Hacker News Reader

Comment by mechnesium | Hacker News Reader

This my professional opinion since I lack the resources to perform a true analysis, so instead I speculate based on current nation state trends and the US government’s surveillance track record. Signal is a big red flag to me. I choose not to trust it. Signal specifically targets an audience of interest for the NSA—those who are actively trying to encrypt their communication. I have an eking suspicion that Signal could be a surveillance tool similar to the UAE’s ToTok messaging app. I don’t care if it is open source or uses E2E encryption. Unless you’re jailbroken or rooted and can install unsigned binaries, the binary you installed from the Play Store or App Store could contain backdoors. Your decision to trust and use this should be judiciously evaluated based on your threat model.

View on HN

I also had this thought. Given how vehemently reproducible f-droid builds were rejected, along with forks, and the app insistance in "phoning home" continuously on phones without Google Play at the expense of the battery, regardless of the multiple fixes submitted that were ignored. The outdated openssl in signal-desktop, the lack of libsignal development vs fancy UI, the strong rejection of any sort of federation work as "too hard", the plans to upload contacts somewhere as if the masses they target needed this at all... but yeah they added stickers so must be legit.

This is literally the definition of FUD.

How? Can you prove the binaries on the Play Store/App Store do not have backdoors? Most nation states engage in domestic surveillance. Here is a story about ToTok: https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.... Logically, chat applications are an ideal platform to engage in surveillance. There is no FUD here.

As greysonp points out, yes; Signal has had reproducible builds since March 2016. So we can prove that those published binaries do not have backdoors insofar as we can prove that the corresponding source code does not have backdoors.

If you didn’t create the binary yourself how can you trust it?

Because you can reproduce that binary bit-for-bit to confirm its corresponding source code. That's the point of a reproducible build.

https://en.wikipedia.org/wiki/Reproducible_builds

Literally yes, but it's a very reasonable fear based on a very prominent level of uncertainty and doubt in quite a few of Signal's / Moxie's decisions.

Is the binary from play/app store not reproducible? (without the google/apple signature that is)

That’s a valid question. Do these platforms provide users with signatures/checksums to reference?

Signal has had reproducible builds since March 2016. https://github.com/signalapp/Signal-Android/blob/master/Repr...

Does the App Store or Play Store provide a checksum of the binary to compare to the self compiled binary?

Reply on news.ycombinator.com