Why do people assume Signal messenger isn't spying on you? Yes, it has open source code, yes it uses end-to-end encryption. But we can't check which code runs in the version from Google Play or the App Store. And also their APK (IPA) build process is essentially a black box, it doesn't use GitHub Actions or some other transparent build system. I also heard from Techlore that they add a proprietary part to the apk to filter bots. The only thing I can assume is that people scanned the traffic coming from the app (Android), phone (iOS) and checked whether encryption keys were being sent to Signal or not. But it seems to me that this can be also circumvented. What do you think?
P.S. I myself use Signal to communicate with relatives and friends. Definetly not a hater.
The beauty of open-source is that you can build an APK/IPA yourself and be sure that your app - your version is truly not spying on you. I think most people just take Signal's devs words for it that it's the same.
You can build IPA but that's all. How could you install this IPA on normal iPhone (without jailbreak)? And if you send message to recepient that uses it, then they can spy on your messages through recepient's phone π
You simply dont get an Iphone ;)
No but seriously the "spy on the other users phone" is something you got a point about. But isnt that a genuine issue if you use non-open source code on your phone? Like if you go that far isnt anything other than stock android that you compiled yourself unsafe?
First there is AltStore, which is not a jailbreak.
I think you can also load any app with a free dev account.
π
On my phone LineageOS is installed and their build process is completely open. BUT! This does not negate the fact that my messages end up on another person's iPhone and this +- black box can transmit data to Signal servers, f.e. using notifications functionality.
Once again, I don't think that's really the case. The reputation risks are too high to listen to the messages of some random son and mother. And it would also be possible to detect this using traffic analysis (if someone done this). But. Posibillity is there π
With that logic, you'd have to go completely off-grid and not use any kind of messenger.
With Apples CSAM scanning and similar features that could be introduced in any OS we're using, no messaging app is really safe from spying eyes.
You can install your own precompiled Android, make shure the reciever does aswell, host an end-to-end encypted messaging server on your own and you are set. Maybe use thor browser aswell, but that shouldnt be necessary
If you have a Mac and xcode on it you build the IPA and deploy it to your iphone thru xcode. A developer needs to be able to test their own application this xcode just uses your regular devices and let's you deploy onto them.
Yes, a convincing answer. Didn't think it is that easy π
So you want to send private messanges typed by a virtual keyboard with spyware?
There are reasonably secure Android forks.
I was talking about iPhone.
On Android yes, OpenBoard, AOSP keyboard, KryptEY keyboard for example are find
We are talking about Signal spying on us, not Apple (Google). And I'm talking about the messages that I sent, not the person to me. And it doesn't matter that the information will go to one place. Let's not talk about it π
But many people around me are.
Great argument. Loneliness, go ahead! π₯
You know a lot about the word cringe. Like π
The best option is obviously a Degoogled Android device. But l, for normal users iOS is the straight-up better option for privacy and security. Apple collects information for its own use; Google is the planetβs largest advertising platform, data broker, and marketing data collector.