Signal is also on F-Droid, so it should Bd verifiable
Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption
Tanoh@lemmy.world 5 days agoAnd Signal is open source so, if it did anything weird with private keys, everyone would know
Well, no. At least not by default as you are running a compiled version of it. Someone could inject code you don’t know anything about before compilation that for example leaked your keys.
One way to be more confident no one has, would be to have predictable builds that you can recreate and then compare the file fingerprints. But I do not think that is possible, at least on android, as google holds they signature keys to apps.
MaggiWuerze@feddit.org 5 days ago
pressanykeynow@lemmy.world 5 days ago
Signal has reproducible builds and here’s the instruction how to check it on Android github.com/signalapp/Signal-Android/…/README.md
Tanoh@lemmy.world 4 days ago
If they have, then good. Wasn’t sure it was doable with current google’s signing process. Highly unlikely someone hasn’t tampered with them then (far easier to target the site displaying the “correct” fingerprint).
However, my original point still stands. Just because it is open source doesn’t in itself mean that a bad actor can’t tamper with it.