TIL about the 300 member signal groups that …

you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 1 day ago* (last edited 1 day ago) (5 children)

Since @angband@lemmy.world added more to the comment with an edit:

The source code does not contain anything that would let someone break in and read your messages. That part is irrelevant.

Assuming @angband is asking about a scenario where Google is compromised and tries to push out a bad APK to update over installed apps to read the private data stores, see here: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md

Signal has supported reproducible builds since Signal Android version 3.15.0, which was first released in March 2016. This process lets you verify that the version of the app that was downloaded from the Play Store matches the source code in our public repository.

So if they pushed out a bad update to lots of people, it would get caught pretty quickly.

Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -1 points 22 hours ago (4 children)

    Still a bit of an absurd reply. Most people can't do that, and won't know to do that. Signal is secure enough for me to pass my passwords and safe code to my relatives when I go into surgery.

    It isn't trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 18 hours ago (3 children)

    It isn't trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.

    What you've described would affect any app on the play store, unless you have some other concern with the signal protocol itself?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 11 hours ago (2 children)

    That's disingenous. Most other apps don't promise cryptographically secure communications, for one. For the other, the man in the middle renders any purported security of signal moot, as I originally implied. So both disingenious, and begging the question. Logical fallacies typical of bad faith or poorly structured arguments.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 11 hours ago* (last edited 10 hours ago) (1 child)

    I thought you were saying that signal is a worse secure messaging app compared to alternatives. Based on that, I said that this would affect other secure messaging apps too.

    Is your problem that people are promising secure communication apps while also making the apps available on the Play store?

    If so, then I can understand the argument around potentially misleading people by not warning them about it. However, that's still different from the signal app itself being insecure. If you said that at the beginning, then we could all have saved some back and forth

    Logical fallacies typical of bad faith or poorly structured arguments.

    You've been so all over the place that it's hard to address what you're even talking about.

  • source
  • parent
  • hideshow 1 child comment