refuses to cooperate, but at least I can use signal again after some years without gapps. F-Droid offers two options (a) they build your app, or (b) you use reproducible builds, they rebuild your app, and verify that it produces the same result. Moxie raged that people should trust him instead of F-Droid for builds, so (a) wouldn’t be an option, and was awfully silent about (b), especially considering that Signal now has reproducible builds, but he refuses to allow that option, too.
- masklinn 9y ago
  > someone below commented that telegram can now be built without dependency on the play framework Do you mean "signal"? Telegram is very specifically the pseudo-secure messenger shit-talking Signal and Marlinspike.
  - jabot 9y ago
    Yes. My bad, i meant signal. m(
lucb1e 9y ago
> although with more battery drain. Telegram doesn't drain battery at all and doesn't need Google. Not sure what Signal and others do, but of Wire I know that they drain battery as fast as if I had a game running constantly in the background. Signal I'd use, but it (still) doesn't work on my phone because I've got many Google software firewalled. When reporting this bug years ago it was a WONTFIX. I also heard they removed that dependency months ago and I keep trying every few months, but Signal won't even let me confirm my phone number because it relies on Google so deeply, so I can't use it. So unfortunately Telegram is still my messenger of choice: high usability, everyone has it, it's not owned by some big corporation and it's not of the USA, and optional encryption (for non-group chats) is better than nothing.
- bubblethink 9y ago
  Have you tried CopperheadOS ? It doesn't include any google services, and signal/noise still works on it from what I've read. So the dependence on google might be a superficial misconfiguration.
- magic_quotes 9y ago
  > optional encryption is better than nothing It's strictly worse than nothing. Opting to use optional end-to-end encryption basically shouts to your local friendly dictatorship, "Hey, look at this person!" Would you like that kind of attention? There are no such concerns with mandatory end-to-end encryption. It probably would be banned altogether, but that's a different problem.