Comment by hiq | Hacker News Reader

Comment by hiq | Hacker News Reader

Parent Full thread

Your points have little to do with security (which is the main angle of Matthew Green's thread), especially because of reproducibility.

Even then

> You need to download it from the Google Play Store.

Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself.

> pushed the update to everyone but no one could inspect the source code.

That was for the server code, which you shouldn't care about from a security standpoint for an E2EE messenger such as Signal. AFAIK that was not the case for the clients.

Regarding your other points, they have reasons that have been discussed elsewhere[0] to avoid federation, notably a lot of the progress on the Signal protocol would be way harder in a federated setting. There's no other messenger that has the same usability ("my grandfather can use it and won't have problems using it afterwards") while being at this level security-wise.

[0]: https://signal.org/blog/the-ecosystem-is-moving/

> Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself.

That page tells me that the safest way is to have a Google account, with Google Play Services installed on my phone, and to download it from the Google Play Store.

It then gives me an APK link after saying "Danger zone" and "most users should not do this".

If the app developer tells me it's dangerous and I shouldn't do it, can you even expect users to do this?

Well, the page is correct. That's the safest way.

I don't know how to verify the SHA fingerprint without Googling (I know how it works, just don't do it often to know the exact openssl or equivalent command).

If I'm downloading the APK directly on the phone, there's a lot that's not under Signal's control that could happen.

What if I'm directly under attack, and I'm trying to move to Signal? The attacker could MITM the connection and intercept the download.

I think that's a fair warning to show a user, because indeed most users will likely want to install apps through Play Store, that'll reduce/remove supply chain risks. Users who know enough about APKs would be able to verify the hash, or build it themselves.

Even if I download the APK, I still have to accept a similar warning when installing it on my phone.

> If the app developer tells me it's dangerous and I shouldn't do it, can you even expect users to do this?

If you care about reproducible builds and avoiding trusting Google, you're already in the class of not-most-users.

Signal seems to have usually taken a pragmatic stance of defaults mattering.

Afaicr, that was the argument for linking to phone numbers (it allowed for more lazy users to use it) and encryption by default (few turn on opt-in-encryption).

And it seems accurate to say 'for most users, who don't know what they're doing and don't want to play personal-IT-department, using the Google Play store is more safe and secure.'

Google Play, for all its failings, IS the safest way to get an APK right now.

F-Droid for as much as I love the open platform, does not provide any security guarantees about what you're downloading. It is a volunteer run project and does not have the extensive security policies and practices that Google has. From https://f-droid.org/en/about/

> Although every effort is made to ensure that everything in the repository is safe to install, you use it AT YOUR OWN RISK.

Likewise downloading and side-loading it from their website, requires you to disable some security guarantees by doing things like enabling developer mode.

You know what you're doing, so you can ignore those errors. Seems like a much better alternative to endorsement of apk downloads directly from websites for non tech-literate users.

Do you disagree? The main issue I see with sideloads is that you don’t get automatic updates. I’d do that for an app I built myself, but not if the app is in the Play Store.

With Signal you actually do. The APK gotten from their website isn't the same from GPlay. It has an auto updater (will prompt you with a notif when a new version comes out, which you can click to install), and doesn't come with a FCM push notification system.

You're moving the goalposts now. Your comment was factually incorrect on a very basic point, own it and move on.

Reply on news.ycombinator.com