31–40 of 71 posts
Earlier quoted context omitted.
Actually, it is possible to use Signal on Android without Google using the opensource microG and Xposed framework (setup is a bit involved...but you can google that :P for a guide).
This still relies on Google's servers to support push messages FYI.
Earlier quoted context omitted.
also on F-Droid you can find "Silence" which is a fork of "Signal" but only for SMS texts.
True, but you still need to be aware of who your potential adversary is. If it is someone with access to SMS network texts logs, these encrypted texts will light up like a Christmas tree for someone looking for something unusual.
And worse tie itself to a company whose business model is based on creepily stalking you all over the internet and getting users psychologically accustomed to the fact they are under surveillance. These are serious escalations that go unnoticed because SV has become a magnet for those who want to profit from it.
A half way serious and sincere effort will be open source, not tied in any remote way to known surveillance companies, and based in a country that genuinely respects privacy.
People seem to love analyzing security of tiny corners of systems while ignoring the rest of the system, and entirely avoiding figuring out a scope for the security.
The post complains about Signal using a Google service, that Google could utilize (either now or through an update) for malicious activity. A Google service that without a fair share of poking around is only available on Google versions of Android. I mean, what.
While this is a more serious problem than the usual whine about GCM (Yes, notifications can give a lot of info, but in case of Signal, the info given is "You received something from some Signal user while you were offline"), it is still amazing how blind the analysis seem to the environment. If you cannot trust Google to provide a "non-evil" Google play services, why the flying fuck do you think the Google-provided (or manufacturer-under-tight-google-control-provided) OS is fine? They could backdoor the process isolation and poke around at Signal memory if they felt like it.
Now, if you are security conscious and willing to let go of the conveniences of selling your soul to Google, you would be running a non-Google'd version of Android without Google services. Your only valid complaint in this case, is that Signal depends on Google services to operate, which makes you unable to use it (without hacking Google back into your Android version, but if you do that you might just as well stick to a Google version).
Oh, and what about the black box binary drivers you are using on your super-secure handset? Baseband? CPU (ME anyone?)? SIM card?
Before you talk about security, figure out what you are trying to protect against, and start from the top. You look like an idiot if you complain about breakable windows but do not notice that the door is open.
It seems that if you really want proper secure channel you need to write one yourself. Anything out there is subject to being compromised. Is there open source alternative for Signal?
You don't have to look far. The actual Signal client source is licensed under GPLv3. Edit: And server code under AGPLv3.
https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
---------------------------
Glad someone points out the technical details of why many people had doubts about signal. Unfortunately, Moxie will dismiss it, and his following will claim "it affects other apps too" as if that makes it any better. "Other apps do it too" is not the standard a "privacy" app should aim for.
tl;dr: this is stupid. People seem to love analyzing security of tiny corners of systems while ignoring the rest of the system, and entirely avoiding figuring out a scope for the security. The post complains about Signal using a Google service, that Google could utilize (either now or through an update) for malicious activity. A Google service that without a fair share of poking around is only available on Google ver…
That's like saying you shouldn't fix your leaking engine, if your brakes don't work.
>tl;dr: There is a “backdoor” in Signal nobody cares about, only Google can use it. Speak for yourself. This backdoor is the reason why I don't use Signal.
You don't use Signal because your phone manufacturer can put a backdoor in the OS or hardware? Why even use a phone?
Can we please stop calling these types of vulnerabilities "backdoors"?