Ask HN: How do we know Signal or Telegram don't store our data on their servers?

> I'm just curious how we trust companies such as Signal, Telegram, Mozilla, that claim they don't store and sell our data?

These are three very different companies with very different security processes and trust profiles.

In the case of Signal: if you trust that the source code they distribute is the same as the app available in the Play Store, then it's pretty easy to verify that the messaging data is end-to-end encrypted in a way that prevents Signal from having much metadata that they even could store. With "sealed sender", they don't even know who's talking to whom: https://signal.org/blog/sealed-sender/

There's the possibility that Signal could ship a different app in the Play store, but that would require active malice to do in a way that would not be trivial to discover[0], and at some point you do have to trust someone. It's not impossible, but it's hard to imagine a world in which Signal is compromised but other links in the chain aren't, because quite frankly, there are far more easily corruptible or hackable links in the hardware/software stack that you use, so Signal would make a pretty inefficient target for someone who wants monetizeable data.

[0] ie, an accidental divergence between the two would be more conspicuous

Get hired and sign NDA

Signal is open source, you and anyone else can inspect the code. You can then build it from source and install on your android directly avoiding the play store.

and how does this proof that they don't save what you send them?

> trust that the source code they distribute is the same as the app available in the Play Store

And, of course, one has the option to build the source and install that.