3 ms·

This my professional opinion since I lack the resources to perform a true analysis, so instead I speculate based on current nation state trends and the US gover

This my professional opinion since I lack the resources to perform a true analysis, so instead I speculate based on current nation state trends and the US government’s surveillance track record. Signal is a big red flag to me. I choose not to trust it. Signal specifically targets an audience of interest for the NSA—those who are actively trying to encrypt their communication. I have an eking suspicion that Signal could be a surveillance tool similar to the UAE’s ToTok messaging app. I don’t care if it is open source or uses E2E encryption. Unless you’re jailbroken or rooted and can install unsigned binaries, the binary you installed from the Play Store or App Store could contain backdoors. Your decision to trust and use this should be judiciously evaluated based on your threat model.

thosakwe 7y ago
This is literally the definition of FUD.
- mechnesium 7y ago
  How? Can you prove the binaries on the Play Store/App Store do not have backdoors? Most nation states engage in domestic surveillance. Here is a story about ToTok: https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.html https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.... Logically, chat applications are an ideal platform to engage in surveillance. There is no FUD here.
  - jblwps 7y ago
    As greysonp points out, yes; Signal has had reproducible builds since March 2016. So we can prove that those published binaries do not have backdoors insofar as we can prove that the corresponding source code does not have backdoors.
    - mechnesium 7y ago
      If you didn’t create the binary yourself how can you trust it?
      - jblwps 7y ago
        Because you can reproduce that binary bit-for-bit to confirm its corresponding source code. That's the point of a reproducible build. https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds
- tripzilch 7y ago
  Literally yes, but it's a very reasonable fear based on a very prominent level of uncertainty and doubt in quite a few of Signal's / Moxie's decisions.
dependenttypes 7y ago
Is the binary from play/app store not reproducible? (without the google/apple signature that is)
- mechnesium 7y ago
  That’s a valid question. Do these platforms provide users with signatures/checksums to reference?
  - greysonp 7y ago
    Signal has had reproducible builds since March 2016. https://github.com/signalapp/Signal-Android/blob/master/ReproducibleBuilds.md https://github.com/signalapp/Signal-Android/blob/master/Repr...
    - mechnesium 7y ago
      Does the App Store or Play Store provide a checksum of the binary to compare to the self compiled binary?
alexandrerond 7y ago
I also had this thought. Given how vehemently reproducible f-droid builds were rejected, along with forks, and the app insistance in "phoning home" continuously on phones without Google Play at the expense of the battery, regardless of the multiple fixes submitted that were ignored. The outdated openssl in signal-desktop, the lack of libsignal development vs fancy UI, the strong rejection of any sort of federation work as "too hard", the plans to upload contacts somewhere as if the masses they target needed this at all... but yeah they added stickers so must be legit.

thosakwe 7y ago

This is literally the definition of FUD.

mechnesium 7y ago
How? Can you prove the binaries on the Play Store/App Store do not have backdoors? Most nation states engage in domestic surveillance. Here is a story about ToTok: https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.html https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.... Logically, chat applications are an ideal platform to engage in surveillance. There is no FUD here.
- jblwps 7y ago
  As greysonp points out, yes; Signal has had reproducible builds since March 2016. So we can prove that those published binaries do not have backdoors insofar as we can prove that the corresponding source code does not have backdoors.
  - mechnesium 7y ago
    If you didn’t create the binary yourself how can you trust it?
    - jblwps 7y ago
      Because you can reproduce that binary bit-for-bit to confirm its corresponding source code. That's the point of a reproducible build. https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds
tripzilch 7y ago
Literally yes, but it's a very reasonable fear based on a very prominent level of uncertainty and doubt in quite a few of Signal's / Moxie's decisions.

dependenttypes 7y ago

Is the binary from play/app store not reproducible? (without the google/apple signature that is)

mechnesium 7y ago
That’s a valid question. Do these platforms provide users with signatures/checksums to reference?
- greysonp 7y ago
  Signal has had reproducible builds since March 2016. https://github.com/signalapp/Signal-Android/blob/master/ReproducibleBuilds.md https://github.com/signalapp/Signal-Android/blob/master/Repr...
  - mechnesium 7y ago
    Does the App Store or Play Store provide a checksum of the binary to compare to the self compiled binary?

alexandrerond 7y ago

I also had this thought. Given how vehemently reproducible f-droid builds were rejected, along with forks, and the app insistance in "phoning home" continuously on phones without Google Play at the expense of the battery, regardless of the multiple fixes submitted that were ignored. The outdated openssl in signal-desktop, the lack of libsignal development vs fancy UI, the strong rejection of any sort of federation work as "too hard", the plans to upload contacts somewhere as if the masses they target needed this at all... but yeah they added stickers so must be legit.