Comment on Time to get serious with E2E encrypted messaging

• mox@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago

  It’s been recently added to FDroid.

  No, it has not. A third-party published it in an f-droid compatible repository. That might be convenient for people who happen to trust that third party and manually add it to their F-Droid client, but it is not at all like it being added it to F-Droid.

  You can use NTFY with Molly (which has been on FDroid for some time).

  This does not refute what I wrote. Unless you only communicate with people who get their Signal app from some non-Google source and they all rig up alternative push notification channels, your conversations are still tied to Google. Perhaps you have so few contacts that you could achieve that, but approximately nobody else is in that position.

  network-level metadata monitoring by anyone with sufficient access/influence at Signal or their data center provider (such as a government who doesn’t like encrypted messaging).
  

  This one is just a straight-up lie. Everything on the server is encrypted and no one has the keys except the participants.

  Encryption doesn’t network traffic invisible. Signal’s centralised design means there is a single point where that traffic can be monitored and traced to reveal which endpoints are talking to each other, and where, and when.

  What I write is not a lie, which you would know if you actually understood these issues.

  Please stop making baseless accusations. You are being very rude.

  source

  • fushuan@lemm.ee ⁨1⁩ ⁨month⁩ ago

    Their github releases have the apk available so you can manually download it and install it or use obtainium.

    github.com/signalapp/Signal-Android/releases

    source

    • Andromxda@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

      It’s also available on their website btw: signal.org/android/apk/

      source
  • Andromxda@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    your conversations are still tied to Google

    That’s simply false. Signal Notifications never include the content of the message or any metadata, no matter if they’re sent over FCM, APN, WebSockets or UnifiedPush (via mollysocket). That wouldn’t even be possible, since the Signal server sending out the notification doesn’t even have the key to decrypt the message. Only the users involved in the conversation have the keys, that’s how end-to-end encryption works. Signal simply sends an empty message via FCM (or any other push system), and the Signal app on your device then receives and decrypts the encrypted message and shows you a preview of the message content as a notification on your operating system.

    And every build of the Signal client for WhatsApp also supports WebSockets as a fallback push notification system, in case Play services aren’t installed or can’t be reached. The only reason why FCM is used by default is that it saves some battery, because it only maintains one background network connection for all apps, instead of each app handling notifications themselves.

    source

    • mox@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago

      The point is that since Signal’s default, well-supported installations use Google services, those services are present on most of your contacts’ devices. You might have the knowledge, skill, and motivation to avoid those services on your own device, but since they’re still present at the other end of most chats, you haven’t escaped them.

      It’s also worth noting that E2EE doesn’t protect the endpionts, and that Google Play Services run with system-level privileges.

      source

      • Andromxda@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

        Signal’s default, well-supported installations use Google services

        Signal only uses FCM for notifications, with a fallback mechanism (WebSockets) being available in all builds of the app, as well as Google Maps for location sharing (which most people probably don’t use anyway).

        so unless you’re an extremely atypical user, those services are present on most of your contacts’ devices

        Google Play services being present on people’s devices has nothing to do with Signal including the library. They are present on almost every Android device, because Google pressures OEMs to include them and grant them system level privileges.

        Let’s also remember that E2EE doesn’t protect the endpionts

        Yeah, but that’s the case with EVERY messenger app, so I really don’t know what your point is here?

        source
  • EngineerGaming@feddit.nl ⁨1⁩ ⁨month⁩ ago

    I would be more concerned about how phone-oriented it is. A phone’s default OS is such spyware that I am not sure just what is safe from from being uploaded. And even if the person wants a more private alternative, most phones have locked bootloaders. On the other hand, Linux would run on damn near anything… But using Signal on it without a smartphone is very annoying. No way my mom would understand an Android VM or a command-line client, because the desktop client isn’t feature-full and doesn’t even allow registration.

    source
  • Ulrich@feddit.org ⁨1⁩ ⁨month⁩ ago

    or every one of them uses Signal exclusively on iOS, your conversations are still tied to Google

    Just because someone else uses Google on the other end does not make it dependent on Google on your end.

    you are being very rude.

    I’m being rude because you’re spreading FUD and misinformation and actively making people unsafe. If you have evidence to prove that Signal has access to all of that information, feel free to share with the class. Otherwise, shut it.

    If Signal had access to any of that information they would have been legally compelled to provide it when they were served with warrants but they did not, which proves that you’re incorrect.

    source