4 ms·

I've also heard that Signal on android leaks message text because of google's keyboard auto-prediction feature. They should implement their own keyboard or fin

by cwkoss 6y ago

I've also heard that Signal on android leaks message text because of google's keyboard auto-prediction feature. They should implement their own keyboard or find a way to disable text prediction - and educate their users.

lrvick 6y ago
In general I would not expect much privacy from a stock Android device on any chat tool considering they shamelessly ship lots of third party blobs carriers demand be included, some of which like OMA-DM toolkits have sweeping permissions on your device. On Apple this is less true, but it is also a centralized black box that grants you no freedom, and apps can be banned at any time with little recourse. You could use something other than Android like PostmarketOS or Librem5 however odds are Signal won't create clients for those platforms considering Moxie has stated publicly he prefers distribution through proprietary channels in order to collect usage stats. Moxie has also stated he will actively fight any third party clients that try to join his network, so we won't likely see many of those attempted for alternative platforms either.
- joecool1029 6y ago
  > some of which like OMA-DM toolkits have sweeping permissions on your device. Fortunately this seems to be going away. For those not aware as to what you're talking about, this is the proprietary 'rootkit' providers like Sprint had to use to activate CDMA modems on their carriers on many of their devices that did not come with a CSIM. As it's doing a lot with the phone's modem, it needs tons of permissions on the device. Verizon Wireless and Google Fi also had similar apk's that were required to provision phones and update PRL (prority roaming list) information. In the US all modern devices on Verizon are CDMA-less and new Sprint customers are usually activated on T-Mobile network (with fallback to GSM/WCDMA not CDMA).
jfim 6y ago
On Android, Signal sets the flag on the text entry box that disables IME personalization, the same way that the text entry box works in Chrome's incognito mode. Whether or not Google respects it is not clear, but it does show a little incognito mode icon on the keyboard.
- cwkoss 6y ago
  Where do you see this icon? I don't think I have an incognito icon on my signal keyboard
  - jfim 6y ago
    In older versions of Android it'll look like this (https://www.androidpolice.com/2017/07/14/gboard-6-4-brings-incognito-mode-marshmallow-nougat-small-changes-apk-download/ https://www.androidpolice.com/2017/07/14/gboard-6-4-brings-i...), while newer versions of Android will have an icon on the top left of the keyboard, before the stickers, gif, clipboard, and cog buttons. This is with the default Google keyboard (gboard), your mileage may vary with other keyboards.
UncleMeat 6y ago
> They should implement their own keyboard or find a way to disable text prediction - and educate their users. They do disable personalized text prediction. You are just misleading readers.
- cwkoss 6y ago
  I don't think that is accurate. On my Pixel 3, when I type "fact" it suggests "factorio" which seems quite personalized. Is there a setting somewhere that needs to be flipped to opt into this behavior? EDIT: Yep, there is a setting in Signal for "Incognito Keyboard", I've never toggled it, and it was off when I went to settings.

by cwkoss 6y ago

lrvick 6y ago

In general I would not expect much privacy from a stock Android device on any chat tool considering they shamelessly ship lots of third party blobs carriers demand be included, some of which like OMA-DM toolkits have sweeping permissions on your device. On Apple this is less true, but it is also a centralized black box that grants you no freedom, and apps can be banned at any time with little recourse. You could use something other than Android like PostmarketOS or Librem5 however odds are Signal won't create clients for those platforms considering Moxie has stated publicly he prefers distribution through proprietary channels in order to collect usage stats. Moxie has also stated he will actively fight any third party clients that try to join his network, so we won't likely see many of those attempted for alternative platforms either.

joecool1029 6y ago
> some of which like OMA-DM toolkits have sweeping permissions on your device. Fortunately this seems to be going away. For those not aware as to what you're talking about, this is the proprietary 'rootkit' providers like Sprint had to use to activate CDMA modems on their carriers on many of their devices that did not come with a CSIM. As it's doing a lot with the phone's modem, it needs tons of permissions on the device. Verizon Wireless and Google Fi also had similar apk's that were required to provision phones and update PRL (prority roaming list) information. In the US all modern devices on Verizon are CDMA-less and new Sprint customers are usually activated on T-Mobile network (with fallback to GSM/WCDMA not CDMA).

jfim 6y ago

On Android, Signal sets the flag on the text entry box that disables IME personalization, the same way that the text entry box works in Chrome's incognito mode. Whether or not Google respects it is not clear, but it does show a little incognito mode icon on the keyboard.

cwkoss 6y ago
Where do you see this icon? I don't think I have an incognito icon on my signal keyboard
- jfim 6y ago
  In older versions of Android it'll look like this (https://www.androidpolice.com/2017/07/14/gboard-6-4-brings-incognito-mode-marshmallow-nougat-small-changes-apk-download/ https://www.androidpolice.com/2017/07/14/gboard-6-4-brings-i...), while newer versions of Android will have an icon on the top left of the keyboard, before the stickers, gif, clipboard, and cog buttons. This is with the default Google keyboard (gboard), your mileage may vary with other keyboards.

UncleMeat 6y ago

> They should implement their own keyboard or find a way to disable text prediction - and educate their users. They do disable personalized text prediction. You are just misleading readers.

cwkoss 6y ago
I don't think that is accurate. On my Pixel 3, when I type "fact" it suggests "factorio" which seems quite personalized. Is there a setting somewhere that needs to be flipped to opt into this behavior? EDIT: Yep, there is a setting in Signal for "Incognito Keyboard", I've never toggled it, and it was off when I went to settings.