9 ms·
This is not secure at all because you just gave Signal root access to your system. By adding their keys you also have granted a permission for Signal to replace
by codedokode 4y ago
This is not secure at all because you just gave Signal root access to your system. By adding their keys you also have granted a permission for Signal to replace any packages on your system.
I would instead manually download and unpack the app, create separate user for it, and run it in chroot. Much safer than your method.
- electromech 4y agoRespectfully, I don't think that's correct, or possibly I am misreading your comment. IIUC, placing a key in /usr/share/keyrings does not allow those keys to sign any package, only the packages designated with "signed-by" in the apt list. Sadly, plenty of applications still take the old "apt-key" approach of adding the keys globally (e.g., installing keys to /etc/apt/trusted.gpg.d), but I think Signal's installation process is the correct/recommended approach for distributing apt packages securely.
- codedokode 4y agoYes, I made a mistake about the key. Adding a key is safe by itself. However by adding third-party repository you are granting Signal a permission to replace packages on your system (unless you manually whitelist package names in apt preferences), and by installing a package from Signal repository you grant it root access to your system. Sadly debian-based distributions do not respect the principle of least privileges and grant unnecessary permissions to installation scripts.