4 ms·

TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think dep

by _jomo 12y ago

TextSecure for Android is only distributed via the Play Store. So I built it myself only to notice that Google Play Services are required for chat. I think depending on proprietary / data gathering apps is the wrong approach for an open source privacy app. It actually makes me sad. There was an issue about "This requires Google Play" on GitHub [0] which was closed by moxie with "TextSecure only requires GSF for data channel messaging. To use SMS/MMS, it doesn't." Great. I'm not paying 3 cents to send a few bytes of text via SMS. I'll rather just stick to WhatsApp/Telegram. There are a lot of issues on GitHub that makes searching them a little hard, but it seems like there is ongoing development for websockets instead of (Google-) Push messages. [1][2] 0: https://github.com/WhisperSystems/TextSecure/issues/560 https://github.com/WhisperSystems/TextSecure/issues/560 1: https://github.com/WhisperSystems/TextSecure/issues/1000 https://github.com/WhisperSystems/TextSecure/issues/1000 2: https://github.com/WhisperSystems/TextSecure/pull/2423 https://github.com/WhisperSystems/TextSecure/pull/2423

anonbanker 12y ago
Install textsecure from F-droid. EDIT: not only is textsecure not on f-droid, but f-droid itself is woefully insecure: https://github.com/WhisperSystems/TextSecure/issues/127 https://github.com/WhisperSystems/TextSecure/issues/127
- ultramancool 12y ago
  It actually seems to indicate that F-Droid has addressed every last obstacle Moxie has posed, even the more ridiculous ones. They're now even willing to distribute developer signed versions if reproducible by their build server. He seems to be standing by this ridiculous "F-Droid is harmful" non-sense with no good reasoning at this point. Hopefully someone will talk some sense into him sooner rather than later.
  - dTal 12y ago
    What's weird is that F-Droid uses the same distribution model as any ordinary Linux distro, where it is assumed that all binaries are compiled from source by the distro maintainers, if for no other reason than to build them against system libraries. The binaries themselves are guaranteed to be built directly from public upstream repositories, in an automated fashion - rather like FreeBSD's ports or Arch's PKGBUILDs. The real reason Moxie doesn't like F-Droid seems to be that it doesn't provide him with analytics "with a nice web interface that displays graphs and trends of time" - rather a nasty conflict of interest in a product that bills itself as "private" and "secure", if you ask me.
StavrosK 12y ago
Don't WhatsApp/Telegram need GSF?
pilif 12y ago
> I'll rather just stick to WhatsApp/Telegram whatsapp and telegram also use google play services for background notifications. There is no other reliable way to ensure that messages are always delivered on both iOS (push notifications) and Android (Google Cloud Messaging). Apps just don't get enough API access to do this on their own in a totally reliable way and even if they did, the overhead of multiple applications keeping multiple connections open (and the radio active) would cause a lot more drain on the battery. Neither TextSecure not Signal use the platform provided notification features for unencrypted data though, so your messages are still safe.
- _jomo 12y ago
  Well, I installed Telegram via F-Droid and WhatsApp from their website. Took about half a minute each and they work - without any Google Apps installed.
- dTal 12y ago
  There's been a lot of talk over the years of implementing a data modem over GSM voice - as far as I can tell, this would solve basically all the issues with the current crop of encryption products. Instead of constantly polling or faffing about with third party servers, one phone could simply initiate a two-way connection to another phone the old fashioned way: via phone call. There's your "push messaging". You wouldn't even have to leave your data on. Your text messages would also probably arrive faster than an SMS. I'm very disappointed that despite numerous papers on the subject in the past decade (even a DEFCON presentation), no implementation has yet appeared, not even a demo.

by _jomo 12y ago

anonbanker 12y ago

Install textsecure from F-droid. EDIT: not only is textsecure not on f-droid, but f-droid itself is woefully insecure: https://github.com/WhisperSystems/TextSecure/issues/127 https://github.com/WhisperSystems/TextSecure/issues/127

ultramancool 12y ago
It actually seems to indicate that F-Droid has addressed every last obstacle Moxie has posed, even the more ridiculous ones. They're now even willing to distribute developer signed versions if reproducible by their build server. He seems to be standing by this ridiculous "F-Droid is harmful" non-sense with no good reasoning at this point. Hopefully someone will talk some sense into him sooner rather than later.
- dTal 12y ago
  What's weird is that F-Droid uses the same distribution model as any ordinary Linux distro, where it is assumed that all binaries are compiled from source by the distro maintainers, if for no other reason than to build them against system libraries. The binaries themselves are guaranteed to be built directly from public upstream repositories, in an automated fashion - rather like FreeBSD's ports or Arch's PKGBUILDs. The real reason Moxie doesn't like F-Droid seems to be that it doesn't provide him with analytics "with a nice web interface that displays graphs and trends of time" - rather a nasty conflict of interest in a product that bills itself as "private" and "secure", if you ask me.

StavrosK 12y ago

Don't WhatsApp/Telegram need GSF?

pilif 12y ago

> I'll rather just stick to WhatsApp/Telegram whatsapp and telegram also use google play services for background notifications. There is no other reliable way to ensure that messages are always delivered on both iOS (push notifications) and Android (Google Cloud Messaging). Apps just don't get enough API access to do this on their own in a totally reliable way and even if they did, the overhead of multiple applications keeping multiple connections open (and the radio active) would cause a lot more drain on the battery. Neither TextSecure not Signal use the platform provided notification features for unencrypted data though, so your messages are still safe.

_jomo 12y ago
Well, I installed Telegram via F-Droid and WhatsApp from their website. Took about half a minute each and they work - without any Google Apps installed.
dTal 12y ago
There's been a lot of talk over the years of implementing a data modem over GSM voice - as far as I can tell, this would solve basically all the issues with the current crop of encryption products. Instead of constantly polling or faffing about with third party servers, one phone could simply initiate a two-way connection to another phone the old fashioned way: via phone call. There's your "push messaging". You wouldn't even have to leave your data on. Your text messages would also probably arrive faster than an SMS. I'm very disappointed that despite numerous papers on the subject in the past decade (even a DEFCON presentation), no implementation has yet appeared, not even a demo.