84 ms·
The point of e2ee is already lost anyways. What does E2EE potentially give you? A promise, which does not involve trusting the service provider, that messages
by tcfhgj 1y ago
The point of e2ee is already lost anyways.
What does E2EE potentially give you? A promise, which does not involve trusting the service provider, that messages can only read by the recipient.
What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook
- Kwpolska 1y agoHow do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?
- tcfhgj 1y agoidk, diff the binaries?
- maqp 1y agopull the apk from your phone with apktool. Compile Signal reproducibly with their instructions. Use the diff.py tool they provide and check for the message that confirms the APKs match.
- selfhoster11 1y agoIf I care about binary integrity, I wouldn't involve an app store. https://signal.org/android/apk/ https://signal.org/android/apk/ is a perfectly cromulent way to get your hands on the APK file directly from the source.
- JetSpiegel 1y agoHow do you keep that updated? What if there is a security issue?
- 31337Logic 1y agoCompile it yourself and compare the hash.
- maqp 1y ago"What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook" It does change the requirement of collection. It's no longer "Well all this data is rolling in, what shall we do with it". It's "Hey, if we commit THREE BILLION FELONIES of backdooring our every users' encryption, we can access all that data". Surely you realize that's a leap.