Hacker Newsnew | past | comments | ask | show | jobs | submit | mfwoods's commentslogin

No. The clients are open source, and (at least on Android) you are able to verify that the source on Github is the same that was used to compile the client on Google Play with reproducible builds [1].

And even if the servers turn out to be malicious, the clients are designed to expose as little metadata as possible with things like private contact discovery[2], sealed sender[3] and private groups[4]. It's not perfect, but the data a malicious server could collect is limited.

[1] https://github.com/signalapp/Signal-Android/tree/master/repr...

[2] https://signal.org/blog/private-contact-discovery/

[3] https://signal.org/blog/sealed-sender/

[4] https://signal.org/blog/signal-private-group-system/


But you cannot verify the source code and binary of the server or set up your own independent one, so reproducible builds don't help here.


That's true, and in that sense it doesn't really matter if they publish the server source or not (although they really should continue to do so). What does matter is that the client was designed with a possible malicious server in mind so you don't have to trust the code the server is running.


But you can verify that the source they publish on Github is the same that was used to built the Google Play version with reproducible builds[1]. Also, Android apps are fairly easy to decompile. They are very likely to get caught if they publish an update with a backdoor.

[1] https://github.com/signalapp/Signal-Android/tree/master/repr...


Wow. That's awesome, I could have sworn they opposed to reproducible builds for some reason.



It's not, once linked the desktop client can be used independently of your phone.


> Can I use Signal from desktop only?

Yes, the desktop client functions independently from the phone client once linked (so not like whatsapp that proxies everything through your phone).

> Can I create an account from desktop?

Technically yes, but you either need to compile the desktop client yourself[0] and miss some features or use something like signal-cli[1] to act as the main client. So it's not supported (yet?).

> Is my account independent of any specific device?

The first client that registers acts as the main client, so no. But it might get easier to restore access on a different device without using backups with the secure value recovery[2] stuff they are working on.

> Can I use Signal on multiple computers at the same time with correct credentials?

It's possible to link and use several desktop clients at the same time.

[0] https://github.com/signalapp/Signal-Desktop/blob/development...

[1] https://github.com/AsamK/signal-cli

[2] https://signal.org/blog/secure-value-recovery/


Not necessarily. But storing them in plain text on the server and all history accessible just by hijacking a phone number (or a single text message) is, considering the alternatives, don't you agree?


How do you know that it is stored in plain text on the server?


Because there is no end to end encryption (other than some very limited temporary one on one chats that only work between two mobile devices) which means the server can (and does) read and store all your messages. Getting access to your full chat history is as simple as intercepting a single text, because the server has access to your plain text messages.

They might do some form of encryption to store the messages, but this is meaningless when they also have access to the keys and can decrypt any message whenever they want.


So in essence, like about any service that performs manipulations on your files? Like a storage service that creates thumbnails of your photos?


> not proxying through your phone which Signal used to do and maybe still does

This is what Whatsapp does. Signal never did and has real multi-device support.

> and the Signal server is closed source

It's not: https://github.com/signalapp/Signal-Server


> This is what Whatsapp does. Signal never did and has real multi-device support.

This is news to me. Curious then, why is it not possible to use Signal desktop without a phone?

https://support.signal.org/hc/en-us/articles/360008216551-In...

> Can I install Signal Desktop without a mobile device?

> Signal Desktop must link with either Signal Android or Signal iOS to be available for messaging.


You must link a client with a mobile device, but after that apparently you can use e.g. the Desktop client without your mobile phone turned on.


Although Signal is not closed-source, they tend to discontinue useful features of their product. For example RedPhone server code has been removed from GitHub after it was discontinued.

Last time I checked, it is not really feasible to setup a standalone Signal instance. Is there any guide to deploying a standalone version of Signal on your own servers or a successful example of it? If not, their approach may be more of "see but not touch" than being a free software. Also decisions like dependency on GCM and discontinuing features to increase development speed make Signal less reliable as a open source project.


I assume they removed it because they don't want anyone to use old insecure code. The RedPhone server hasn't been used for years now and was replaced with a better implementation.

You're right there's no official support on their server, but there are some unofficial guides on their community forums on how to set it up. Also, GCM is not a hard dependency. On Android it will fall back to using only websockets (and no GCM) when Google Play Services is not installed since some time. What other features have they removed without replacement?


I wish Signal did route through the phone and allowed to send regular texts from other devices.


But that's more of a feature request, or even a completely different product ("I would like to send SMS from my desktop"), than a design decision for a chat application's protocol.


Sure it's a feature request but a feature that would be much simpler if the messages were routed through the phone any way.


Your message history is always synchronised between devices, it doesn't sound like rocket science to make the client detect when a message is meant to be sent as SMS. No need to make the design choice of routing all traffic through the phone for that.


Corrected, thanks!

Curious though, why does WhatsApp not do it if they use the same protocol anyway? Why bother with the phone as an annoying proxy?


Only the encryption layer of the protocol is the same, they are not really compatible otherwise.

I assume it's a design trade-off when you have E2EE and don't store any messages on the server. With Signal (and I assume Wire) you have to register each device and each device needs to manage its keys. Every message is send multiple times, once for each device, and each device has an independent message queue on the server. That's why you only get the messages from after you registered the device.

Whatsapp doesn't have to do any of that and can just keep the keys on one device.


For those that don't want to enable Javascript, these are the hidden Linux instructions:

  $ curl -s https://updates.signal.org/desktop/apt/keys.asc | sudo apt-key add -
  $ echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | sudo tee -a /etc/apt/sources.list.d/signal-xenial.list
  $ sudo apt update && sudo apt install signal-desktop


How are we supposed to verify keys.asc?

(To be a bit more explicit: searching for either the pub (57F6FB06) or sub(0E46390F) keys on hkps.pool.sks-keyservers.net returns no result)


Just because it's on a keyserver doesn't mean it's trustworthy. Keyservers do no verification of any kind on the keys they host.

If you(r system) trust the certificate that https://updates.signal.org/ is using, you should be confident that you are getting the correct keys.

(You shouldn't trust a stranger on the internet, but I am getting the same keys when I download them.)


Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your phone to be turned on).


wow, sorry. my bad.

So I guess there is a way to use signal without having a phone nowadays! That's a great news!

I will try right now.


You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after.

Edit: It actually has the option to register without smartphone, but it's only enabled in the debug versions.


About your edit: precious information, thanks!


Speaking of edits, you should probably edit the misinformation out of your original post, while you have time. It's ranked pretty high up the thread and it's completely inaccurate.


You're right, I clarified it a little.


Oh I meant the original poster, who claims you need a turned-on and present phone for Signal desktop to work. The person you originally corrected.


The original poster was correct though. Just because you only need to do it once doesn't mean it isn't required. As a person without a smart phone I can't use it.

Nor would I since it still requires a phone number to use.


They could correct this line: " keeping your phone open"


Where can you get the debug version? I can't find it.


You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build with little modifications.

This might get you started: https://github.com/WhisperSystems/Signal-Desktop/blob/d1f7f5...


The debug version uses a different server. Will not work.


You can get a google voice number and just activate through that. On iOS you have to type a confirmation code in manually, so there is no need for a debug version there.


If only Google voice existed outside the US.


You could always use it without the phone.


> Also, video chat has been in beta since March 2017.

Video chat actually came out of beta in March [0]. The beta was released in February.

[0] https://whispersystems.org/blog/signal-video-calls/


Actually, Signal works without routing the messages trough your phone. Instead they use a browser extension to store the keys client side, which acts as a full client with its own, separate keypair.

You could even register only the browser, without having a smartphone at all.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: