Why do people assume Signal messenger isn’t spying on you? Yes, it has open source code, yes it uses end-to-end encryption. But we can’t check which code runs in the version from Google Play or the App Store. And also their APK (IPA) build process is essentially a black box, it doesn’t use GitHub Actions or some other transparent build system. I also heard from Techlore that they add a proprietary part to the apk to filter bots. The only thing I can assume is that people scanned the traffic coming from the app (Android), phone (iOS) and checked whether encryption keys were being sent to Signal or not. But it seems to me that this can be also circumvented. What do you think?

P.S. I myself use Signal to communicate with relatives and friends. Definetly not a hater.

  • Shizu@lemmy.world
    link
    fedilink
    arrow-up
    17
    ·
    1 year ago

    The beauty of open-source is that you can build an APK/IPA yourself and be sure that your app - your version is truly not spying on you. I think most people just take Signal’s devs words for it that it’s the same.

    • FarLine99@lemm.eeOP
      link
      fedilink
      arrow-up
      4
      arrow-down
      9
      ·
      edit-2
      1 year ago

      You can build IPA but that’s all. How could you install this IPA on normal iPhone (without jailbreak)? And if you send message to recepient that uses it, then they can spy on your messages through recepient’s phone 🙂

      • chris_0725@feddit.de
        link
        fedilink
        arrow-up
        23
        ·
        1 year ago

        You simply dont get an Iphone ;)

        No but seriously the “spy on the other users phone” is something you got a point about. But isnt that a genuine issue if you use non-open source code on your phone? Like if you go that far isnt anything other than stock android that you compiled yourself unsafe?

        • FarLine99@lemm.eeOP
          link
          fedilink
          arrow-up
          4
          arrow-down
          5
          ·
          edit-2
          1 year ago

          😁

          On my phone LineageOS is installed and their build process is completely open. BUT! This does not negate the fact that my messages end up on another person’s iPhone and this ± black box can transmit data to Signal servers, f.e. using notifications functionality.

          Once again, I don’t think that’s really the case. The reputation risks are too high to listen to the messages of some random son and mother. And it would also be possible to detect this using traffic analysis (if someone done this). But. Posibillity is there 😄

          • Netto Hikari@social.fossware.space
            link
            fedilink
            English
            arrow-up
            9
            ·
            1 year ago

            With that logic, you’d have to go completely off-grid and not use any kind of messenger.

            With Apples CSAM scanning and similar features that could be introduced in any OS we’re using, no messaging app is really safe from spying eyes.

            • chris_0725@feddit.de
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              You can install your own precompiled Android, make shure the reciever does aswell, host an end-to-end encypted messaging server on your own and you are set. Maybe use thor browser aswell, but that shouldnt be necessary

      • Shizu@lemmy.world
        link
        fedilink
        arrow-up
        11
        arrow-down
        1
        ·
        1 year ago

        If you have a Mac and xcode on it you build the IPA and deploy it to your iphone thru xcode. A developer needs to be able to test their own application this xcode just uses your regular devices and let’s you deploy onto them.

          • sv1sjp@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            I was talking about iPhone.

            On Android yes, OpenBoard, AOSP keyboard, KryptEY keyboard for example are find

        • FarLine99@lemm.eeOP
          link
          fedilink
          arrow-up
          1
          arrow-down
          2
          ·
          edit-2
          1 year ago

          We are talking about Signal spying on us, not Apple (Google). And I’m talking about the messages that I sent, not the person to me. And it doesn’t matter that the information will go to one place. Let’s not talk about it 😁