3 ms·
As others have pointed out, we users of Signal have no way of verifying that the code running on the server we connect to is the code they've released. We are
by Frondo 6y ago
As others have pointed out, we users of Signal have no way of verifying that the code running on the server we connect to is the code they've released.
We are very much trusting the Signal team to do what they're saying (not logging, not leaking) and to make no mistakes in doing it (not logging accidentally, not leaking accidentally).
Which is in general a fair trade-off, but it is very much a trade-off, open audits notwithstanding.
- junon 6y agoWhere does Signal prevent you from using your own server? Spin up your own and use it if you'd like. https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
- NateEag 6y agoAs I pointed out elsewhere in the thread, Signal uses SGX to let clients confirm exactly what version of the contact discovery server software they're running against: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ It's not bulletproof by any means (https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ goes into this, and also points out several features they've used SGX for since), but it's certainly something, and they're doing it.