this post was submitted on 20 Oct 2024
30 points (76.8% liked)

Technology

60055 readers
3751 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago
MODERATORS
L3s
[email protected]
[email protected]
L4s
enu
30
Why doesn't Signal forbid third party clients or at least offer a client certification program to ensure security? (feddit.org)
submitted 2 months ago* (last edited 2 months ago) by [email protected] to c/technology
16 comments fedilink hide all child comments
 

  • Signal forks can have unexpected behaviours like retaining deleted messages and also they don't get updated at the same rate that Signal get updated.

  • Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossible or very hard to be done If they blocked third party clients. (Ex: 1)

  • The amount of people who use third party Signal clients are very few anyway.

I saw what WhatsApp did to forbid modification of it's app which works in stopping a lot of distributions, why doesn't Signal do the same?

you are viewing a single comment's thread
view the rest of the comments
[–] tekato 19 points 2 months ago (1 children)

They don’t allow 3rd party clients, as per their ToS:

You must not (or assist others to) access, use, modify, distribute, transfer, or exploit our Services in unauthorized manners, or in ways that harm Signal, our Services, or systems. For example you must not (a) gain or try to gain unauthorized access to our Services or systems; (b) disrupt the integrity or performance of our Services; (c) create accounts for our Services through unauthorized or automated means; (d) collect information about our users in any unauthorized manner; or (e) sell, rent, or charge for our Services.

You need authorization to access Signal servers, which they don’t give:

we really don't want forked versions of the app maintained by other parties connecting to our servers. Not only could the users using the forked version have a subpar experience, but the people they're talking to (using official clients) could also have a subpar experience (for example, an official client could try to send a new kind of message that the fork, having fallen out of date, doesn't support). I know you say you'd advocate for a build expiry, but you know how things go. Of course you have our full support if you'd like to fork Signal, name it something else, and use your own servers.

In my opinion, this is a horrible decision from Signal.

[–] visor841 13 points 2 months ago* (last edited 2 months ago)

Yeah this is a big part why I'm very skeptical of Signal. It feels a lot like Ubuntu's snap store, it's technically open but you can't really interact with the main corporate controlled ecosystem.