I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
It's my default and over a few years I've pretty much converted everyone in my life except my mom
Signal app downloads spike as US protesters seek message encryption
31–40 of 367 posts
Re: Signal app downloads spike as US protesters seek message encryption
#32Earlier quoted context omitted.
Learn cryptography to a high level then read the source code?
I never realized signal code was available open source... so in theory one could “build” then load the software via developer tools (assuming you have an iOS dev account). https://github.com/signalapp/Signal-iOS Are there any “certs”/keys you would need to talk to your contacts?
Ya they are pretty open, their blog explains a lot of their design decisions as well.
Re: Signal app downloads spike as US protesters seek message encryption
#33I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
Re: Signal app downloads spike as US protesters seek message encryption
#34I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
I was about to ask about this. Signal was comparatively annoying. Can I keep using Telegram or am I postponing the inevitable? Curious.
Re: Signal app downloads spike as US protesters seek message encryption
#35Earlier quoted context omitted.
How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
Determinism. https://tests.reproducible-builds.org/debian/reproducible.ht... We're making great strides into software being completely deterministic. The Bitcoin project for many years has had completely deterministic binaries and a ceremony process for GPG signing the output with many individual parties.
See my other comment about determinism: https://news.ycombinator.com/item?id=23424925
Trying to get a bit-to-bit equivalent of a binary lifted from the app store sounds challenging to say the least.
Re: Signal app downloads spike as US protesters seek message encryption
#36Earlier quoted context omitted.
How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
How do you know the compiler actually compiles the source code to the binary you expect without injecting backdoors? How do you know that the hardware actually follows the instructions in the binary as they are specified? How do you know you're not living in a computer simulation in which the operators can access your data without any backdoors whatsoever?
That's my point, you can't establish trust by checking everything yourself. So you delegate to other things as an approximation. In this case, Signal seems to be reputable, have competent developers and afaik no history of leaks or malevolence so I would rely on that rather than a half-assed source code review.
Re: Signal app downloads spike as US protesters seek message encryption
#37I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
I would ditch WhatsApp in a heartbeat if Signal had a browser client.
Re: Signal app downloads spike as US protesters seek message encryption
#38Re: Signal app downloads spike as US protesters seek message encryption
#39Re: Signal app downloads spike as US protesters seek message encryption
#40Earlier quoted context omitted.
Key management is still centralized and controlled by Apple, so they can still MITM communications by messing with the key exchange. iCloud backups (enabled by default) are not end-to-end encrypted. So while it's technically E2E, in practice you get very little protection from it because it's broken by design. I still use iMessage because of the user experience, but let's not be fooled by their misleading E2E claims;…
If both parties disable iCloud on their phones, does Apple have any way to read messages sent via iMessage?
They can still pull off an MITM attack by sending the MITM’s keys (pretending to be the other user’s keys) because they control they key exchange.
It’s an active attack and can’t apply retroactively but within these constraints they can still do it.