3 ms·

Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging

Valid question, which I don't have the answer for, but since Signal is open-source [1][2] it's open to lot of analysis. Since we haven't heard anything damaging so far, I'm guessing it's _secure enough_. [1] https://github.com/signalapp/Signal-iOS https://github.com/signalapp/Signal-iOS [2] https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android

coldtea 4y ago
Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?
- eitland 4y ago
  With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.
  - palata 4y ago
    I looked into it, and it was technically interesting, but honestly much harder than compiling from source.
    - eitland 4y ago
      Reproducible builds are notoriously hard even without having to worry about things like jailbreaking and app stores. The point is not just that everyone can make their own, but that anyone who is competent enough can prove that their client code is exactly what is used to produce the version that gets distributed. This means that with Telegram it shouldn't be possible to hide a backdoor in the client in a way that is impossible to spot.
      - palata 4y ago
        Well it's far from easy with Telegram, too.
- kijiki 4y ago
  The builds are reproducible, so you can compile it yourself and check to see that you get identical binaries.
  - coldtea 4y ago
    Identical to what? Aren't iOS (at least) App Store apps encrypted, so even if I build one locally, I can't compare the resulting file with the encrypted app
    - kijiki 4y ago
      I don't use iOS, so I'm not familiar, but surely there is a way to download app packages from their store to verify them and generally exercise due diligence and do security research?
- palata 4y ago
  Not impossible, but that's definitely not trivial to do. If it matters to you, you should build it from source. If it's just out of curiosity... yeah reproducible builds are a thing, but generally that's not super straightforward in practice, I would say.

coldtea 4y ago

Another question then: can we verify (even if we have to jailbreak and check the binary) that the encrypted app delivered on iOS (and I presume Android) is built from the exact same source code? E.g. could we build it ourselves in, say, Xcode, and compare a hash of the resulting app binary with the installed one?

eitland 4y ago
With Telegram you can. They provide instructions. (At least used to do.) Not sure about Signal.
- palata 4y ago
  I looked into it, and it was technically interesting, but honestly much harder than compiling from source.
  - eitland 4y ago
    Reproducible builds are notoriously hard even without having to worry about things like jailbreaking and app stores. The point is not just that everyone can make their own, but that anyone who is competent enough can prove that their client code is exactly what is used to produce the version that gets distributed. This means that with Telegram it shouldn't be possible to hide a backdoor in the client in a way that is impossible to spot.
    - palata 4y ago
      Well it's far from easy with Telegram, too.
kijiki 4y ago
The builds are reproducible, so you can compile it yourself and check to see that you get identical binaries.
- coldtea 4y ago
  Identical to what? Aren't iOS (at least) App Store apps encrypted, so even if I build one locally, I can't compare the resulting file with the encrypted app
  - kijiki 4y ago
    I don't use iOS, so I'm not familiar, but surely there is a way to download app packages from their store to verify them and generally exercise due diligence and do security research?
palata 4y ago
Not impossible, but that's definitely not trivial to do. If it matters to you, you should build it from source. If it's just out of curiosity... yeah reproducible builds are a thing, but generally that's not super straightforward in practice, I would say.