3 ms·
There's no way for Signal to prevent any piece of code that can make a TCP connection and speak its protocol from using the service.
by dboreham 1y ago
There's no way for Signal to prevent any piece of code that can make a TCP connection and speak its protocol from using the service.
- coppsilgold 1y agoWhile that's true even in the general case (through reverse engineering), it's especially true in the case of Signal because it's open source. There are libraries for interacting with Signal services (one from Signal themselves), here is a CLI tool that uses a patched official library: <https://github.com/AsamK/signal-cli https://github.com/AsamK/signal-cli>
- mmooss 1y agoWhy not require keys signed with Signal's private key?
- goupillon 1y agoIf the keys are generated on the device, they can't be trusted by Signal since any clone could generate them too. If the keys are generated by Signal and sent to the device, they can be intercepted and used in any clone
- mmooss 1y agoThanks. Signal could use unique public keys for each valid client. It could be intercepted and used for DoS against the valid client's Signal service, but that's not a confidentiality risk. It could serve as a UID, but maybe there are workarounds to that.
- bubblethink 1y agoYou'd need hardware attestation, but you can essentially implement DRM like schemes that prevent any unofficial client from working.