2 ms·

> Compromised apps can very much silence such warnings. Again, this is not a useful take since this equally applies to any other app, federated or not. > If y

• Andrew_nenakhov 5y ago
  > this equally applies to any other app, federated or not. Wrong. If your client software and service come from different vendors, it is by far harder to attack your privacy via compromised apps - especially if there are multiple vendors of client software and reputable open source repositories like f-droid who build apps from sources. > No, you just need one of the trusted component to be compromised to lose your security guarantees While this looks to be true, in real world practice it is completely not so. It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app - especially if the attacker knows which account should be affected. And in a federated environment the attacker might not even know your account name.
  • hiq 5y ago
    Whether the protocol is federated or not (which is the topic of the article) doesn't say anything about the clients and how they're distributed. Even with respect to Signal, which is open-source, can be rebuilt from source and has several clients, including 3rd-party ones. > It is far harder sneaking a backdoor into a F-droid app, with far bigger reputation risks, than doing it in Signal app We'll have to agree to disagree.