3 ms·

What prevents Google from replacing Signal on the Android Application store with their custom and backdoored version ? Can we check a hash or something ? Does t

What prevents Google from replacing Signal on the Android Application store with their custom and backdoored version ? Can we check a hash or something ? Does the signal foundation do that on a regular basis ?

paulgb 6y ago
If Google wanted to read your messages and were willing to use malware to do it, there’s little to stop them on Android. Even if Signal checked the apk regularly, there’s no guarantee that the apk served to them is the same one served to everyone else. They could also push an update to the OS that recognizes the Signal apk and applies a patch after downloading but before installing. That said, Signal does apparently support reproducible builds so that people can check that the apk matches what’s on GitHub (though this is more of a way to detect malfeasance on Signal’s part rather than Google’s) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/
- johnchristopher 6y ago
  > They could also push an update to the OS that recognizes the Signal apk and applies a patch after downloading but before installing. Ah, right, there's also that.
- jrockway 6y ago
  Never forget to reflect on trusting trust, of course: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
oneplane 6y ago
Nothing, because they can also just read it off of your phone and don't need to 'break' Signal.
mjg59 6y ago
Signal is signed with a key that's held by Signal, not Google. Android won't install app updates unless they're signed with the same key as the currently installed version. (I work at Google, but not on Android)
restingrobot 6y ago
You can verify the installed version on Android with the Github repo version. Yes you can essentially check a hash.
paxys 6y ago
There's nothing stopping Google from silently pushing a keylogger to your phone and recording every single thing you do. They don't need to hijack Signal or anything else for that. By using your phone you are implicitly trusting Google, the manufacturer and several other parties.

paulgb 6y ago

If Google wanted to read your messages and were willing to use malware to do it, there’s little to stop them on Android. Even if Signal checked the apk regularly, there’s no guarantee that the apk served to them is the same one served to everyone else. They could also push an update to the OS that recognizes the Signal apk and applies a patch after downloading but before installing. That said, Signal does apparently support reproducible builds so that people can check that the apk matches what’s on GitHub (though this is more of a way to detect malfeasance on Signal’s part rather than Google’s) https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/

johnchristopher 6y ago
> They could also push an update to the OS that recognizes the Signal apk and applies a patch after downloading but before installing. Ah, right, there's also that.
jrockway 6y ago
Never forget to reflect on trusting trust, of course: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

oneplane 6y ago

Nothing, because they can also just read it off of your phone and don't need to 'break' Signal.

mjg59 6y ago

Signal is signed with a key that's held by Signal, not Google. Android won't install app updates unless they're signed with the same key as the currently installed version. (I work at Google, but not on Android)

restingrobot 6y ago

You can verify the installed version on Android with the Github repo version. Yes you can essentially check a hash.

paxys 6y ago

There's nothing stopping Google from silently pushing a keylogger to your phone and recording every single thing you do. They don't need to hijack Signal or anything else for that. By using your phone you are implicitly trusting Google, the manufacturer and several other parties.