Re:A Formal Security Analysis of the Signal Messaging Protocol
by haffenloher on Tuesday November 08, 2016 @06:10PM
(#12904791)
> You can compile Signal yourself, and install it on a rooted phone [...] OWS doesn't then allow you to use their servers for routing/discovery etc
? That's a misunderstanding. You can of course use the official servers with your self-compiled version. (side note: I also don't think your phone needs to be rooted for this)
Re:A Formal Security Analysis of the Signal Messaging Protocol
by e12e on Tuesday November 08, 2016 @08:05PM
(#12905341)
Ok, that makes sense. It's only compiled binaries distributed through third party app stores that cannot (should not) use the official servers?
Re:A Formal Security Analysis of the Signal Messaging Protocol
by haffenloher on Tuesday November 08, 2016 @10:46PM
(#12905904)
Yeah, they prefer if you don't distribute your builds (i.e. something named Signal and / or using their servers) to other people (because they don't actually know what's inside the builds, they've got no update channel, etc.)
OWS doesn't then allow you to use their servers for routing/discovery etc - so you need to run your own servers, and set up a different network that cannot federate with the one users of the Google Play Appstore version of Signal use.
If you do that, and install eg. the F-Droid store, you've now given another actor (the F-Droid store) access to your phone. OWS argues that in general you're less likely to manage to run a safe, patched system this way.