Remix.run Logo
Cider9986 12 hours ago

>This is why as a security engineer and researcher even I do not have a Signal account.

Signal is regarded as the best mainstream messenger by many security professionals.

>they are obsessed with centralized control and user tracking, via app store stats.

Do you have any evidence they are obsessed with user tracking via all store stats? It seems reasonable to use any stats given to try to improve your app. Signal doesn't control the app stores and looking at provided stats doesn't compromise their users privacy.

"Obsessed" is a weird way to personify a company. Signal chose centralization because it's best for UX which is clear when they have 100x the users of Matrix while being more private.

>Also relying on app stores that can, with a court order

What law would legally require Apple or Google to do this? Signal doesn't rely on app stores on android as you can a signed apk download directly from them. Other apps like Element or SimpleX also are distributed on app stores.

>ship anyone an extra special fork of signal with compromised encryption, and they will never know.

This is wrong. "Anyone" can clearly not do this or it would have happened to a single app in history, and yet it has not. It would be trivially detected through reverse engineering and would only ever happen in an insane targeted attack which is not in the threat model of 99.9⁹% of people. It wouldn't be the easiest attack and authorities would use something like Pegasus instead.

>But F-Droid with independent control and reproducible builds? Unacceptable to Signal. Their stance is use proprietary partner platforms with their centralized servers so you can be tracked and backdoored at any time or GTFO.

FDroid has had terrible security practices in the past. Not sure their current status but it's not recommended by GrapheneOS.

Proprietary software is not less secure by default and can be analyzed.

>Centralized comms that force you to identify yourself and use proprietary software are an enemy of a free society.

Signal can be used without any proprietary software on GrapheneOS and by downloading Signal from their website. iOS and Android are proprietary anyway so your aren't avoiding it on those OSes.

>I do not understand the true goals of Signal, but their actions are inconsistent with their stated ones.

Their goal is more privacy for everyone, which they are clearly quite good at achieving with their skyrocketing user counts.

>This is not even getting started on their Mobilecoin premine scam that was a blatant conflict of interest and a wildly blatant violation of their non-profit charter given Moxies financial ties to Mobilecoin.

This was bad but I respect the intentions. They should have worked on Monero instead. It doesn't compromise their apps privacy, though.