Hacker News Reader

Comment by aussieguy1234 | Hacker News Reader

While the government can't crack Signal or put a backdoor in its official code, it could force your favorite appstore to send its own backdoored Signal to your phone as a push update.

Same goes for any apps, people will probably start turning off auto update now, makes for a much more secure world doesn't it?

View on HN

You don't need to crack signal. You just need to log what the user enters on the keyboard. On android any third party keyboard (SwiftKey, Swype etc.) is already collecting this data and probably just a warrant is needed to get to it.

I was under the impression that Google Play Store apps were cryptographically signed by the developer/publisher (not by Google), and the phone would refuse to update the app if the key behind the signature had changed. Am I wrong on this?

Wouldn't playstore itself be the the simplest yet most effective target for these laws rather than Signal?

Signal themselves aren't on f-droid which has far more protections and the apk download is basically hidden on their site.

Google certainly has no qualms about China, is draconian Australia much of a stretch?

Applications are signed by Signal, so Google can't make fake ones.

Google does implement the apk signing verification (shipped as a binary in their ROMs), and they could easily make exceptions for applications if they wanted to. Don't assume that what you see in AOSP is the source form of what google ships.

Reply on news.ycombinator.com