4 ms·
OK. How can you guarantee that your favorite three-letter agency does not have an agreement with Signal, so they can MITM you transparently, or deliver a custom
by atemerev 6y ago
OK. How can you guarantee that your favorite three-letter agency does not have an agreement with Signal, so they can MITM you transparently, or deliver a custom-built app to you? Trustless is the only way to fly. I don’t need to trust any central authority to pay someone with Bitcoin or other cryptocurrencies. Why should I trust someone to route my messages?
- IshKebab 6y agoIt is actually possible because Signal is 1. Open source. 2. Has verifiable builds (just being open source isn't enough). 3. Uses end to end encryption. You need all three of those to get what you want. Also you need to spend a ton of time building Signal from source and auditing it, which I doubt you're going to bother with but at least in theory it is possible.
- deleted 6y ago[deleted]
- kitkat_new 6y ago4. Verification
- heldergg 6y agoWhat's running server side?
- IshKebab 6y agoDoesn't matter. The client uses end-to-end encryption. That's kind of the whole point.
- codethief 6y ago> so they can MITM you They can't, provided you verify the (reproducible) builds you download from the app store and check your verification codes. Besides, it would be rather difficult for Signal to target just you and hand-deliver a custom build to you – Apple/Google would have to in on this, too. And if you use a Play Store alternative like the Aurora Store with a random Google account, this wouldn't work, either. > Why should I trust someone to route my messages? Unless you want to put the cables in the ground yourself and run the entire internet's infrastructure on your own, you'll always have to trust someone.