Signal: No evidence that 0day is real

https://twitter.com/signalapp/status/1713789255359619171

by skilled • 3 years ago

38 21 3 years ago

twitter.com

skilled• 3 years ago

Context,

https://hax0rbana.social/@adam/111236822600142276

https://news.ycombinator.com/item?id=37888531

Nitter,

https://nitter.net/signalapp/status/1713789255359619171

ploum• 3 years ago

The thread on Mastodon: https://mastodon.world/@signalapp/111243840362802813

pizzafeelsright3• 3 years ago

I am not sure you can trust signal or any other app that offers E2EE.

Would there be any way to independently verify a claim?

I am working on some E2EE as well while trying to answer the question with full transparency.

Download a binary and trust the moment it is typed the content is encrypted.

joshuamorton• 3 years ago

Signal provides source code and binary hashes, so you can build from source and ensure the running binaries match the source you built from.

You can further use tools like Wireshark to show that the data sent away from your device is encrypted.

So yes, this is fairly straightforward.

FirmwareBurner• 3 years ago

You can further use tools like Wireshark to show that the data sent away from your device is encrypted

That's pretty pointless. Everything is encrypted nowadays, what you want to know is if it's encrypted well enough to not be easily decrypted by any actors.

pizzafeelsright3• 3 years ago

Thank you. Now why can't the service be used without a phone number?

Phones leak data that remove privacy.

Moldoteck4• 3 years ago

I guess the question was referring to how do we know it's e2ee and not simple server-client encryption? Ideally, it would be nice to be able to add additional custom encryption on any client, so that ppl that really need it will be extra protected

sofixa• 3 years ago

You can further use tools like Wireshark to show that the data sent away from your device is encrypted.

Data sent away from your device is encrypted on Facebook Messenger and Telegram too, but that doesn't mean anything if it's decrypted upon arrival at the server, or if the receiver backs everything up in plaintext.

Signal: No evidence that 0day is real

Related Stories