Hacker News Reader

Comment by amedvednikov | Hacker News Reader

Signal is openly against third party clients, they basically killed LibreSignal:

https://github.com/LibreSignal/LibreSignal/issues/37#issueco...

Also how easy is it to run a custom Signal server?

If you're going to say what is said under every submission about Signal you should I least mention that it is a choice they made and that they gave reasons why [1], whether you disagree with their arguments.

I am personnally glad that both options exist.

[1] https://signal.org/blog/the-ecosystem-is-moving/

You can only trust E2EE if whoever controls the server does not also control the client. Otherwise they can just backdoor the client.

I wonder what'd happen if a three letter agency subpoena'd Signal and demanded Signal's app signing key so they can ship a backdoored update to a handful of targets.

Interesting how the issue there was both usage of their servers and the name.

Molly (https://github.com/mollyim) uses their servers but not their name and seems to be operating just fine. I've been using it for almost a year now.

I found it primarily because I wanted to run Signal on a tablet.

It's not super easy. Both sides of the issue have fair points. Clearly it's not going to happen within upstream signal any time soon(if ever).

So it would have to be a fork, and so far nobody seems particularly motivated enough.

The "ease" with which one can run their own Matrix server is currently what causes the most problems that I see in the wild.

I love matrix, I use it a lot, it has its place. But Signal just works.

If they believe that uncontrolled 3rd-party clients would make it easier to breach their protocol (because they know their protocol's weaknesses), it would make sense to be openly hostile to 3rd-party clients.

If there's no third party client then the e2e is completely moot because Signal could be forced to push a backdoor to their customers and they would never know e2e has been removed.

Fair point, I guess it goes both ways.

The strength and security of any good protocol, especially Signal's, does not come from obscurity.

See https://en.wikipedia.org/wiki/Security_through_obscurity

How would a third party client make it easier to breach the protocol? You can still study the source of the client, the protocol, make a fork of it and modify it, etc. The official client is fully open source.

The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.

Reply on news.ycombinator.com