3 ms·

So, you're suggesting Signal has a back-door?

opportune 3y ago
I don’t know. Neither this article nor the article it references (https://www.news18.com/amp/india/govt-blocks-14-mobile-messenger-apps-in-jk-used-by-terror-groups-to-contact-supporters-ogws-exclusive-7684669.html https://www.news18.com/amp/india/govt-blocks-14-mobile-messe...) seem to have the full list. For a high profile app like Signal (which more than just the Indian government cares about) I assume there are security vendors or US intelligence solutions to get access. I mean, for one, the US government and EU can make Google and Apple do anything by showing up to their offices with guns. It’s also a high value target for whatever you call those security firms that sell exploits to nationstates. For intelligence purposes you’d rather centralize targets on a small number of platforms that they think are safe and not give them a reason to leave, rather than have them be fragmented across many platforms which each require some kind of backdoor/additional work to get access to. I guess I’m getting downvoted for insinuating Signal has a backdoor without evidence, but an iOS or Android level exploit or backdoor would easily function as a signal backdoor, and depending on its implementation (like peaking at process memory) could be hard to get working for each and every random app. There’s also the risk of an app store itself adding a backdoor or a Signal insider sneakily creating one to sell the exploit. These all seem highly possible given the various NSO exploits that have hit the news.
russnes 3y ago
Last I checked Signal has reproducible builds at least on Android, so it should be possible to verify it doesn't have back doors.
- opportune 3y ago
  That only verifies that the app stores are not directly adding a backdoor to the APK. An exploit could still be hiding in plain sight within the code, or more likely added by the OS through various mechanisms like a direct OS exploit making it easy to read application memory, or the OS injecting an exploit while starting the app.
nine_k 3y ago
Maybe they can be legally compelled to stop operating in a particular area, but such a limitation can't be all that effective.

I don’t know. Neither this article nor the article it references (https://www.news18.com/amp/india/govt-blocks-14-mobile-messenger-apps-in-jk-used-by-terror-groups-to-contact-supporters-ogws-exclusive-7684669.html https://www.news18.com/amp/india/govt-blocks-14-mobile-messe...) seem to have the full list. For a high profile app like Signal (which more than just the Indian government cares about) I assume there are security vendors or US intelligence solutions to get access. I mean, for one, the US government and EU can make Google and Apple do anything by showing up to their offices with guns. It’s also a high value target for whatever you call those security firms that sell exploits to nationstates. For intelligence purposes you’d rather centralize targets on a small number of platforms that they think are safe and not give them a reason to leave, rather than have them be fragmented across many platforms which each require some kind of backdoor/additional work to get access to. I guess I’m getting downvoted for insinuating Signal has a backdoor without evidence, but an iOS or Android level exploit or backdoor would easily function as a signal backdoor, and depending on its implementation (like peaking at process memory) could be hard to get working for each and every random app. There’s also the risk of an app store itself adding a backdoor or a Signal insider sneakily creating one to sell the exploit. These all seem highly possible given the various NSO exploits that have hit the news.

russnes 3y ago

Last I checked Signal has reproducible builds at least on Android, so it should be possible to verify it doesn't have back doors.

opportune 3y ago
That only verifies that the app stores are not directly adding a backdoor to the APK. An exploit could still be hiding in plain sight within the code, or more likely added by the OS through various mechanisms like a direct OS exploit making it easy to read application memory, or the OS injecting an exploit while starting the app.

nine_k 3y ago

Maybe they can be legally compelled to stop operating in a particular area, but such a limitation can't be all that effective.