Signal's hostility to third party clients is a huge red flag.
They also refuse to distance themselves from Google's app store.
this post was submitted on 28 Aug 2024
306 points (100.0% liked)
Privacy
789 readers
4 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
That's outdated information:
- Molly ~5 years in development
- gurk-rs ~4 years in development
- signal-cli ~9 years in development
- Flare
- Beeper
Go forth and contribute, fork, or create your own.
They also refuse to distance themselves from Google’s app store.
This link has existed forever at this point if we count in internet years: https://signal.org/android/apk/ - getting an app directly from the developer with no middleman is about as distant as you can get from Google's app store.
Those clients exist despite Signal Foundation, not because they encourage community development. They are doing everything they can to discourage third party app development.
They are doing everything they can to discourage third party app development.
I'd say you're moving the goalpost. Other than the hostility the founder showed towards LibreSignal nearly 10 years ago now, can you source any evidence to support your claim?
Lots of red flags here in Github: https://github.com/signalapp/Signal-Android/issues/9044
That link, and I could be missing it, has nothing to do with what I claimed. Mind editing your post and quoting a red flag linked at the source you provided?
Some of my favourite red flags:
Signal's dependence on Google libraries: https://github.com/signalapp/Signal-Android/issues/9044#issuecomment-535194837
Signal dev bullshitting a non-answer and then hilariously refuting his non-answer: https://github.com/signalapp/Signal-Android/issues/9044#issuecomment-534340623
Signal hiding its serverside source code for many months: https://github.com/signalapp/Signal-Android/issues/11101
You can find many more examples.
The last one about server side code, together with Signal's funding sources and their obsession with phone numbers code leads me to suspect that Signal is just a honeypot by US intelligence.
Those clients exist despite Signal Foundation, not because they encourage community development. They are doing everything they can to discourage third party app development.
That was your original claim. None of the sources you provided back up your original claim. We can talk about Google libraries or the delay in server side code if you want to go down that path, but that's a completely different discussion. Why are you pivoting to other topics? Will you concede your original point or do you have evidence to back it up?
I wish they had Signal on F-droid but at the end of the day at least it is possible to use Molly Foss.
load more comments
(2 replies)
Yeah, I would like to use it from f-droid instead of google store or apk
https://molly.im/ Especially the FOSS version. Need to manually add the repository though.
This is the way.
Or use Accrescent
What? How is this a red flag? Having third party clients is not good for security.
Is there any merit to this comment?
When you use a client, you are relying on the client's crypto implementation to be correct. This is only one part of it and there's a lot more to it when it comes to hardening the program. Signal focuses on their desktop and mobile clients and they hire actual security professionals and cryptographers (unlike the charlatans in this thread) to implement it correctly.
Having third party clients would not definitively mean the client is bad, but it most likely would break the security model. Just take a look at Matrix's clients.
When you use a client, you are relying on the client's crypto implementation to be correct.
Nothing prevents this other client from using the same as the original app. When the alt client is just a fork, it's even easier to check if they kept it intact or not.
This is only one part of it and there's a lot more to it when it comes to hardening the program.
Something at which even the original Signal fails. It has received criticism multiple times (1, 2) for not being verifiable whether it's been tampered with by the app's distributor, and also for having included properietary google services dependencies which dynamically load further code from the phone which is also a security issue. Worthy forks solve both of these.
Signal focuses on their desktop and mobile clients and they hire actual security professionals and cryptographers (unlike the charlatans in this thread) to implement it correctly.
Last I heard (a month or so ago) the desktop client had serious unfixed issues.
I think it further erodes your point that Signal is not just hostile in terms of not wanting it, but Moxie for instance has been very, very verbal about this.
load more comments
(1 replies)
No, if your system can't support 3rd party clients properly, it is inherently insecure, especially in an e2ee context where you supposedly don't have to trust the server/vendor. If a system claims to be e2ee, but tightly controls both clients and servers (for example WhatsApp), that means they can rug-pull that e2ee at any point in time and even selectively target people with custom updates to break that e2ee for them only. The only way to realistically protect yourself from that is using a 3rd party client (and yes, I know, in case of Signal also theoretically reviewing every code change and using reproducible builds, but that's not very realistic).
Now admittedly, Signal has started to be less hostile to 3rd party clients like Molly, so it's not as bad anymore as it used to be.
Excellent point! If I'm sending someone information that could get me killed if it were intercepted by the state, I'd sure as hell want some guarantees about how the other side is handling my data. Disallowing third party clients gives me at least one such guarantee.
You have absolutely zero guarantees, with or without their policy on third party apps. You can not send sensitive information to someone else's phone and tell yourself it couldn't possibly have been intercepted, or that someone couldn't get ahold of that phone, or that the person you're sending it to won't take a screenshot and save it to their cloud.
A lot of software nowadays is doing a real disservice to their users by continuing to lie to them like this by selling them the notion that they can control their information after it has been sent. It's really making people forget basic information hygiene. No app can guarantee that message won't be intercepted or mishandled. They can only give you tools to hopefully prevent that, but there are no guarantees.
Moreover, this policy does not exclude them from including third-party functionality and warning the user when they are communicating with somebody that isn't using encryption.
Too many of these apps and services are getting away with the "security" excuse for what is effectively just creating a walled garden to lock users in. Ask yourself how you can get your own data out of these services when you decide to quit them, and it becomes more apparent what they're doing.
Of course, I fully agree! My point was just that you can eliminate the risk of poorly implemented cryptography at the endpoints. Obviously there's a thousand and one other ways things could go wrong. But we do the best we can with security.
Anyway apparently third party clients are allowed after all? So it's a moot point.
You have no control on the receiving end. Zero.
You do if third party clients aren't possible? You have control over what client the receiving end is using.
But apparently third party clients are possible, so it's moot.
Signal doesn't disallow third party clients, you should always understand the risk when messaging anyone on any platform. See my post here: https://lemmy.ml/post/19672991/13312234
Signal third party clients base off the Signal code base. They just add patches and remove certain dependencies. Also they are often more secure. You logic is from the Apple PR department.
Again, having third party clients would not definitively mean the client is bad. Obviously, if it's a simple fork with hopefully small patches that are just UI changes, it's probably not going to harm the security model.
I should have phrased this better in my original post. When I was thinking about third party clients, Matrix and XMPP immediately came to my mind. Not very simple forks. So I'll phrase this better: "Having non-trivial third party clients is not good for security." What non-trivial means is left to interpretation though, I suppose.
Appreciate the link. I still believe in Matrix, even if the client ecosystem isn't there yet. There HAS to be something to replace discord, the enshitification has already begun.
I wouldn't call it a discord alternative. It is closer to fancy IRC/live forms.
Then again I don't really use Discord
Having third party clients is not good for security.
If the first party provider told you this, you should always second guess them.
Moreover, providing an option that informed users can choose doesn't hurt security. This idea the user can't be trusted to use the appropriate type of messaging if provided options needs to die.
load more comments
(1 replies)
Do you hate Signal or do you hate the west? There legitimate reasons to not like Signal but calling them hostile toward third party clients is untrue. Last time I checked Signal wasn't proprietary.
load more comments
(12 replies)
I hope they don't arrest them too.
She's in the US
Say what you will about US but they are pouring money into the cyber security industry
This is a very rude question, but on this subject of being lean, I looked up your 990, and you pay yourself less than … well, you pay yourself half or a third as much as some of your engineers.
Yes, and our goal is to pay people as close to Silicon Valley’s salaries as possible, so we can recruit very senior people, knowing that we don’t have equity to offer them. We pay engineers very well. [Leans in performatively toward the phone recording the interview.] If anyone’s looking for a job, we pay very, very well.
But you pay yourself pretty modestly in the scheme of things.
I make a very good salary that I’m very happy with.
That's pretty cool. But knowing the number would matter.
IIRC She earns around 400+k per year. Which is a nice salary, but rather low compared to other execs.
As a happy user of Signal (no bugs or incidents from my viewpoint), I regardless chime in to say a word for decentralization. :)
Signal is centralized:
- there is a single Signal implementation, with a single developing entity
- you have to install its mobile version before you may run the desktop version
There exist protocols like Tox which go a step beyond Signal and offer more freedom -> have multiple clients from diverse makers (some of them unstable), don't have centralized registration, and don't rely on servers to distribute messages - only to distribute contact information.
In the grand comparison table of protocols (not clients), Tox is among the few lines that's all green (Signal has one red square).
0% chance that the feds don't have Signal backdoors, otherwise Wired wouldn't be promoting it. fyi everyone Proton is CIA. It's modern cryptoAG.
Well, I disagree about Signal. Proton however, I agree is extremely shady and should be avoided at all costs.
Centralized service with servers in the US, requires a phone number to create an account, and tech bros like it. "0% chance" 100% confirmed.
This is the same Meredith Whittaker doing interviews with US defense-department aligned sites like LawFare.
Why are all these big tech sites like wired so interested in pushing signal anyway?
The thing I hate about signal is the UI. Everything looks way too big on my device. WhatsApp, for example, holds 2 more chats, and the messages themselves are tidier.
This may seem like it's not a big deal, but UI is absolutely crucial on order to get people to actually use the app. I moved a few people to signal but they just hated the way it looks. "seems like an app for old people, font too big". I can see that. They moved back to insta/WhatsApp.
I think some small and easy UI changes could make the app much better: just give us a "compact" mode.
Both WhatsApp and Signal show the same amount of chats to me (9 for both). WhatsApp does show a small sliver of a tenth chat, but it's not really properly visible. There is a compact mode for the navigation bar in Signal, which helps a bit here.
From what I can see there's slightly more whitespace between chats, and Signal uses the full height for the chat (eg same size as the picture), whereas WhatsApp uses whitespace above and below, pushing the name and message preview together.
In chats the sizes seem about the same to me, but Signal colouring messages might make it appear a bit more bloated perhaps? Not sure.
load more comments
(1 replies)
view more: next ›