Hacker News Reader

Comment by zx8080 | Hacker News Reader

With their proprietary client it does not matter how secure is a protocol. There's always a risk of bad update or total compromise. And of course ads need to be targeted.

View on HN

Exactly. E2EE is just "transit encryption" when clients are not open source/ audited/ trusted. And FB cannot be trusted (I'm not going to list instances by which they gained my distrust here).

Encrypting metadata is also really hard. See the Matrix (and XMPP) community for detailed discussions on why that is.

I use and advise others to use E2EE encrypting tools, all are open source, audited and popular.

Fake sense of safety is worse than understood unsafety.

That’s it right - they get the goodwill of “we value privacy, look we gave you e2ee” and yet they still get to use your data and serve you targeted ads. Creeps.

Exactly. The protest against Reddit's ban on third party clients needs to be more widespread. We want FOSS clients for all IM, discussion and social media platforms.

Same with WhatsApp and signal

I thought Signal is open source?

Also their builds are fully reproducible on Android.

Is there a guide how one can check that the PlayStore version matches the source code?

Here is one: https://github.com/signalapp/Signal-Android/tree/main/reprod...

US spooks can get Apple or Google to deliver altered apps to targets, if nothing else.

Source?

AppStore and PlayStore are not open source, so you trust the distribution mechanism, is what I think parent wanted to say.

But you don't need to install them via their store. Also, you can always check the hash code of the binary.

I'm not sure about that. But true, in that case only the fact that's not open source is still in the way of me giving it my "baseline safe" approval. :)

It's "source available". They make changes to their server code, run those modified servers for a year or so and then release a source.

The server code isn't relevant in this case, you want the client code to be secure.

Well signal isn’t taking personal data or targeting people with ads, so no. Signal afaik cant access your data and it’s open source so assume has been proven.

Last I checked, Signal requires and uses your phone number.

Actually I think you’re right - there is one data point. Pretty impressive

Reply on news.ycombinator.com