5 ms·
Yeah exactly, we can't read cypher text and so aren't included in the end to end encryption contract of signal. Frankly this is nothing to do with signal and ev
by Guthur 6y ago
Yeah exactly, we can't read cypher text and so aren't included in the end to end encryption contract of signal. Frankly this is nothing to do with signal and everything to do with phone security.
- heavyset_go 6y agoDoes Signal still require you to register and verify using a real cell phone number?
- godelski 6y agoYes. But note that Signal doesn't know your number. Usernames are being promised this year too.
- heavyset_go 6y ago> But note that Signal doesn't know your number Courts can compel them to keep these records, and require them to not disclose to their customers that they are doing so.
- godelski 6y agoMy understanding is that the phone number is never even sent to Signal in the first place. So doing so would result in a git commit.
- kps 6y agoAssuming the published app matches the published source.
- busterarm 6y agoIs there an audit trail showing that the compiled binary available in the App store is the same one you build from source?
- bigiain 6y agoSadly, no. There’s still some “trust” required in both Whispersystems to not backdoor updates, as well as Apple and Google to not backdoor the distributed apps after Whispersystems submit updates for publication. There is though, some ability for skilled enough people to “trust but verify” by reversing the app bundles after publication. I believe (but not for any good evidence based reason) that there are “enough eyeballs” interested in Signal that _hopefully_ if a backdoored app update ever appears the white hats will raise the alarm quickly (I have no doubt the black hats will sell the details to NSO/GreyKey just as quickly...)
- godelski 6y agoYou are able to compile from source though...
- bigiain 6y agoAt least Apple have demonstrated pushing back on a court order requiring them to fundamentally break their product’s advertised security to comply with such an order. I’d be curious to see if WhisperSystems are prepared enough to lawyer up and fight like that. (I suspect they’d probably get NSLed like Lavabit did we won’t know about it until way later...)
- simple_phrases 6y agoAccording to the Snowden leaks, Apple's been a part of PRISM for quite some time. Seems to me like the trial was a show for PR, and a win for the FBI because now a ton of people are under the impression that they can commit crimes without a trace if they have an iPhone.
- ixwt 6y agoI'm no legal expert, but that seems difficult for a court to do. They're not legislative (or, not supposed to be). And I'm certain the ACLU would fight that tooth and nail. Signal was subpoenaed in court, and told to give up information[0] on certain customers. They replied the only information they had was the time the account was created and the date of the last connection. Admittedly, this was over 5 years ago. They fought to get these court records released. [0]: https://arstechnica.com/tech-policy/2016/10/fbi-demands-signal-user-data-but-theres-not-much-to-hand-over/ https://arstechnica.com/tech-policy/2016/10/fbi-demands-sign...
- TwoBit 6y agoHow about if Signal encrypted all your stored communication when not in use and required a password (and 2FA) to decrypt it? Thus the app's security is ~independent of phone security, at least for forensic seizure analysis.