Andromxda 🇺🇦🇵🇸🇹🇼

Mastodon: @Andromxda@infosec.exchange

wiki-user: Andromxda

  • 0 Posts
  • 29 Comments
Joined 8 months ago
cake
Cake day: March 22nd, 2024

help-circle

  • So it knows about all metadata

    Metadata is encrypted on the client-side using Signal’s sealed sender implementation. The client also removes as much metadata as possible. All of this is open-source and happens in the client application.

    plus registration with phone number

    Signal doesn’t store phone numbers. It derives a user id from your phone number along with other parameters. It’s in the open-source server code, you can check it out yourself.

    you need to use the client built by Signal

    No you don’t. I myself use a fork of Signal called Molly.

    with dependencies from Google Services and the like

    Not true again. You don’t need to use the official binary that includes Google libraries. These aren’t required for the app to function. You can use Signal-FOSS or Molly-FOSS, and it works just fine.

    and you can’t use one built from the source they provide

    If this was true, forks like Signal-FOSS or Molly wouldn’t exist.

    Which at that point means they can introduce whatever they want in whichever version.

    Stupid conclusion, because all of your previous points are false

    Stop spreading false information, focus on the facts.



  • Signal having the server code closed source for more than a year so the Signal devs could get a headstart and insider knowledge

    That argument makes absolutely no sense. This server-side code does almost nothing. The only task it really has is passing around encrypted packets between clients. All of the encryption is client-side, of course including metadata encryption. That’s how end-to-end encryption works. The server code really doesn’t matter. The Signal protocol, which is used for client-side, local, on-device end-to-end encryption has always been fully open, and it can be used by any app/platform.

    How one can trust Signal after them showcasing what they truly stand for is mind blowing

    It’s very simple. The client is open source, and the encryption happens locally within the client application. You don’t need to trust anything or anyone except for the code and mathematics, which are fully open, so you can verify them yourself.

    It’s mind-boggling how people attempt to spread so much misinformation while having absolutely no understanding of the topic their talking about.