Why reinvent the wheel?
Signal does the job, doesn't store data, not even metadata, and can be used immediately.
Signal does the job, doesn't store data, not even metadata, and can be used immediately.
Isn't that just a promise? Also, even then, it is based on your contacts, which are seen by google.
Your phone number is sent to Signal's servers during sign-up and it uses the conventional SMS service to "close the loop" and prove this number is under your control. Having signed up you can use a PIN to lock the number to you so that anyone without that PIN can't do the "new phone" dance (this expires if you stop answering PIN questions correctly)
If you choose to do so a digest of your contact's phone numbers can be sent to Signal for them to match against the set of (also digested) numbers of Signal users so they can tell you who has Signal enabled.
Whether you choose to give your contacts to Google, to Facebook, to Apple or whoever is up to you and outside Signal's control.
Signal does let you create an encrypted profile, and then your device can tell other people's devices the keys to look at the profile if you want to allow that. You don't have to use a profile or trust anybody else if you don't want to. Signal doesn't learn the keys (unless I guess you deliberately sent them those keys) so they can't read the profile.
Unlike many of its competitors Signal's messages can't be read by Signal, in most cases this includes who sent them (Signal's "Sealed Sender" means in most cases if you correspond with someone the indication of who sent them a message will be encrypted such that they can tell you sent it but Signal only knows it was someone they authorised to send them messages). When you attach images Signal avoids learning how large the images are exactly, and if you use a service like GIPHY to add typical meme images like Stephen Colbert eating popcorn Signal double-proxies this so that they don't learn which GIF you used, and GIPHY doesn't learn who used it.
Edit: Fixed name of GIPHY. Huh.
I can look it out for myself but there won't be any point as they can simply run different code on their servers.
> If you believe that despite precautions the source code won't match what actually runs on your phone
On their servers
Also what precautions? As far as I know their binaries are not reproducible.
> this expires if you stop answering PIN questions correctly
After a week if I remember correctly.
> a digest of your contact's phone numbers
> also digested
A hash? This does not protect against anything. There are much less than 2^32 active mobile phone numbers per country. It would be trivial to brute-force it.
> Whether you choose to give your contacts to Google, to Facebook, to Apple or whoever is up to you and outside Signal's control.
The point is that someone* other than you will be able to see the metadata. It does not matter if it is Signal or not.
OK.
That's true for literally all services. Do you expect to be able to walk into the server rooms and dump the binaries to inspect them?
> Also what precautions? As far as I know their binaries are not reproducible.
The client builds are. Reproducible server builds don't tell you anything about what is running.
The point is that your client should not send any information which you expect to keep private to their services. It is the exact reason that we use e2ee rather than just tls for chats.
> The client builds are
Not fully, see https://signal.org/blog/reproducible-android/
> Reproducible builds for Java are simple, but the Signal Android codebase includes some native shared libraries that we employ for voice calls (WebRTC, etc). At the time this native code was added, there was no Gradle NDK support yet, so the shared libraries aren’t compiled with the project build.
> Getting the Gradle NDK support set up and making its output reproducible will likely be more difficult.
Yes. And Signal achieves this better than all the other major options, given the number of footguns in the other tools.
If you are concerned about the client builds then run a decompiler. It's not hard. People have been auditing binaries for ages.
You can use a different contacts app, you don't have to give all your information to Google. My contacts are managed by a Nextcloud instance.
As far as I know OWS does not mention this anywhere on their site nor on their program -- aren't the issues with usability of other programs and lack of sane defaults (such as with gpg) often given as an argument by signal supporters on why you should prefer it?
That being said, is that even possible? I admit that I am not too familiar with how Android phones work. Signal requires the google play services in order to work, right? Is this not enough for google to see your information?
Signal also released a WebRTC version that doesn't depend on Google Play Services if that floats your boat.
https://www.aclu.org/open-whisper-systems-subpoena-documents
You can also disable contact backup on Android.
But the code is right there for you to read it and re-use it, you just won't get far building your own network with one user and demanding everybody else switch over.