Hacker News Reader

Comment by Kwpolska | Hacker News Reader

> However, given that you can report messages to Meta for violating the terms of use, they clearly do have mechanisms to read messages.

That’s not a reasonable assumption IMO. The report API most likely takes the message your phone has decrypted (so that you can read it) and sends it over to Meta. This doesn’t break end-to-end encryption. Neither does me copying the message from a friend and posting it on Twitter.

View on HN

The point of e2ee is already lost anyways.

What does E2EE potentially give you? A promise, which does not involve trusting the service provider, that messages can only read by the recipient.

What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook

"What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook"

It does change the requirement of collection.

It's no longer "Well all this data is rolling in, what shall we do with it".

It's "Hey, if we commit THREE BILLION FELONIES of backdooring our every users' encryption, we can access all that data".

Surely you realize that's a leap.

How do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?

If I care about binary integrity, I wouldn't involve an app store. https://signal.org/android/apk/ is a perfectly cromulent way to get your hands on the APK file directly from the source.

How do you keep that updated? What if there is a security issue?

pull the apk from your phone with apktool. Compile Signal reproducibly with their instructions. Use the diff.py tool they provide and check for the message that confirms the APKs match.

Compile it yourself and compare the hash.

idk, diff the binaries?

Reply on news.ycombinator.com