4 ms·
> However, given that you can report messages to Meta for violating the terms of use, they clearly do have mechanisms to read messages. That’s not a reasonable
by Kwpolska 1y ago
> However, given that you can report messages to Meta for violating the terms of use, they clearly do have mechanisms to read messages.
That’s not a reasonable assumption IMO. The report API most likely takes the message your phone has decrypted (so that you can read it) and sends it over to Meta. This doesn’t break end-to-end encryption. Neither does me copying the message from a friend and posting it on Twitter.
- tcfhgj 1y agoThe point of e2ee is already lost anyways. What does E2EE potentially give you? A promise, which does not involve trusting the service provider, that messages can only read by the recipient. What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook
- Kwpolska 1y agoHow do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?
- tcfhgj 1y agoidk, diff the binaries?
- maqp 1y agopull the apk from your phone with apktool. Compile Signal reproducibly with their instructions. Use the diff.py tool they provide and check for the message that confirms the APKs match.
- selfhoster11 1y agoIf I care about binary integrity, I wouldn't involve an app store. https://signal.org/android/apk/ https://signal.org/android/apk/ is a perfectly cromulent way to get your hands on the APK file directly from the source.
- JetSpiegel 1y agoHow do you keep that updated? What if there is a security issue?
- 31337Logic 1y agoCompile it yourself and compare the hash.
- maqp 1y ago"What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook" It does change the requirement of collection. It's no longer "Well all this data is rolling in, what shall we do with it". It's "Hey, if we commit THREE BILLION FELONIES of backdooring our every users' encryption, we can access all that data". Surely you realize that's a leap.