3 ms·

On Android (at least); you can verify that the apk is signed with the developer's key; and Signal provides reproducible builds. Then the app is designed to not

by Aissen 9y ago

On Android (at least); you can verify that the apk is signed with the developer's key; and Signal provides reproducible builds. Then the app is designed to not trust the server. I think we are in agreement that Apple or Google could patch the app before it gets deployed. But AFAIK it has never been done yet, and if it ever happens, it would undermine all credibility of the platform. Of course a state actor wouldn't want to be the first to find out.

cm2187 9y ago
Thinking about it, Google and Apple actually don't even need to patch the app, they have access to all key strokes and screen rendering. It just needs to be a few lines of code hidden anywhere.
- Aissen 9y ago
  This would need patching the OS at runtime, but yes, it's also possible.
  - cm2187 9y ago
    What I mean is that perhaps they already have.
    - Aissen 9y ago
      It's a possibility. It just wouldn't make any business sense, it's a pure self-destruct button. And there are hundreds of reverse engineers on both platforms that could have caught it by now.