Granted, the part

The globally recommended app by privacy and security experts, Signal, is now being downloaded massively and tops the Danish Google Play Store

is a little ironic, but you gotta push this winning tide and then work from that.

  • Vincent@feddit.nl
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    4 days ago

    Because there will always people running Signal from a different source, and only one of them is sufficient to notice the server has been tampered with.

    (And I’m not sure if they have reproducible builds yet, but if they do, people can also verify that even the Google Play-provided APK does or doesn’t match the published source code.)

    • plyth@feddit.org
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      4 days ago

      notice the server has been tampered with.

      Which server?

      doesn’t match the published source code

      People don’t control their phone. There is no way of knowing if the installed app is the one that is running.

      • Vincent@feddit.nl
        link
        fedilink
        English
        arrow-up
        3
        ·
        3 days ago

        Which server?

        The server running Signal’s server-side code.

        People don’t control their phone. There is no way of knowing if the installed app is the one that is running.

        Some do, and that’s the point: if there’s an attempt at tampering, interested security researchers can detect it.

        • plyth@feddit.org
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          3 days ago

          The server running Signal’s server-side code.

          What could a client detect? Signal is a US company and will comply with the government. The server can’t be trusted.

          Some do, and that’s the point: if there’s an attempt at tampering, interested security researchers can detect it.

          They can detect if a different app was installed from the store on their phone. That’s not useful for anybody to know if their own app is unaltered. Only people of interest will receive a manipulated client. So there is no security in knowing that some people received the original app.

          Besides, Google runs the OS. They can change the app at runtime.

          • Vincent@feddit.nl
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 day ago

            What could a client detect? Signal is a US company and will comply with the government. The server can’t be trusted.

            As mentioned before, it could detect that the server is not running the published source code. So long as it’s untampered with, and the published source code is trusted, the server can be trusted. And again, for message encryption that is only an additional layer of protection; the messages are encrypted before reaching the server, so even if the server was malicious, it still couldn’t see the contents. That’s the whole point.

            They can detect if a different app was installed from the store on their phone

            I think you’re conflating points here - the detection was about detecting whether the server had been tampered with.

            I’m not sure what specifically you’re arguing for, here. It would’ve been nice for Signal to not have been in the US, and it can be coerced to stop working altogether, but your communication is at least as safe as any other app, at least the ones of comparable usability. Or are you’re just saying we’re all lost anyway and we might just as well give up and communicate via public Twitter posts?