5 ms·
I wonder what happens with Signal as it's US-based.
by nextos 7y ago
I wonder what happens with Signal as it's US-based.
- robert_foss 7y agoMaybe @moxie could enlighten us.
- hos234 7y agoNothing. Whoever is interested, has to get hold of the phones to access the messages.
- cheschire 7y agoHistorical messages, yes. However an app maker can be coerced into adding a hidden user that can participate in chats and receive all future messages decrypted. It doesn't require any special crypto hacks for that to work.
- zzzcpan 7y agoSignal may or may not be ok at the moment, but not in a couple of years (it has all the power to silently push an update with a backdoor). Among all the popular messaging apps only Telegram is in a position to not cooperate with five eyes.
- aorth 7y agoSure, but the Signal source code is open source. I've been compiling it myself for years on Android (and signing the binary with my own key). They can't silently push a binary from the Play Store and overwrite my binary.
- zzzcpan 7y agoThey still can for everyone else, probably everyone you talk to over Signal, so not much of a protection. Pretty much the only way to avoid that is for Signal to give up that control, don't supply Signal directly and let others build Signal from sources and publish in independent from Signal package repositories, i.e. f-droid, OS package managers on Linux, etc. Even if they don't federate, it will at least make their end-to-end encryption sound, not useless like it is now when everyone uses Signal supplied binaries.
- 6gvONxR4sf7o 7y agoPresumably, for most of us here, even if we compiled it ourselves, most of the people we'll communicate with won't.
- abledon 7y agoDude, I can only imagine what you are doing that you need to be so secretive lol
- aorth 7y agoI think "trust, but verify" and "verifiable security" are good axioms.
- eitland 7y ago