Re:Ask HN: How do we know Signal or Telegram don't store our...
by restingrobot on Wednesday January 13, 2021 @06:38PM
(#25769562)
Technically they could get the signature key, but they can't force Signal to publish it via the store. Users would have to download an .apk file and install it directly. At that point there is no reason to have the signing key at all as the phone will recognize a sideload as a third party install. As far as I know, the government cannot compel a company to do something like update an app.
[ Parent
| on HN ]
Re:Ask HN: How do we know Signal or Telegram don't store our...
by Mediterraneo10 on Wednesday January 13, 2021 @06:43PM
(#25769622)
> but they can't force Signal to publish it via the store
Is there not a suspicion that Google, another US-based corporation, may have some agreement with American national security to supply malicious APKs to individual targets via the Play Store? Having Signal’s signing key would allow the state to present that custom-targeted APK as an ordinary Signal version update.
Re:Ask HN: How do we know Signal or Telegram don't store our...
by vel0city on Wednesday January 13, 2021 @07:46PM
(#25770222)
While I'm not saying Google hasn't done something like this (I have no proof either way) there's a strong legal argument to be made that forcing a company to produce binaries is compelled speech which goes against the first amendment.