Live data from Hacker News

Signal for Android: RedPhone and TextSecure in one app

whispersystems.org

11–20 of 158 posts

Re: Signal for Android: RedPhone and TextSecure in one app

#11
post #8
post #4

Earlier quoted context omitted.

What does it send via googleplay other than "please connect to the server now"?

it does require to have the google play services installed in the first place. so for those who i.e. run cyanogenmod without the google play services installed, it's unfortunately not possible to use Signal/TextSecure.

microg's GmsCore (an unprivileged open source reimplementation of Google Play Services) can do Google Cloud Messaging and should work for Signal.

Re: Signal for Android: RedPhone and TextSecure in one app

#12
post #2

I really want to start using TextSecure (or Signal now I guess), but the only thing holding me back is it depends on Google Play Services. I love what they're doing and can understand the decision, but still thinks it sucks a bit that the best option for secure communications is so tied into Google.

It's mostly because there aren't any real alternatives. Building a world wide push messaging network is really hard (you have to deal with carriers a lot and convince them not to close your long running connections after 5 minutes). That said, the servers support websocket connections as well. I don't know the current state of client support. Also, a Chrome/Chromium extension is in the works.

Re: Signal for Android: RedPhone and TextSecure in one app

#13
post #10

I have been using Signal (and TextSecure before that) for a while. The two features that would make me use it more would be: 1. Web client. (I send most of my texts from my laptop, which means I use Hangouts) 2. Search messages on the client. Thanks for a great product and keep up the good work.

A browser extension for Chrome/Chromium is being worked on! You can track it at https://github.com/WhisperSystems/TextSecure-Browser

Re: Signal for Android: RedPhone and TextSecure in one app

#14
One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android).

Yes, I realise that this is part of Android's broken security model.

But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info.

Call me paranoid, but making an app with all those permissions seems kind of the obvious place for backdoors and similar.

If there was a 'light' version of the app which only required access the internet, then I'd be much more likely to install and use it. (And maybe if I ended up trusting it, then later install add-ons / the full version later).

Re: Signal for Android: RedPhone and TextSecure in one app

#18

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

In Android Marshmallow you can deny / disable any of those permissions. And apps compatible with API Level 23 won't ask for those permissions from the start.

Re: Signal for Android: RedPhone and TextSecure in one app

#19
post #10

I have been using Signal (and TextSecure before that) for a while. The two features that would make me use it more would be: 1. Web client. (I send most of my texts from my laptop, which means I use Hangouts) 2. Search messages on the client. Thanks for a great product and keep up the good work.

A browser extension for Chrome/Chromium is being worked on! You can track it at https://github.com/WhisperSystems/TextSecure-Browser

That's excellent. Installing and using GPG (or GPGTools or GPG Keychain or whatever it's name is) on OS X is awful.

Something that's still OSS and cares about UX (like Signal on iOS) would be fantastic.

Re: Signal for Android: RedPhone and TextSecure in one app

#20

One of the reasons I didn't install WhatsApp is the sheer quantity of permissions it wants (on Android). Yes, I realise that this is part of Android's broken security model. But the Signal app also wants access to practically everything. Device & App History, Identity, Calendar, Contact, Location, SMS, Phone, Photos/Media/Files, Camera, Microphone, WiFi Connection info and Device ID and call info. Call me paranoid, b…

I'm not associated with Signal or Moxie (though I've been a silent fanboy for ~15 years-- [[hey Moxie if you're reading this and still are hiring, ping me - contact info is in my profile]]), but I'd inherently trust the application more than an average application or company because: a) Moxie has a track history of having a lot of personal integrity with regards to security. Some might say this is blasphemous but I'd put him up there with Bruce Schieder. b) The whole source is available on GitHub, compile the APK and see if it matches. c) it's incredibly easy to take an apk and disassemble it, to see if there are backdoors to begin with if you are really that cynical.

Don't get me wrong, I'm a tinfoil hatter. I use GPG, run my own MTA for anything even remotely important, use DDG over Google, donate to the EFF and use their HTTPS Everywhere plugin, have all of the Ad-Opt outs enabled that Google/Doubleclick/etc make available but try to obscure, etc. I'd be willing to bet that Google is collecting way more information than Signal is.

But hey, that's why rev-eng is so important. A wiser man than me once said "Don't turn it on, take it apart" ;)

Post reply on HN