Re:Twilio incident: What Signal users need to know
by MayeulC on Monday August 15, 2022 @05:28PM
(#32475634)
> Google Play services are still required for the official builds because of the (unverifiable to be really) encrypted backups.
??? I use the official build with encrypted backups without Google services, and have been doing so for at least 3 years. I've been forward-carying my backup since 2016, too.
Re:Twilio incident: What Signal users need to know
by exyi on Monday August 15, 2022 @04:05PM
(#32474707)
we still don't know of anyone with their messages printed out. Signal probably doesn't have all the contacts hoarded on their server, while WA certainly does. For me, there is a big difference in "might be buggy" vs "certainly is privacy hostile"
I still prefer Matrix, but Signal is clearly the next best thing for chats. And it also has quite a number of non-HN users :)
Google Play services are still required for the official builds because of the (unverifiable to be really) encrypted backups.
> everything is client-side
Signal's FOSS fork developers would disagree. They got outright legal problems after they wanted to implement an open source alternative. Most APIs in regards to contact management are server-side. There's Molly as a younger fork but I'm waiting for Signal to write them also a cease and desist letter.
Honestly this is why I think that Signal should be treated the same like WhatsApp. Supposedly end to end encrypted, but only until you suddenly have the FBI with printed out chats in front of your door.
As long as Signal uses proprietary services and contains proprietary blobs in their (default aka Play store-provided) app we have to treat it as an unsecure messaging system.
Especially given the RCEs that it had in the past, where it was as simple as injecting an HTML with a script tag to install malware on your system.