Being prebuilt isn’t the same as open source! By that metric Linux is closed source because 99.9% of Linux users don’t build their own kernels (and those that do ought to shower anyway).
Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption
Tanoh@lemmy.world 1 month agoAnd Signal is open source so, if it did anything weird with private keys, everyone would know
Well, no. At least not by default as you are running a compiled version of it. Someone could inject code you don’t know anything about before compilation that for example leaked your keys.
One way to be more confident no one has, would be to have predictable builds that you can recreate and then compare the file fingerprints. But I do not think that is possible, at least on android, as google holds they signature keys to apps.
wallabra@lemmy.eco.br 1 week ago
MaggiWuerze@feddit.org 1 month ago
Signal is also on F-Droid, so it should Bd verifiable
pressanykeynow@lemmy.world 1 month ago
Signal has reproducible builds and here’s the instruction how to check it on Android github.com/signalapp/Signal-Android/…/README.md
Tanoh@lemmy.world 1 month ago
If they have, then good. Wasn’t sure it was doable with current google’s signing process. Highly unlikely someone hasn’t tampered with them then (far easier to target the site displaying the “correct” fingerprint).
However, my original point still stands. Just because it is open source doesn’t in itself mean that a bad actor can’t tamper with it.