Hacker News Reader

Comment by sschueller | Hacker News Reader

This is a mistake. They should at least compile their own version and not something that comes from an US based app store under US law. At any point the US can force a change.

This is as secure as purchasing a machine from Crypto AG. [1]

[1] https://en.wikipedia.org/wiki/Crypto_AG

View on HN

The OS is US based too and they could easily keylog everything. Even if you wipe out the OS for a self-compiled one, there are blobs running full blown OS in the hardware and it has access to every single hardware resource, good luck getting rid of that one without building your own hardware and drivers from scratch.

> good luck getting rid of that one without building your own hardware and drivers from scratch.

For an individual that is obviously infeasible. For the continent of Europe as a whole, it obviously isn't. Why shouldn't they put some money into developing cellphone hardware with open source drivers?

The size of the supply chain required for such an endeavor is so huge and spread among various countries and companies worldwide this would be a big task even for the EU. I mean, competing with the like of Broadcom and ARM from scratch. Good luck with that. Even then, the NSA would just need to pay or blackmail a single entity in the supply chain to get their backdoor in there. The EU itself would probably implement their own backdoor. Also open source doesn't mean it will be backdoor free https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...

You don't have to refuse to take an ARM license (although RISC-V is also a thing). You may not even have to design your own chips at all -- they could just pay an existing manufacturer for design specifications and then both audit the design and develop and publish open source firmware for it.

Supply chain security is an independent problem. First you have to know exactly what the design is supposed to be, only then can you verify that it actually is.

Signal provides reproducible builds these days: https://signal.org/blog/reproducible-android/

Not sure how feasible this is on iOS (with Bitcode).

This is for external communications for any case people would most likely be using WhatsApp. It's not for official, internal or classified stuff.

Giving this advice has almost no cost and, at least arguably, it is better for staff to use Signal than other messengers. So, IMHO, this is good advice.

Not if the staff is lured by all the E2EE promises and all the lock icons to overestimate the security of the app and share more information than they would otherwise.

Not using something that actually improves security because people might think that it actually improves security is a crappy argument. If your phone is insecure for two separate reasons you should fix both of them instead of using each as an excuse not to fix the other.

Yeah, but the fix should be using Matrix, not Signal. IMHO

Perhaps a better idea would be to fund an audit of the Signal app. (Or has that been done already?)

Doesn't help figure out if the signal update of the day that comes from the store is any good.

That is true. But given how much interest there is to find vulnerabilities in the Signal app, I would be very surprised if anyone would succeed in putting up a compromised Signal app on the App store and also be able to fly under the radar.

The "anyone" in this case would be Signal. No need to fake it when Signal is under US law.

Ok lawyer, explain which US law allows compelled speech considering in djb vs US it was decided code was speech, and protected by the first amendment.

And if Signal did this you think no-one would notice?

With cooperation, you could literally target just certain devices with the compromised version.

IMHO, the cost of that attack is pretty darn high.

An audit would only prove that the current code is secure.

Does F-Droid support signed releases, and does Signal sign their APKs? In fact, aren't all APKs signed?

Signal is not on F-Droid, because m0xie does not want that[1].

Some forks of Signal are, though[2].

[1] https://community.signalusers.org/t/how-to-get-signal-apks-o... [2] https://forum.f-droid.org/t/signal-in-f-droid-in-2018/2847

Ah, yes, I forgot about that. Too bad they don't even publish the APK on signal.org.

They do https://signal.org/android/apk/

Thanks, I missed that.

It's not as though staff will be installing it from the App store on their phones.

How else would they install it on their phones?

If it's Android the apk can be side loaded.

Their IT department will handle it

Crypto AG was an intel op the entire time. Where is your proof Signal works for and is owned by the American government?

Reply on news.ycombinator.com