Google generates the apk after compiling it, and signs it with a key they previously generated. They’ve publically stated they want your code to recompile as they wish.
All the replies to this are dense. If google can recompile your code, they are the ultimate man-in-the-middle.
Here, google keeps signing keys to customize the apk, this means they can insert code in the app, regardless of whether it is source or compiled. This means they can copy the signal encryption keys and send them anywhere.
https://developer.android.com/guide/app-bundle/
Signal has supported reproducible builds since Signal Android version 3.15.0, which was first released in March 2016. This process lets you verify that the version of the app that was downloaded from the Play Store matches the source code in our public repository.
So if they pushed out a bad update to lots of people, it would get caught pretty quickly.
Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.
Still a bit of an absurd reply. Most people can’t do that, and won’t know to do that. Signal is secure enough for me to pass my passwords and safe code to my relatives when I go into surgery.
It isn’t trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.
That’s disingenous. Most other apps don’t promise cryptographically secure communications, for one. For the other, the man in the middle renders any purported security of signal moot, as I originally implied. So both disingenious, and begging the question. Logical fallacies typical of bad faith or poorly structured arguments.
I thought you were saying that signal is a worse secure messaging app compared to alternatives. Based on that, I said that this would affect other secure messaging apps too.
Is your problem that people are promising secure communication apps while also making the apps available on the Play store?
If so, then I can understand the argument around potentially misleading people by not warning them about it. However, that’s still different from the signal app itself being insecure. If you said that at the beginning, then we could all have saved some back and forth
Logical fallacies typical of bad faith or poorly structured arguments.
You’ve been so all over the place that it’s hard to address what you’re even talking about.
What do you mean by this? Isn’t Google’s signing key only used to verify an update for an app is actually the for correct app?
Even if Google could decompile the app, they wouldn’t have access to Signal’s servers or any encryption keys so they couldn’t read any messages.
Google requires source code to publish in the play store. Google owns a copy of the signing key. Google can rewrite your software in your name. It has been this way for years.
I don’t know what an app bundle consists of, which the page you linked says google needs, but it can’t include the source code because google has recently been paying some developers for access to their source code - https://www.techrepublic.com/article/news-google-android-code-offer/
In any case, having access to the source code will not grant access to encryption keys or allow anyone to decrypt messages. After all Signal is already open source so anyone can use the Signal protocol for encrypting messages, which is exactly what WhatsApp does.
Paying for access means licensing. And your second argument is downright incorrect.
https://developer.android.com/guide/app-bundle/
I just had to check, it doesn’t require source, but just some compiler resource files, but that also doesn’t matter. Google keeps the signing keys and can read all input and also signals private keys, and the user wouldn’t know.
It says specifically, google generates the apk. That means they can shim the whole app, regardless of source code. People subject to government surveillance shouldn’t consider any app store application safe.
Doubtful. Google owns the signing keys specifically so they can recompile for individual downloads.
Edit : here is google info page on it https://support.google.com/googleplay/android-developer/answer/9842756?hl=en
Google generates the apk after compiling it, and signs it with a key they previously generated. They’ve publically stated they want your code to recompile as they wish.
All the replies to this are dense. If google can recompile your code, they are the ultimate man-in-the-middle.
Here, google keeps signing keys to customize the apk, this means they can insert code in the app, regardless of whether it is source or compiled. This means they can copy the signal encryption keys and send them anywhere. https://developer.android.com/guide/app-bundle/
They aren’t encrypting the messages with the signing keys.
Do you even know how a signing key work?
Since @angband@lemmy.world added more to the comment with an edit:
The source code does not contain anything that would let someone break in and read your messages. That part is irrelevant.
Assuming
@angbandis asking about a scenario where Google is compromised and tries to push out a bad APK to update over installed apps to read the private data stores, see here: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.mdSo if they pushed out a bad update to lots of people, it would get caught pretty quickly.
Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.
Still a bit of an absurd reply. Most people can’t do that, and won’t know to do that. Signal is secure enough for me to pass my passwords and safe code to my relatives when I go into surgery.
It isn’t trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.
What you’ve described would affect any app on the play store, unless you have some other concern with the signal protocol itself?
That’s disingenous. Most other apps don’t promise cryptographically secure communications, for one. For the other, the man in the middle renders any purported security of signal moot, as I originally implied. So both disingenious, and begging the question. Logical fallacies typical of bad faith or poorly structured arguments.
I thought you were saying that signal is a worse secure messaging app compared to alternatives. Based on that, I said that this would affect other secure messaging apps too.
Is your problem that people are promising secure communication apps while also making the apps available on the Play store?
If so, then I can understand the argument around potentially misleading people by not warning them about it. However, that’s still different from the signal app itself being insecure. If you said that at the beginning, then we could all have saved some back and forth
You’ve been so all over the place that it’s hard to address what you’re even talking about.
Yeah right.
What do you mean by this? Isn’t Google’s signing key only used to verify an update for an app is actually the for correct app? Even if Google could decompile the app, they wouldn’t have access to Signal’s servers or any encryption keys so they couldn’t read any messages.
Google requires source code to publish in the play store. Google owns a copy of the signing key. Google can rewrite your software in your name. It has been this way for years.
I don’t know what an app bundle consists of, which the page you linked says google needs, but it can’t include the source code because google has recently been paying some developers for access to their source code - https://www.techrepublic.com/article/news-google-android-code-offer/
In any case, having access to the source code will not grant access to encryption keys or allow anyone to decrypt messages. After all Signal is already open source so anyone can use the Signal protocol for encrypting messages, which is exactly what WhatsApp does.
Paying for access means licensing. And your second argument is downright incorrect.
https://developer.android.com/guide/app-bundle/ I just had to check, it doesn’t require source, but just some compiler resource files, but that also doesn’t matter. Google keeps the signing keys and can read all input and also signals private keys, and the user wouldn’t know.
It says specifically, google generates the apk. That means they can shim the whole app, regardless of source code. People subject to government surveillance shouldn’t consider any app store application safe.