Hacker News Reader

Signal is open source. But you have to trust the OS it runs on...

And even if you trust the OS, you have no idea what is going on on the phone's baseband processor: https://en.m.wikipedia.org/wiki/Baseband_processor

One has to assume that all are back-doored. Mobile phones are inherently not trustable.

Same goes for all major firewall vendors. If you going to hack one of them as a nation state, then you're going to do all of them.

There is at least one project that seeks to mitigate the threat posed by baseband processors having DMA, Neo900: http://neo900.org/faq#privacy

Even if you trust the OS and the baseband, you have to trust that the federated server for Signal (OpenWhisper, Cyanogen, etc) isn't storing contact discovery requests.

And the hardware the OS runs on... Intel and others are now embedding "management" features at a very low level.

Reply on news.ycombinator.com