11–20 of 71 posts
It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised. Is there open source alternative for Signal?
The backdoor referred to can be applied to any Android app that uses Google Maps. Also mentioned is that using the built-in Google keyboard is a vulnerability, because in theory it gives Google the ability to keylog you. I supposed this boils down to knowing your adversaries. If you number Google amongst that list, life is going to be really difficult - no matter who you are.
It is still possible to run a phone with Signal without any proprietary google code on your phone (see: microG).
>tl;dr: There is a “backdoor” in Signal nobody cares about, only Google can use it. Speak for yourself. This backdoor is the reason why I don't use Signal.
Why even use a phone?
If you're considering Google an adversary, perhaps you shouldn't use stock Android, or any of their software. If you're considering Google an adversary, and use a version of Android without Google support, you can't use Signal anyway.
Actually, it is possible to use Signal on Android without Google using the opensource microG and Xposed framework (setup is a bit involved...but you can google that :P for a guide).
>tl;dr: There is a “backdoor” in Signal nobody cares about, only Google can use it. Speak for yourself. This backdoor is the reason why I don't use Signal.
You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware? Why even use a phone?
I'm reasonably confident that my phone's OS is uncompromised and I take the radio problem into consideration as part of my threat model and change my behaviors on my phone accordingly. I have also made some progress on using OsmocomBB as a radio baseband, and on building a custom phone that treats the radio as hostile and isolates it as much as possible.
The backdoor referred to can be applied to any Android app that uses Google Maps. Also mentioned is that using the built-in Google keyboard is a vulnerability, because in theory it gives Google the ability to keylog you. I supposed this boils down to knowing your adversaries. If you number Google amongst that list, life is going to be really difficult - no matter who you are.
I mean yes, it's basically impossible to do this. Even if you used a completely free OS, you still have radio chips to contend with etc.
>tl;dr: There is a “backdoor” in Signal nobody cares about, only Google can use it. Speak for yourself. This backdoor is the reason why I don't use Signal.
>tl;dr: There is a “backdoor” in Signal nobody cares about, only Google can use it. Speak for yourself. This backdoor is the reason why I don't use Signal.
Doesn't Google have root anyway? They could backdoor your OS and grant a third party access to phone through that.
If you're considering Google an adversary, perhaps you shouldn't use stock Android, or any of their software. If you're considering Google an adversary, and use a version of Android without Google support, you can't use Signal anyway.
Actually, it is possible to use Signal on Android without Google using the opensource microG and Xposed framework (setup is a bit involved...but you can google that :P for a guide).
If you're considering Google an adversary, perhaps you shouldn't use stock Android, or any of their software. If you're considering Google an adversary, and use a version of Android without Google support, you can't use Signal anyway.
So without the mentioned issues through Play Services and Gboard, Google would not be able to access your Signal messages. On Stock Nexus/Pixel builds they can of course push updates that change this...