6 ms·

Signal is still centrally controlled and compiled by a single entity and distributed only in an unsigned insecure form or in a signed/verified manner only if yo

by lrvick 6y ago

Signal is still centrally controlled and compiled by a single entity and distributed only in an unsigned insecure form or in a signed/verified manner only if you give up your privacy to install with Google Play or the Apple store. Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Moxie has stated he will not support anyone but his team compiling or distributing Signal binaries so third party signed builds via privacy focused app stores like F-Droid are out. All builds must also use Signal centralized servers even though that centralizes TCP/IP metadata, etc. Not to mention you need to show government ID to get a SIM to use the Signal wallet for said private currency/messenger in 200 countries. Secondly having a decentralized currency whose servers can only run on Intel machines with Intel SGX is a very centralized supply chain as well. A single supply chain attack on Intel microcode or related SGX updates could run malicious code and game over for the currency globally? A government that sees MobileCoin as a threat could make Intel do this. With a SPOF on the supply chain of the only client people are expected to use and another SPOF on the only hardware enclave people are supposed to use for servers... decentralized is technically true but not used in the same way as most other projects that use that word. I will keep an eye on this experiment though, because there are some unique ideas here which could have value should your trust anchors expand beyond Intel and Signal.

hiq 6y ago
> distributed only in an unsigned insecure form or in a signed/verified manner only if you give up your privacy to install with Google Play or the Apple store. > Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Nope: https://signal.org/android/apk/ https://signal.org/android/apk/
- stonesweep 6y ago
  You may be missing the subtle point - the APK provided is the same one from Google Play, which includes the Google SDK encumbered libraries (links? hooks? features?). If you run a libre device without the Google Play store (non-Google android build) then the software cannot function. The code for the client is open source, but the act of compiling it against the required Play store libraries encumbers the final binary. F-Droid requires that all code compile without the Google SDKs in order to be hosted (IIRC).
  - Mediterraneo10 6y ago
    You are being a bit too subtle for many people. I think most reading your post above are going to understand it as claiming that the Signal APK downloadable from Signal's website requires Google Play Services or the Play store in order to run. That is not the case, as any LineageOS user can tell you.
  - hiq 6y ago
    > If you run a libre device without the Google Play store (non-Google android build) then the software cannot function I think you mean either of two things: 1. running the APK they build on a device without Google Service does not work 2. running the APK they build on a device means it's no longer running only libre software 1. is not true, so I assume you mean 2. I guess that's true, but in practice I think that the compiled dependency doesn't do anything if you don't have the services on your phone (don't quote me on that). It's not free software, but it's still better than the competition.
    - stonesweep 6y ago
      I think it sort of floats in 2 territory and sort of resembles the LGPL based kernel modules which require a binary firmware blob to run (kind of, not exactly). In order to create the APK, the code must compile against the SDK and encumber it by binding to an API, however if I understand this correctly in Android terms it means a stub of non-free code is now inside your APK, instead of say an external firmware blob. (I am not an Android coder to know the subtle details here) (I'm aware that the code will try and use Google services, then if it fails it falls back to websocket(?) - so the actual Services don't have to be present, but the compiled APK contains the non-free hooks to use it if present? I tried to use the word encumbered to reflect that)
  - Vinnl 6y ago
    Others seem to interpret this as your saying that downloading the APK results in non-free code being present on your system, but > If you run a libre device without the Google Play store (non-Google android build) then the software cannot function. is just not true. I don't have the Google Play Store (I'm on a non-Google Android build) and Signal functions just fine. (Well, mostly fine - it has to maintain its own connection because of course it can't use Google's tooling for that, so it supposedly has more battery impact.)
AfouToPatisa 6y ago
Even if an SGX attack does take place, tx's aren't recognized as the system is secured with Cryptonote's ring signatures (1st reply in FAQ https://github.com/mobilecoinfoundation/mobilecoin https://github.com/mobilecoinfoundation/mobilecoin) here too about 11mins in - https://www.youtube.com/watch?v=e9afDQ_M5CU https://www.youtube.com/watch?v=e9afDQ_M5CU
- codethief 6y ago
  The problem is: Signal already relies on SGX for lots of other features (Signal PINs & Secure Value Recovery, contact discovery etc. etc.) and these depend on SGX working as advertized.
  - AlexCoventry 6y ago
    I wasn't aware that Signal relies on SGX. If I want to use Signal without being exposed to risk of SGX compromise, is it still possible?
    - codethief 6y ago
      For contact discovery, AFAIK no[0]. For everything else: Yes, by setting a randomized long Signal PIN since SGX is effectively used to add entropy to Signal PINs[1]. You can also disable Signal PINs – in this case Signal will simply set a randomized long PIN for you. [0]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ [1]: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
      - AlexCoventry 6y ago
        Thanks!
ac29 6y ago
> Not to mention you need to show government ID to get a SIM to use the Signal wallet for said private currency/messenger in 200 countries. There are less than 200 countries in total, unless you get very creative with states that are arent recognized more more than a handful of other countries, like Abkhazia or Transnistria. You also dont need ID to buy SIM cards in the US, so I'm curious on how valid this assertion is.
- Klonoar 6y ago
  None of this particularly matters given that Signal is actively working on not requiring phone numbers.
  - Mediterraneo10 6y ago
    Signal is actively working on other identifiers than a phone number, but can you cite proof that no phone will be required at all? I got the impression that Signal will still require a phone number at signup to do SMS verification, and only then give you a way to provide non-phone-number identifiers to contacts.
    - Klonoar 6y ago
      Eh, fair. I cannot cite proof, only note that every instance I've seen Signal promise this feature has been worded in a way that indicates no phone number would be required. It is unfortunate that I don't see many from Signal on this forum, as it'd be nice if someone would just clarify this already considering the popularity of it as a feature request.
      - pixxel 6y ago
        Not from Signal but the MobileCoin CEO posted this answer yesterday. ..... >>The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How do you stop impersonation? A: Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification. ..... Reads to me like phone numbers are not going away.
2OEH8eoCRo0 6y ago
>compiling every release by hand Clicking build in Android Studio?
nullc 6y ago
> Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Particularly because the software is timebombed and stops working after a while (and also blocked on the server side if you bypass the client side timebomb).

by lrvick 6y ago

hiq 6y ago

> distributed only in an unsigned insecure form or in a signed/verified manner only if you give up your privacy to install with Google Play or the Apple store. > Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Nope: https://signal.org/android/apk/ https://signal.org/android/apk/

stonesweep 6y ago
You may be missing the subtle point - the APK provided is the same one from Google Play, which includes the Google SDK encumbered libraries (links? hooks? features?). If you run a libre device without the Google Play store (non-Google android build) then the software cannot function. The code for the client is open source, but the act of compiling it against the required Play store libraries encumbers the final binary. F-Droid requires that all code compile without the Google SDKs in order to be hosted (IIRC).
- Mediterraneo10 6y ago
  You are being a bit too subtle for many people. I think most reading your post above are going to understand it as claiming that the Signal APK downloadable from Signal's website requires Google Play Services or the Play store in order to run. That is not the case, as any LineageOS user can tell you.
- hiq 6y ago
  > If you run a libre device without the Google Play store (non-Google android build) then the software cannot function I think you mean either of two things: 1. running the APK they build on a device without Google Service does not work 2. running the APK they build on a device means it's no longer running only libre software 1. is not true, so I assume you mean 2. I guess that's true, but in practice I think that the compiled dependency doesn't do anything if you don't have the services on your phone (don't quote me on that). It's not free software, but it's still better than the competition.
  - stonesweep 6y ago
    I think it sort of floats in 2 territory and sort of resembles the LGPL based kernel modules which require a binary firmware blob to run (kind of, not exactly). In order to create the APK, the code must compile against the SDK and encumber it by binding to an API, however if I understand this correctly in Android terms it means a stub of non-free code is now inside your APK, instead of say an external firmware blob. (I am not an Android coder to know the subtle details here) (I'm aware that the code will try and use Google services, then if it fails it falls back to websocket(?) - so the actual Services don't have to be present, but the compiled APK contains the non-free hooks to use it if present? I tried to use the word encumbered to reflect that)
- Vinnl 6y ago
  Others seem to interpret this as your saying that downloading the APK results in non-free code being present on your system, but > If you run a libre device without the Google Play store (non-Google android build) then the software cannot function. is just not true. I don't have the Google Play Store (I'm on a non-Google Android build) and Signal functions just fine. (Well, mostly fine - it has to maintain its own connection because of course it can't use Google's tooling for that, so it supposedly has more battery impact.)

AfouToPatisa 6y ago

Even if an SGX attack does take place, tx's aren't recognized as the system is secured with Cryptonote's ring signatures (1st reply in FAQ https://github.com/mobilecoinfoundation/mobilecoin https://github.com/mobilecoinfoundation/mobilecoin) here too about 11mins in - https://www.youtube.com/watch?v=e9afDQ_M5CU https://www.youtube.com/watch?v=e9afDQ_M5CU

codethief 6y ago
The problem is: Signal already relies on SGX for lots of other features (Signal PINs & Secure Value Recovery, contact discovery etc. etc.) and these depend on SGX working as advertized.
- AlexCoventry 6y ago
  I wasn't aware that Signal relies on SGX. If I want to use Signal without being exposed to risk of SGX compromise, is it still possible?
  - codethief 6y ago
    For contact discovery, AFAIK no[0]. For everything else: Yes, by setting a randomized long Signal PIN since SGX is effectively used to add entropy to Signal PINs[1]. You can also disable Signal PINs – in this case Signal will simply set a randomized long PIN for you. [0]: https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ [1]: https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
    - AlexCoventry 6y ago
      Thanks!

ac29 6y ago

> Not to mention you need to show government ID to get a SIM to use the Signal wallet for said private currency/messenger in 200 countries. There are less than 200 countries in total, unless you get very creative with states that are arent recognized more more than a handful of other countries, like Abkhazia or Transnistria. You also dont need ID to buy SIM cards in the US, so I'm curious on how valid this assertion is.

Klonoar 6y ago
None of this particularly matters given that Signal is actively working on not requiring phone numbers.
- Mediterraneo10 6y ago
  Signal is actively working on other identifiers than a phone number, but can you cite proof that no phone will be required at all? I got the impression that Signal will still require a phone number at signup to do SMS verification, and only then give you a way to provide non-phone-number identifiers to contacts.
  - Klonoar 6y ago
    Eh, fair. I cannot cite proof, only note that every instance I've seen Signal promise this feature has been worded in a way that indicates no phone number would be required. It is unfortunate that I don't see many from Signal on this forum, as it'd be nice if someone would just clarify this already considering the popularity of it as a feature request.
    - pixxel 6y ago
      Not from Signal but the MobileCoin CEO posted this answer yesterday. ..... >>The UK also has receiver verification. If I try to send to an account and it doesn't match the name I'm sending to, my bank will warn me. How do you stop impersonation? A: Signal relies on phone numbers for identities. Other apps that integrate MobileCoin may have a higher threshold for identification. ..... Reads to me like phone numbers are not going away.

2OEH8eoCRo0 6y ago

>compiling every release by hand Clicking build in Android Studio?

nullc 6y ago

> Those that only run open source software like myself have no secure way to run Signal short of compiling every release by hand which is impractical. Particularly because the software is timebombed and stops working after a while (and also blocked on the server side if you bypass the client side timebomb).