Hacker News Reader

Comment by _b8r0 | Hacker News Reader

If you're considering Google an adversary, perhaps you shouldn't use stock Android, or any of their software.

If you're considering Google an adversary, and use a version of Android without Google support, you can't use Signal anyway.

View on HN

Actually, it is possible to use Signal on Android without Google using the opensource microG and Xposed framework (setup is a bit involved...but you can google that :P for a guide).

This still relies on Google's servers to support push messages FYI.

"without Google proprietary code on your phone"

https://microg.org/ wow never knew about this

Even with stock Android, on devices != Pixel or Nexus, Google parts are sandboxed in a way making it hard for them to access private app data. The only way would be to deliver a different app through play store which is easy to discover as it breaks the cryptographic signature and must be done on first install (android uses TOFU).

So without the mentioned issues through Play Services and Gboard, Google would not be able to access your Signal messages. On Stock Nexus/Pixel builds they can of course push updates that change this...

They can patch the sandbox out in an update, right?

On Pixel and Nexus, yes. for every other device it would require coop with the device manufacturer: they build the open-source code (+ their own proprietary extensions), add google apps and libraries (that are sandboxed) and sign the build. Only they have the private keys to provide updates, Google does not have full device access.

Reply on news.ycombinator.com