Signal has supported reproducible builds since Signal Android version 3.15.0, which was first released in March 2016. This process lets you verify that the version of the app that was downloaded from the Play Store matches the source code in our public repository.
So if they pushed out a bad update to lots of people, it would get caught pretty quickly.
Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.
Still a bit of an absurd reply. Most people can’t do that, and won’t know to do that. Signal is secure enough for me to pass my passwords and safe code to my relatives when I go into surgery.
It isn’t trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.
That’s disingenous. Most other apps don’t promise cryptographically secure communications, for one. For the other, the man in the middle renders any purported security of signal moot, as I originally implied. So both disingenious, and begging the question. Logical fallacies typical of bad faith or poorly structured arguments.
I thought you were saying that signal is a worse secure messaging app compared to alternatives. Based on that, I said that this would affect other secure messaging apps too.
Is your problem that people are promising secure communication apps while also making the apps available on the Play store?
If so, then I can understand the argument around potentially misleading people by not warning them about it. However, that’s still different from the signal app itself being insecure. If you said that at the beginning, then we could all have saved some back and forth
Logical fallacies typical of bad faith or poorly structured arguments.
You’ve been so all over the place that it’s hard to address what you’re even talking about.
They aren’t encrypting the messages with the signing keys.
Do you even know how a signing key work?
Since @angband@lemmy.world added more to the comment with an edit:
The source code does not contain anything that would let someone break in and read your messages. That part is irrelevant.
Assuming
@angbandis asking about a scenario where Google is compromised and tries to push out a bad APK to update over installed apps to read the private data stores, see here: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.mdSo if they pushed out a bad update to lots of people, it would get caught pretty quickly.
Now if an individual is worried that they are high profile enough to be targeted as an individual, they really should be installing from a source other than the play store.
Still a bit of an absurd reply. Most people can’t do that, and won’t know to do that. Signal is secure enough for me to pass my passwords and safe code to my relatives when I go into surgery.
It isn’t trustworthy against google or any state google iis regulated by, by any measure of cryptographic theory since whenever.
What you’ve described would affect any app on the play store, unless you have some other concern with the signal protocol itself?
That’s disingenous. Most other apps don’t promise cryptographically secure communications, for one. For the other, the man in the middle renders any purported security of signal moot, as I originally implied. So both disingenious, and begging the question. Logical fallacies typical of bad faith or poorly structured arguments.
I thought you were saying that signal is a worse secure messaging app compared to alternatives. Based on that, I said that this would affect other secure messaging apps too.
Is your problem that people are promising secure communication apps while also making the apps available on the Play store?
If so, then I can understand the argument around potentially misleading people by not warning them about it. However, that’s still different from the signal app itself being insecure. If you said that at the beginning, then we could all have saved some back and forth
You’ve been so all over the place that it’s hard to address what you’re even talking about.
Yeah right.