Viewing profile — mfwoods

That's true, and in that sense it doesn't really matter if they publish the server source or not (although they really should continue to do so). What does matter is that the clien…

No. The clients are open source, and (at least on Android) you are able to verify that the source on Github is the same that was used to compile the client on Google Play with repr…

But you can verify that the source they publish on Github is the same that was used to built the Google Play version with reproducible builds[1]. Also, Android apps are fairly easy…

It's not, once linked the desktop client can be used independently of your phone.

> Can I use Signal from desktop only? Yes, the desktop client functions independently from the phone client once linked (so not like whatsapp that proxies everything through your p…

Because there is no end to end encryption (other than some very limited temporary one on one chats that only work between two mobile devices) which means the server can (and does) …

Not necessarily. But storing them in plain text on the server and all history accessible just by hijacking a phone number (or a single text message) is, considering the alternative…

I assume they removed it because they don't want anyone to use old insecure code. The RedPhone server hasn't been used for years now and was replaced with a better implementation. …

Only the encryption layer of the protocol is the same, they are not really compatible otherwise. I assume it's a design trade-off when you have E2EE and don't store any messages on…

> not proxying through your phone which Signal used to do and maybe still does This is what Whatsapp does. Signal never did and has real multi-device support. > and the Signal serv…

Just because it's on a keyserver doesn't mean it's trustworthy. Keyservers do no verification of any kind on the keys they host. If you(r system) trust the certificate that https:/…

You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build w…

You're right, I clarified it a little.

You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after. Edi…

For those that don't want to enable Javascript, these are the hidden Linux instructions: $ curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add - $ echo "deb …

Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your …

> Also, video chat has been in beta since March 2017. Video chat actually came out of beta in March [0]. The beta was released in February. [0] https://whispersystems.org/blog/sign…

Actually, Signal works without routing the messages trough your phone. Instead they use a browser extension to store the keys client side, which acts as a full client with its own,…

I don't think they intend to contribute back to the original OpenSSL code base, but see this as a OpenBSD only fork.

That's because there is no video. It's a sound fragment to which they added a single photo (not a render) to make it a video (why? no idea).

Thanks for reminding, almost forgot about that.

I just installed update openssl_1.0.1e-2+deb7u5 and libssl1.0.0_1.0.1e-2+deb7u5 on debian wheezy, so it seems the fix is now available.

Not only that, but these bases usually also have a non-trivial contribution to the local economy. Especially in smal(ler) towns, I'd expect there are quite some people who'd rather…

According to Wikipedia[1] over 80-90% (or $163 million in 2011) of Mozilla's funding comes from Google. I'd love to see Mozilla be more independent from Google, but I don't think t…

I'm not sure what this adds over applying PGP on the server? The way to intercept the message with the server doing PGP would be to either MITM the connection or breach into the se…