3 ms·
This is very true. Reproducible builds for mobile apps would be far superior. You can build Signal from source for Android if you wish, although obviously this
by 2cb 6y ago
This is very true. Reproducible builds for mobile apps would be far superior. You can build Signal from source for Android if you wish, although obviously this is a massive pain to do for each update, there’s absolutely nothing stopping you from doing it.
On iOS it's a lot more difficult to get the required certificates from Apple but you can run your own build in Xcode and deploy it to your personal device if you are a registered Apple developer.
While reproducible builds are obviously the gold standard, for apps you install from the Play Store or the App Store, developers sign the apps that get distributed with their own private keys. As Google and Apple don’t have access to these it should be verifiable that the apps are not tampered with.
There is an exception here with the Play Store, where there is an opt-in option for Google to sign the app on your behalf [1], but I think we can safely assume Signal are manually signing with their own private keys.
In any case it's easy to just grab an APK from an Android device and check signatures for yourself.
For iOS though, no surprises here it’s locked down. Although from what I gather reading Apple’s security documentation, it confirms that apps must be signed by developers with their private keys. [2] But unlike Android there’s sadly no way I can tell for the user to independently verify this without jailbreaking.
But ultimately, short of building each version yourself, all this is moot if you distrust the developers.
[1] https://developer.android.com/studio/publish/app-signing https://developer.android.com/studio/publish/app-signing
[2] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...
- hanniabu 6y agoAre there any instructions to build the app yourself for signal?
- mariojv 6y agoYes, they have some docs on GitHub for how to do it: https://github.com/signalapp/Signal-Android/wiki/How-to-build-Signal-from-the-sources https://github.com/signalapp/Signal-Android/wiki/How-to-buil... You can build the iOS version too for development: https://github.com/signalapp/Signal-iOS/blob/master/BUILDING.md https://github.com/signalapp/Signal-iOS/blob/master/BUILDING... I haven't done it before but you should even be able to deploy that build to your phone in theory: https://codewithchris.com/deploy-your-app-on-an-iphone/ https://codewithchris.com/deploy-your-app-on-an-iphone/ It's unclear to me if there are any restrictions on iOS that would prevent you from doing that.
- josephg 6y agoI spent a few hours trying to get a local build of signal-ios working a few weeks ago, in order to write a PR fix a bug with lost voice messages. The xcode project uses a plethora of device entitlements I'm not allowed to have (since I don't have the proper signal signing key). Even after a couple hours of tweaking to get it building and deployed to my device, its currently crashing on startup because it can't access some special signal local device store. You can certainly get your own build working (without notifications and other features). But personally I found it prohibitively difficult to do so.
- hanniabu 6y agoI just realized one issue with this is that their latest production branch is private so you would receive delayed updates.
- Nextgrid 6y agoI think you will have a problem when it comes to push notifications. I doubt a local build would be able to receive push notifications addressed to App Store builds.