5 ms·

Signal is distributed as an app. Furthermore, the client is open source, you can see the repositories here: https://github.com/signalapp https://github.com/sig

Signal is distributed as an app. Furthermore, the client is open source, you can see the repositories here: https://github.com/signalapp https://github.com/signalapp I don't know the latest details about Android/iOS app signing, but presumably reproducible builds + sufficiently strong signing would make it secure enough for most users. For those who are truly paranoid, then can build it themselves (subject to their own device OS's requirements, which are hardly a unique problem to Signal). In short, Signal's security should be as good as any mobile app can be, and can be even better if you're willing to put in legwork.

01HNNWZ0MV43FF 2y ago
The government could definitely compel Google to give a list of users a malicious Signal update
- Xelynega 2y ago
  The government could compel signal to do this, no? They haven't, but if they decide they want to what's technologically stopping signal from: 1. Making an update that doesn't exist in git which pushes decrypted messages to their server when you launch the app 2. Push this update to the app store If a government ever compelled them to?
Vinnl 2y ago
Well, the security should be good enough for most people's threat models. But government officials will probably want to have some restrictions on who can be added to a group, for example.
Xelynega 2y ago
When was the last time you verified that the update being pushed to the app store by signal matches the git repo? When was the last time you checked what updates have been made to the git repo? Of course what you're saying is "technically" possible to avoid signal changing code and circumventing encryption, but show me one person who does a check of all the changes to signal source(and verified the binary matches) before they let their app store update it and they launch it... Everyone I know has signal auto-update through the app store and don't even know it updated until after they launch it.

01HNNWZ0MV43FF 2y ago

The government could definitely compel Google to give a list of users a malicious Signal update

Xelynega 2y ago
The government could compel signal to do this, no? They haven't, but if they decide they want to what's technologically stopping signal from: 1. Making an update that doesn't exist in git which pushes decrypted messages to their server when you launch the app 2. Push this update to the app store If a government ever compelled them to?

Vinnl 2y ago

Well, the security should be good enough for most people's threat models. But government officials will probably want to have some restrictions on who can be added to a group, for example.

Xelynega 2y ago

When was the last time you verified that the update being pushed to the app store by signal matches the git repo? When was the last time you checked what updates have been made to the git repo? Of course what you're saying is "technically" possible to avoid signal changing code and circumventing encryption, but show me one person who does a check of all the changes to signal source(and verified the binary matches) before they let their app store update it and they launch it... Everyone I know has signal auto-update through the app store and don't even know it updated until after they launch it.