3 ms·

> AFAIK the Signal app doesn't connect to the Google servers directly, so even if it exists, the cookie doesn't get transferred anywhere. The Firebase Cloud Mes

> AFAIK the Signal app doesn't connect to the Google servers directly, so even if it exists, the cookie doesn't get transferred anywhere. The Firebase Cloud Messaging library / Google Play Services on your phone do connect to Google but they carry unique identifiers, anyway. It does connect to google's servers for pretty much everything [1] - you can look for these constants in the codebase and you'll find lots of things that would worry any netsec person, including the key backup related stuff. Signal doesn't only use firebase for the sake of Push Notifications. Also have in mind that push notifications/firebase is unnecessary with a high priority notification, which is what e.g. other f-droid FOSS forks of other apps use instead. > What legal threats? (I'm familiar with the discussion but I have yet to see Moxie threatening anyone.) Granted, most of the discussions in LibreSignal's repo [2] got very heated very quickly. Can't find the twitter thread of @moxie at the time, and lots of replies in there got deleted from both sides. Maybe someone else can provide an archived version or screenshot? [3] > Could you provide a source that's more accurate (...)? Make an Access Point, use smartphone to connect to it. Run Wireshark, and you'll see what's happening. Use an AOSP ROM and use the Signal Download without Google Play Services (to be sure that it's not Google Play noise you're observing) [4]. [1] https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L122-L181 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... [2] https://github.com/LibreSignal/LibreSignal/issues/37 https://github.com/LibreSignal/LibreSignal/issues/37 [3] https://twitter.com/comzeradd/status/733677192870297600 https://twitter.com/comzeradd/status/733677192870297600 [4] https://signal.org/android/apk/ https://signal.org/android/apk/

codethief 6y ago
Thanks for the response! I will have to postpone a detailed response to later. In the meantime: > Make an Access Point, use smartphone to connect to it. Run Wireshark, and you'll see what's happening. That won't help when it comes to how stuff is encrypted locally, i.e. the hardware-backed encryption[0]. PS: I think I updated my comment while you were already responding. [0]: https://blog.elcomsoft.com/2019/08/how-to-extract-and-decrypt-signal-conversation-history-from-the-iphone/ https://blog.elcomsoft.com/2019/08/how-to-extract-and-decryp...
codethief 6y ago
> Granted, most of the discussions in LibreSignal's repo [2] got very heated very quickly. Can't find the twitter thread of @moxie at the time, and lots of replies in there got deleted from both sides. Maybe someone else can provide an archived version or screenshot? [3] I remember reading all those threads (the one on GitHub and those on Twitter) back in the day and, honestly, I didn't come away impressed by the way some people treated Moxie. I've been in his shoes a few times now (trying to build a product that works – technically and economically – with team of anarchistic techies) and can empathize with the path he's taken. Not understanding his POV is no excuse for being rude, though. Now, since you posted the link, I went through that GitHub thread again and my impression has stayed the same. A few quotes: > Wow, moxie0 just sounds sounds like a giant cunt. Anyone who uses a binary compiled release of Signal from the Google Play Store for security is a fucking idiot. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-308842858 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > FUCK YOU OWS!!! (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-612531318 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > I must say, you [moxie] really are the worst anarchist I've ever encountered in my life; but I'm no authority on the matter. Writing good software doesn't give you a license to bully other projects around unless they give you a WhatsApp-level payout. How about you keep your narcissism tucked in so that secure messaging in general doesn't have to suffer from it? (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217857428 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > That post [by moxie] is pure politics. It's a bunch of feel-good phrasing, cringe-worthy in its superficial slickness, that obfuscates what is really a giant policy-level middle finger from in terms of Open Whisper Systems shifting away from free software and into a centralized, All Rights Reserved commercial outfit. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-218305029 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) Here's what the people in the thread had to say who didn't get all personal: > [Directed to someone else on the thread:] Whatever your take on what "the right thing" is, there is no need to get personal. And as previously said, Signal is free software - that entitles you to the source code, and no more. Noone is in the right to demand that OWS do anything else, and that includes most of what is being said in this thread. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217407414 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > I thank @moxie0 for replying when asked by @mimi89999, providing his (OWS) point of view in a polite and useful way, bringing up some truly interesting aspects of the issue. I can understand @cjeanneret's frustration, feeling just one step away from a truly free and secure messaging system, but this is no excuse for being rude. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217413089 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...)
codethief 6y ago
> It does connect to google's servers for pretty much everything [1] Have you actually looked at that code? It's for domain fronting[0], so nothing shady, and it's only used when you're in Egypt, UAE, Oman, Qatar, or Iran. Have a look at https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L199 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... vs https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L258 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... and, finally, https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L277 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... > you can look for these constants in the codebase and you'll find lots of things that would worry any netsec person, including the key backup related stuff I just ran a recursive grep on the entire repository and the file you referred to is effectively the only place where a google.com URL shows up in the code (apart from two or three more instances which are not suspicious, either). Maybe I'm missing something, so feel free to prove me wrong, but right now my impression is that you're spreading FUD for no good reason. [0]: https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/
- deleted 6y ago
  [deleted]
codethief 6y ago
> Signal doesn't only use firebase for the sake of Push Notifications For what else does it use Firebase? > Also have in mind that push notifications/firebase is unnecessary with a high priority notification, which is what e.g. other f-droid FOSS forks of other apps use instead. That's news to me. OTOH I'm not familiar with the term "high-priority notification" outside the FCM realm. Unfortunately, a quick Google search only yielded results related to FCM. Could you explain what you mean?

codethief 6y ago

Thanks for the response! I will have to postpone a detailed response to later. In the meantime: > Make an Access Point, use smartphone to connect to it. Run Wireshark, and you'll see what's happening. That won't help when it comes to how stuff is encrypted locally, i.e. the hardware-backed encryption[0]. PS: I think I updated my comment while you were already responding. [0]: https://blog.elcomsoft.com/2019/08/how-to-extract-and-decrypt-signal-conversation-history-from-the-iphone/ https://blog.elcomsoft.com/2019/08/how-to-extract-and-decryp...

codethief 6y ago

> Granted, most of the discussions in LibreSignal's repo [2] got very heated very quickly. Can't find the twitter thread of @moxie at the time, and lots of replies in there got deleted from both sides. Maybe someone else can provide an archived version or screenshot? [3] I remember reading all those threads (the one on GitHub and those on Twitter) back in the day and, honestly, I didn't come away impressed by the way some people treated Moxie. I've been in his shoes a few times now (trying to build a product that works – technically and economically – with team of anarchistic techies) and can empathize with the path he's taken. Not understanding his POV is no excuse for being rude, though. Now, since you posted the link, I went through that GitHub thread again and my impression has stayed the same. A few quotes: > Wow, moxie0 just sounds sounds like a giant cunt. Anyone who uses a binary compiled release of Signal from the Google Play Store for security is a fucking idiot. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-308842858 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > FUCK YOU OWS!!! (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-612531318 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > I must say, you [moxie] really are the worst anarchist I've ever encountered in my life; but I'm no authority on the matter. Writing good software doesn't give you a license to bully other projects around unless they give you a WhatsApp-level payout. How about you keep your narcissism tucked in so that secure messaging in general doesn't have to suffer from it? (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217857428 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > That post [by moxie] is pure politics. It's a bunch of feel-good phrasing, cringe-worthy in its superficial slickness, that obfuscates what is really a giant policy-level middle finger from in terms of Open Whisper Systems shifting away from free software and into a centralized, All Rights Reserved commercial outfit. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-218305029 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) Here's what the people in the thread had to say who didn't get all personal: > [Directed to someone else on the thread:] Whatever your take on what "the right thing" is, there is no need to get personal. And as previously said, Signal is free software - that entitles you to the source code, and no more. Noone is in the right to demand that OWS do anything else, and that includes most of what is being said in this thread. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217407414 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...) > I thank @moxie0 for replying when asked by @mimi89999, providing his (OWS) point of view in a polite and useful way, bringing up some truly interesting aspects of the issue. I can understand @cjeanneret's frustration, feeling just one step away from a truly free and secure messaging system, but this is no excuse for being rude. (https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217413089 https://github.com/LibreSignal/LibreSignal/issues/37#issueco...)

codethief 6y ago

> It does connect to google's servers for pretty much everything [1] Have you actually looked at that code? It's for domain fronting[0], so nothing shady, and it's only used when you're in Egypt, UAE, Oman, Qatar, or Iran. Have a look at https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L199 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... vs https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L258 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... and, finally, https://github.com/signalapp/Signal-Android/blob/d74e9f74103ad76eb7b5378e06fb789e7b365767/app/src/main/java/org/thoughtcrime/securesms/push/SignalServiceNetworkAccess.java#L277 https://github.com/signalapp/Signal-Android/blob/d74e9f74103... > you can look for these constants in the codebase and you'll find lots of things that would worry any netsec person, including the key backup related stuff I just ran a recursive grep on the entire repository and the file you referred to is effectively the only place where a google.com URL shows up in the code (apart from two or three more instances which are not suspicious, either). Maybe I'm missing something, so feel free to prove me wrong, but right now my impression is that you're spreading FUD for no good reason. [0]: https://signal.org/blog/looking-back-on-the-front/ https://signal.org/blog/looking-back-on-the-front/

deleted 6y ago
[deleted]

codethief 6y ago

> Signal doesn't only use firebase for the sake of Push Notifications For what else does it use Firebase? > Also have in mind that push notifications/firebase is unnecessary with a high priority notification, which is what e.g. other f-droid FOSS forks of other apps use instead. That's news to me. OTOH I'm not familiar with the term "high-priority notification" outside the FCM realm. Unfortunately, a quick Google search only yielded results related to FCM. Could you explain what you mean?