cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f

As of now, Molly lastest release was in 31 July (Version v8.19.2-4).

It contains vulnerabilities that had been simply fixed in mainline Signal.

Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.

It's currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.

you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 1 week ago (31 children)

Why run Molly when Signal is right there? Is this about getting it via places other than the Play store?

  • source
  • hideshow 31 child comments
  • [–] 9 points 6 days ago (1 child)

    I'm running it specifically for the UnifiedPush support which gives me push notifications without Google Play Services.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 1 week ago (4 children)

    With Molly you can use one Signal account on two devices.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 9 points 1 week ago (9 children)

    That and unified push (although I didn't get that to work yet) are my main selling point, yes. I seriously don't understand how signal is only on the PlayStore

  • source
  • parent
  • hideshow 9 child comments
  • [–] 14 points 1 week ago (3 children)

    Are you messing with me? It's literally right below: https://signal.org/android/apk/

  • source
  • parent
  • hideshow 3 child comments
  • [+] -7 points 1 week ago (1 child)

    I'm aware of that. But I'm not going to manually download a file every time. And I especially can't expect that from family members who don't have the playstore and can't use a phone very well. A child I manage the phone for does not even have a browser so yeah

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 1 week ago*

    So use Obtainium? It's no worse than f-droid or wherever you get Molly from

    Edit: The page just fetches https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want

  • source
  • parent
  • [–] 13 points 6 days ago* (2 children)

    As a Android developer who has an app in the Play store as well as in f-droid, I'll be the first to say that the f-droid people make it an absolute pain to put things there. I've almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.

    So yeah I'm not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it's not there. Should try publish in there sometime

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 6 days ago (1 child)

    What about your own repo then? I would be totally fine with that if signal did that.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 days ago

    Sure that is the work around that guardian did for signal. It's just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it's there

  • source
  • parent
  • [–] 3 points 6 days ago

    It does some extra stuff signal doesn't ( apparently). Though there's always a risk using a 3rd party client. And I guess it might be against the TOS of signal?

    • encrypt the database with a password
    • not using google for notifications
    • ram shedding And some others....

    https://molly.im/

  • source
  • parent
  • [–] 3 points 1 week ago (3 children)

    I use molly because i have an android smartphone and tablet and running both with signal is not possible with signal. (Maybe the changed it? I have to check it)

  • source
  • parent
  • hideshow 3 child comments
  • [–] 6 points 1 week ago (2 children)

    They did! (If you're talking about pairing a tablet with your smart phone like how their desktop app pairs).

    https://aboutsignal.com/news/signal-allows-android-phones-to-be-linked-as-secondary-devices/

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 1 week ago (3 children)

    Signal is distributed by the Guardian Project on Fdroid.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 6 points 6 days ago (2 children)

    Yeah unofficially... that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).

    Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 6 days ago (2 children)
  • [–] 6 points 6 days ago* (last edited 5 days ago) (1 child)

    Session has removed forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain (delaying actual deletion). Overall though, I would stay away from it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 days ago* (last edited 5 days ago)

    It's just forward secrecy, not "perfect forward secrecy", unless you are writing Signal press material. (Edit: Parent comment was edited to use the correct term.)

    https://en.wikipedia.org/wiki/Forward_secrecy

    I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.

    Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal's reliance on a fixed identity that complicates the matter of rotating keys.

    In other words, Signal is not better because it has "perfect forward secrecy". It is worse because it needs it.

    Even so, it is such a talking point that Session does intend to implement "perfect forward secrecy".

    https://getsession.org/blog/session-protocol-v2

    As for "store all messages in a blockchain", I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren't, someone would be replying in your stead and complaining that Session does not allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.

    I find it strange that you condemn Session's use of a blockchain but are apparently unconcerned by Signal's bundling a cryptocurrency wallet and linking it to users' Signal accounts.

    https://en.wikipedia.org/wiki/MobileCoin#Signal_Integration

    https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_requirements_pin

  • source
  • parent