21–30 of 241 posts
Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.
So how do I build the Signal server and confirm it's identical to the one they're running?
> The American Civil Liberties Union announced Tuesday that Open Whisper Systems (OWS), the company behind popular encrypted messaging app Signal, was subpoenaed earlier this year by a federal grand jury in the Eastern District of Virginia to hand over a slew of information—"subscriber name, addresses, telephone numbers, email addresses, method of payment"—on two of its users.
> ... “The only information responsive to the subpoena held by OWS is the time of account creation and the date of the last connection to Signal servers,” Kaufman continued, also pointing out that the company did in fact hand over this data.
https://arstechnica.com/tech-policy/2016/10/fbi-demands-sign...
And it is convenient, because you can just switch your smartphone and still access all your chathistory, without having to manually backup/restore.
But Telegram in general does not have a business model yet, so just assume, that one day, they want(or have) to cash out.
Signal on the other hand is a non-profit foundation and pretty open on what they are doing. That creates trust for me.
Earlier quoted context omitted.
That is a somewhat misleading statement, you may know what's on your device but you don't know what is happening on the servers
Because of public-key crypto, it doesn't matter if the servers are malicious.
- read the source code and are satisfied that it's secure
- compiled that version of the code
- installed it on your mobile or desktop
You're still only as secure as the client on the other side of the conversation.
If that one is compromised (has not gone throught the steps above) it could very well be sending all messages in clear text to a malicious party.
Edit: formatting
As of mid-2016, and trusted as much as you feel like trusting something attested in a court of law, Signal stores: a bool (is this phone number a user) and two ints (epoch of signup, epoch of last transmission).
https://www.aclu.org/open-whisper-systems-subpoena-documents
Earlier quoted context omitted.
So how do I build the Signal server and confirm it's identical to the one they're running?
It doesn't matter if it's not. Security should depend completely on the clients. Public-key crypto allows private communication through insecure channels.
Telegram‘s „secret chats“ and signal chats are end-to-end encrypted. The servers still may store metadata, and there is no way to tell if they do than either joining them or let a trusted third party verify that.
To check if e2e encrypted message content cannot be encrypted via backdoors on their servers, you need to ensure they use proven encryption schemes and the client encryption does correspond to those algorithms.
Earlier quoted context omitted.
So how do I build the Signal server and confirm it's identical to the one they're running?
It doesn't matter if it's not. Security should depend completely on the clients. Public-key crypto allows private communication through insecure channels.