Not sure why you're gettimg downvoted. This is exactly what he did to instant messaging; extremely damaging to everyone and without solid arguments for such design.
>broken SGX metadata protections
Citation needed. Also, SGX is just there to try to verify what the server is doing, including that the server isn't collecting metadata. The real talking is done by the responses to warrants https://signal.org/bigbrother/ where they've been able to hand over only two timestamps of when the user created their account and when they were last seen. If that's not good enough for you, you're better off using Tor-p2p messengers that don't have servers collecting your metadata at all, such as Cwtch or Quiet.
>weak supply chain integrity
You can download the app as an .apk from their website if you don't trust Google Play Store.
>a mandate everyone supply their phone numbers
That's how you combat spam. It sucks but there are very few options outside the corner of Zooko's triangle that has your username look like "4sci35xrhp2d45gbm3qpta7ogfedonuw2mucmc36jxemucd7fmgzj3ad".
>and agree to Apple or Google terms of service to use it?
Yeah that's what happens when you create a phone app for the masses.
"You have to agree to Apple's terms to use it"? What's Signal meant to do, jailbreak your phone before installing itself on it?
This criticism has absolutely zero substance and honestly just reads like paranoid rambling. The Signal protocol has been independently formally analyzed [1] and has no known security issues.
The specific part is that Signal forces Google and Apple on its users, and forces the specific kind of push notifications, too.
(You really have a lot of free time to write unsubstantiated dismissals to all my posts.)
Are you against using an Android (or LineageOS) emulator to do so?
> (You really have a lot of free time to write unsubstantiated dismissals to all my posts.)
You pop up in a lot of threads I'm interested in and seem to say a lot of incorrect things, that's all.
1. It's annoying and inconvenient.
2. It's the result of an artificial restriction by Moxie, for which I can't see any good reason, making me suspicious. In my opinion, this is basically an attack on true mobile freedom.
3. I do not believe in a good app isolation of Waydroid, so I would prefer to use as rare as possible. I also do not trust Android too much. And I will have to run two Signal apps simultaneously.
> so-called creator of some encryption protocol
All evidence points to him being one of the protocol’s designers, along with Trevor Perrin.
I’ve met both of them. The first time I met Moxie and talked about axolotl (as it was called back then) was in 2014. Moxie and Trevor strike me as having more integrity and conviction than most. There is no doubt in my mind that they are real and genuine.
Interestingly enough, some of the work Trevor did related to Signal’s cryptography was later used by Jason Donenfeld in the design of WireGuard.
> It screams honeypot like nothing else.
As you can see there is plenty of evidence suggesting otherwise.
Even if you do all that, it is not an official option, let alone a recommended one. The recommendation is to accept the google or apple terms of service.
Moxie even went as far as to say he would actively do anything in his power to discourage or stop the use of third party clients.
Potentially targeted users are set up to fail.
> Yeah that's what happens when you create a phone app for the masses.
No, that's what happens when you actively forbid alternative clients and servers, prevent (secure) alternative methods of delivery for your app and force people to rely on the American megacorps known for helping governmental spying on users, https://news.ycombinator.com/item?id=38555810
I wish apple & google provided a way to verify that an app was actually compiled from some specific git SHA. Right now applications can claim they're opensource, and claim that you can read the source code yourself. But there's no way to check that the authors haven't added any extra nasties into the code before building and submitting the APK / ios application bundle.
It would be pretty easy to do. Just have a build process at apple / google which you can point to a git repo, and let them build the application. Or - even easier - just have a way to see the application's signature in the app store. Then opensource app developers could compile their APK / ios app using github actions. And 3rd parties could check the SHA matches the app binaries in the store.
Is that a typo or are you really implying half the human population use Signal?
Edit: I misread, you are counting almost every messaging app user.
>Citation needed.
https://en.wikipedia.org/wiki/Software_Guard_Extensions#List...