Signal app downloads spike as US protesters seek message encryption

Post by RL_Quine » Fri, Jun 05, 2020, 3:00 AM UTC

raspyberr wrote: post #5

killswitched wrote: post #4

One has to wonder about behind the scenes heuristics as it pertains to taking a chance distributing a backdoored version sideloaded into the App Stores. One also wonders about whether the encryption or app are possibly compromised generally (even if the source is vetted and distributions are verified) Perhaps most of interest though would be how many phones are owned otherwise, to give access to the protester Signal…

Signal does a pretty good job at minimizing the metadata it has access to. For example, the app can tell you who of your contacts has Signal installed but the Signal service itself never gets to see your contacts ( https://signal.org/blog/private-contact-discovery/ ).

Post by RL_Quine » Fri, Jun 05, 2020, 3:01 AM UTC

senectus1 wrote: post #3

matheusmoreira wrote: post #2

I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.

will only happen if phone manufactures ship them by default rather than the unsecure by default ones they ship atm. Sounds crazy when I say it outloud...

Post by Nextgrid » Fri, Jun 05, 2020, 3:03 AM UTC

RL_Quine wrote: post #13

senectus1 wrote: post #3

Earlier quoted context omitted.

will only happen if phone manufactures ship them by default rather than the unsecure by default ones they ship atm. Sounds crazy when I say it outloud...

iMessage is end to end encrypted by default. Perhaps not as strongly, but it's a good default to begin with.

Post by ciarannolan » Fri, Jun 05, 2020, 3:06 AM UTC

Nextgrid wrote: post #15

RL_Quine wrote: post #13

Earlier quoted context omitted.

iMessage is end to end encrypted by default. Perhaps not as strongly, but it's a good default to begin with.

Key management is still centralized and controlled by Apple, so they can still MITM communications by messing with the key exchange. iCloud backups (enabled by default) are not end-to-end encrypted. So while it's technically E2E, in practice you get very little protection from it because it's broken by design. I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims;…

Post by gentryb » Fri, Jun 05, 2020, 3:11 AM UTC

shawnz wrote: post #16

drdrey wrote: post #10

Earlier quoted context omitted.

How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.

How do you know the compiler actually compiles the source code to the binary you expect without injecting backdoors? How do you know that the hardware actually follows the instructions in the binary as they are specified? How do you know you're not living in a computer simulation in which the operators can access your data without any backdoors whatsoever?