Comment on Signal messenger blocked in Russia, says Roskomnadzor

• Varcour@lemm.ee ⁨2⁩ ⁨months⁩ ago

  No need, all you have to do is read the whitepaper. they home brewed the encryption algorithm and nobody actually knows if it’s worth a damn. That’s not exactly a secret.

  source

  • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

    nobody actually knows if it’s worth a damn.

    After all these years, security researchers still don’t know if the encryption is any good?

    source

    • HarriPotero@lemmy.world ⁨2⁩ ⁨months⁩ ago

      On that level it usually falls on computer scientists. Formal methods can prove that any implementation is correct, but proving the absence of unintended attacks is a lot harder.

      Needham-Schroeder comes to mind as an example from back when I was studying the things.

      source

      • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

        On that level it usually falls on computer scientists.

        And not a single one has been able to analyze the encryption in all these years? Fact is, Telegram is the tool the Russian opposition and even Ukrainians use to communicate without Putin being able to infiltrate.

        source

        • -> View More Comments
  • Andromxda@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

    And it isn’t even encrypted by default, you manually have to enable that. By default, all your plain text messages are stored on their servers.

    source
• doodledup@lemmy.world ⁨2⁩ ⁨months⁩ ago

  They don’t have reproducible builds afaik (unlike Signal). You can have a completely different code running on your phone than on GitHub.

  Besides, who is using Secret Chat anyways? All default chats and group chats are unencrypted.

  source

  • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

    You can have a completely different code running on your phone than on GitHub.

    Just use the F-Droid version if there is any doubt.

    Besides, who is using Secret Chat anyways?

    Probably Russians who used Signal before.

    source

    • doodledup@lemmy.world ⁨2⁩ ⁨months⁩ ago

      The F-droid version is also not reproducible. The binary you install has a different hash than the one you build from the GitHub.

      source

      • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

        The F-droid version is also not reproducible. The binary you install has a different hash than the one you build from the GitHub.

        F-Droid builds from source, so any suspicion whether the Google Play version has been tampered is completely irrelevant for the F-Droid version.

        source
      • Nonononoki@lemmy.world ⁨2⁩ ⁨months⁩ ago

        It’s reproducible if you compare it with F-droid’s tarball, which has all the source code in it.

        source
• catloaf@lemm.ee ⁨2⁩ ⁨months⁩ ago

  Can it be proven that that encryption is what’s used in practice?

  source

  • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

    Just use the F-Droid version if there is any doubt.

    source

    • Andromxda@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

      What about iOS users?

      source

      • woelkchen@lemmy.world ⁨2⁩ ⁨months⁩ ago

        What about iOS users?

        Apple is not selling iPhones in Russia after the beginning of the invasion.

        source

        • -> View More Comments