Hacker News Reader

How does reproducible builds help you verify that you friends don’t have compromised builds installed? I haven’t used Signal, so I don’t know, but is there some way for your client to verify the client on the other end?

Knowing that your client isn’t compromised is pointless if you friend can’t/won’t do verification on their end.

View on HN

This isn't something you can reasonably protect against and I don't even see this as a purely technical problem.

Even if you could verify Signal, what about the OS being compromised, the phone being lost or a shoulder surfer reading the message?

Even if I tell a friend a secret over dinner I can't 100% verify that they are not going to tell someone else. So some degree of trust in the other party is required.

If you can't trust the person to take the technical steps needed to secure the information, why do you trust them to not just share your secret the old fashioned way?

Even if you could verify the client on the other end, that doesn't help you if the OS that client runs on is compromised because your friend carelessly allowed macros in an office document.

Reply on news.ycombinator.com