6 ms·

Signal received subpoena to produce all data they have on a user and they provided just two data-points: last connection date and account creation date [1][2].

Signal received subpoena to produce all data they have on a user and they provided just two data-points: last connection date and account creation date [1][2]. So I'm pretty sure they do not store anything else. [1] https://signal.org/bigbrother/central-california-grand-jury/ https://signal.org/bigbrother/central-california-grand-jury/ [2] https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/

deleted 4y ago
[deleted]
coldtea 4y ago
And how to we know they don't collect other data but don't advertise it? If they have a special deal with government, the court wouldn't even know about those, or might be instructed not to ask them and not disclose anything.
- kklisura 4y ago
  Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging so far, I'm guessing it's _secure enough_. [1] https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS [2] https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
  - coldtea 4y ago
    Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?
    - eitland 4y ago
      With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.
      - palata 4y ago
        I looked into it, and it was technically interesting, but honestly much harder than compiling from source.
        eitland 4y ago
        Reproducible builds are notoriously hard even without having to worry about things like jailbreaking and app stores. The point is not just that everyone can make their own, but that anyone who is competent enough can prove that their client code is exactly what is used to produce the version that gets distributed. This means that with Telegram it shouldn't be possible to hide a backdoor in the client in a way that is impossible to spot.
        palata 4y ago
        Well it's far from easy with Telegram, too.
    - kijiki 4y ago
      The builds are reproducible, so you can compile it yourself and check to see that you get identical binaries.
      - coldtea 4y ago
        Identical to what? Aren't iOS (at least) App Store apps encrypted, so even if I build one locally, I can't compare the resulting file with the encrypted app
        kijiki 4y ago
        I don't use iOS, so I'm not familiar, but surely there is a way to download app packages from their store to verify them and generally exercise due diligence and do security research?
- palata 4y ago
  You can audit your Signal client app (which is open source) and see exactly what it sends, and how. Now realistically, most people can do that, so they have to trust that somebody who can actually did it. Security experts have been and are looking into messengers like Signal: they have an interest to do so as security researchers, because that would look good on their CV. Of course there is trust somewhere, you cannot do without trust. But Signal is amongst the best you can find.
  - coldtea 4y ago
    >You can audit your Signal client app (which is open source) and see exactly what it sends, and how. See my other question. Audit how? Sure, you can examine the source. But how can one tell the app blob in their phone is the same as the one produced if you build the code?
    - niel 4y ago
      Signal on Android advertises reproducible builds: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md https://github.com/signalapp/Signal-Android/blob/main/reprod... (I haven't tested this myself.) Edit: You can also build the client yourself and use your own version. No need to use the Google Play store version.
    - palata 4y ago
      Just build it from source...
      - coldtea 4y ago
        I know that part, that's why I asked "how can one tell the app blob in their phone is the same as the one produced if you build the code?". The problem being that apps as installed from the App Store come (to my knowledge, could be wrong) encrypted. So you can't just compare an unencrypted local build with the encrypted installed app (and you can't decrypt the app or encrypt your build the same way, because you don't have the key, e.g. Apple has it - and iirc, there's no access to it, because it's held in the secure enclave in iOS case).

deleted 4y ago

[deleted]

coldtea 4y ago

And how to we know they don't collect other data but don't advertise it? If they have a special deal with government, the court wouldn't even know about those, or might be instructed not to ask them and not disclose anything.

kklisura 4y ago
Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging so far, I'm guessing it's _secure enough_. [1] https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS [2] https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
- coldtea 4y ago
  Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?
  - eitland 4y ago
    With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.
    - palata 4y ago
      I looked into it, and it was technically interesting, but honestly much harder than compiling from source.
      - eitland 4y ago
        Reproducible builds are notoriously hard even without having to worry about things like jailbreaking and app stores. The point is not just that everyone can make their own, but that anyone who is competent enough can prove that their client code is exactly what is used to produce the version that gets distributed. This means that with Telegram it shouldn't be possible to hide a backdoor in the client in a way that is impossible to spot.
        palata 4y ago
        Well it's far from easy with Telegram, too.
  - kijiki 4y ago
    The builds are reproducible, so you can compile it yourself and check to see that you get identical binaries.
    - coldtea 4y ago
      Identical to what? Aren't iOS (at least) App Store apps encrypted, so even if I build one locally, I can't compare the resulting file with the encrypted app
      - kijiki 4y ago
        I don't use iOS, so I'm not familiar, but surely there is a way to download app packages from their store to verify them and generally exercise due diligence and do security research?
palata 4y ago
You can audit your Signal client app (which is open source) and see exactly what it sends, and how. Now realistically, most people can do that, so they have to trust that somebody who can actually did it. Security experts have been and are looking into messengers like Signal: they have an interest to do so as security researchers, because that would look good on their CV. Of course there is trust somewhere, you cannot do without trust. But Signal is amongst the best you can find.
- coldtea 4y ago
  >You can audit your Signal client app (which is open source) and see exactly what it sends, and how. See my other question. Audit how? Sure, you can examine the source. But how can one tell the app blob in their phone is the same as the one produced if you build the code?
  - niel 4y ago
    Signal on Android advertises reproducible builds: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md https://github.com/signalapp/Signal-Android/blob/main/reprod... (I haven't tested this myself.) Edit: You can also build the client yourself and use your own version. No need to use the Google Play store version.
  - palata 4y ago
    Just build it from source...
    - coldtea 4y ago
      I know that part, that's why I asked "how can one tell the app blob in their phone is the same as the one produced if you build the code?". The problem being that apps as installed from the App Store come (to my knowledge, could be wrong) encrypted. So you can't just compare an unencrypted local build with the encrypted installed app (and you can't decrypt the app or encrypt your build the same way, because you don't have the key, e.g. Apple has it - and iirc, there's no access to it, because it's held in the secure enclave in iOS case).