- Why would meta have access to signal’s memory?
- That’s why code audits have been done multiple times.
- Reproducible builds. Signal has those since 2016
Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption
RIotingPacifist@lemmy.world 9 hours ago-
In The method described, it doesn’t matter if Signal encrypt the message before it leaves your phone, the plaintext is still in the app and gets sent to Meta while also being encrypted.
-
It’s basically impossible to know this isn’t happening based on reading source code, because the code to load widgets doesn’t have to be remotely close to the messaging code, you’d have to read the entire signal code based.
-
There is way to know that the code you read on GitHub is the code Google/Apple install on your phone.
EisFrei@lemmy.world 9 hours ago
protogen420@lemmy.blahaj.zone 8 hours ago
about the 3rd, is the end apk file downloaded by a useer on the playstore reproducible? could google add stuff to the apk before the user downloading it? do users ever bother checking if the apk hash matches the one from the reproducible build?
9bananas@feddit.org 5 hours ago
no, that’s why it’s called fingerprinting:
it’s a kind of mathematical function that takes the entire code as input and outputs a unique result.
the result is just some string of symbols (which really just represent a unique string of 1’s and 0’s).
this unique string of characters is, as mentioned, unique for any given input.
this string can then be compared to any arbitrary other string, and if they match, then you know it’s the same code.
so in the case of signal anybody can download the source, compile it, and verify that it matches the fingerprint of the compiled code on their own device.
that’s why it can’t be faked: you compare the already compiled code.
if even a single digit of the code is out of place, it’s not going to result in the same string, and thus immediately get flagged as a mismatch.
it’s mathematically impossible to fake.
just_another_person@lemmy.world 9 hours ago
🤣🤣🤣😂
Bruv, before Signal launched they posted an entire whitepaper detailing their protocol, the working mechanisms of the system, and source code. So to reply to your 3 points:
If you don’t understand how any of this works, it’s just best not to comment.
RIotingPacifist@lemmy.world 9 hours ago
Why would any message be plaintext?
Fair you could have just said they have reproducible builds or linked to the docs: github.com/signalapp/Signal-Android/…/README.md
Again you are missing the point of the attack
Back at you, even if you are right that signal is secure, the attack is not what you think it is.
just_another_person@lemmy.world 8 hours ago
What in the world are you talking about here, bud? Your comments are making zero sense.
Look, seriously, if my comment is being upvoted, it’s because I responded to yours, and people understand what I am saying in response.
You, unfortunately, clearly do not understand what I’m saying because you do not grasp how any of this works.
RIotingPacifist@lemmy.world 8 hours ago
Lmao, sure buddy pat yourself on the back because you got upvotes.
You’re talking about E2E encryption as if it prevents side-channel attacks, but sure morons will upvotes because they also don’t understand real world security.
The only useful thing you’ve pointed out in your deluge of spam, is that Signal builds are reproducible which does protect against the attack described (as long as there isn’t a backdoor in the published code)