31 ms·
While the government can't crack Signal or put a backdoor in its official code, it could force your favorite appstore to send its own backdoored Signal to your
by aussieguy1234 8y ago
While the government can't crack Signal or put a backdoor in its official code, it could force your favorite appstore to send its own backdoored Signal to your phone as a push update.
Same goes for any apps, people will probably start turning off auto update now, makes for a much more secure world doesn't it?
- darkengine 8y agoI was under the impression that Google Play Store apps were cryptographically signed by the developer/publisher (not by Google), and the phone would refuse to update the app if the key behind the signature had changed. Am I wrong on this?
- ShorsHammer 8y agoWouldn't playstore itself be the the simplest yet most effective target for these laws rather than Signal? Signal themselves aren't on f-droid which has far more protections and the apk download is basically hidden on their site. Google certainly has no qualms about China, is draconian Australia much of a stretch?
- eythian 8y agoApplications are signed by Signal, so Google can't make fake ones.
- deleted 8y ago[deleted]
- craftyguy 8y agoGoogle does implement the apk signing verification (shipped as a binary in their ROMs), and they could easily make exceptions for applications if they wanted to. Don't assume that what you see in AOSP is the source form of what google ships.
- sschueller 8y agoYou don't need to crack signal. You just need to log what the user enters on the keyboard. On android any third party keyboard (SwiftKey, Swype etc.) is already collecting this data and probably just a warrant is needed to get to it.