Why do people assume Signal messenger isn’t spying on you? Yes, it has open source code, yes it uses end-to-end encryption. But we can’t check which code runs in the version from Google Play or the App Store. And also their APK (IPA) build process is essentially a black box, it doesn’t use GitHub Actions or some other transparent build system. I also heard from Techlore that they add a proprietary part to the apk to filter bots. The only thing I can assume is that people scanned the traffic coming from the app (Android), phone (iOS) and checked whether encryption keys were being sent to Signal or not. But it seems to me that this can be also circumvented. What do you think?

P.S. I myself use Signal to communicate with relatives and friends. Definetly not a hater.

  • chris_0725@feddit.de
    23·
    1 year ago

    You simply dont get an Iphone ;)

    No but seriously the “spy on the other users phone” is something you got a point about. But isnt that a genuine issue if you use non-open source code on your phone? Like if you go that far isnt anything other than stock android that you compiled yourself unsafe?

    • FarLine99@lemm.eeOP
      45·
      1 year ago

      😁

      On my phone LineageOS is installed and their build process is completely open. BUT! This does not negate the fact that my messages end up on another person’s iPhone and this ± black box can transmit data to Signal servers, f.e. using notifications functionality.

      Once again, I don’t think that’s really the case. The reputation risks are too high to listen to the messages of some random son and mother. And it would also be possible to detect this using traffic analysis (if someone done this). But. Posibillity is there 😄

      • Netto Hikari@social.fossware.spaceEnglish
        9·
        1 year ago

        With that logic, you’d have to go completely off-grid and not use any kind of messenger.

        With Apples CSAM scanning and similar features that could be introduced in any OS we’re using, no messaging app is really safe from spying eyes.

        • chris_0725@feddit.deEnglish
          1·
          1 year ago

          You can install your own precompiled Android, make shure the reciever does aswell, host an end-to-end encypted messaging server on your own and you are set. Maybe use thor browser aswell, but that shouldnt be necessary