No. The clients are open source, and (at least on Android) you are able to verify that the source on Github is the same that was used to compile the client on Google Play with reproducible builds [1].
And even if the servers turn out to be malicious, the clients are designed to expose as little metadata as possible with things like private contact discovery[2], sealed sender[3] and private groups[4]. It's not perfect, but the data a malicious server could collect is limited.
That's true, and in that sense it doesn't really matter if they publish the server source or not (although they really should continue to do so). What does matter is that the client was designed with a possible malicious server in mind so you don't have to trust the code the server is running.
But you can verify that the source they publish on Github is the same that was used to built the Google Play version with reproducible builds[1]. Also, Android apps are fairly easy to decompile. They are very likely to get caught if they publish an update with a backdoor.
Yes, the desktop client functions independently from the phone client once linked (so not like whatsapp that proxies everything through your phone).
> Can I create an account from desktop?
Technically yes, but you either need to compile the desktop client yourself[0] and miss some features or use something like signal-cli[1] to act as the main client. So it's not supported (yet?).
> Is my account independent of any specific device?
The first client that registers acts as the main client, so no. But it might get easier to restore access on a different device without using backups with the secure value recovery[2] stuff they are working on.
> Can I use Signal on multiple computers at the same time with correct credentials?
It's possible to link and use several desktop clients at the same time.
Not necessarily. But storing them in plain text on the server and all history accessible just by hijacking a phone number (or a single text message) is, considering the alternatives, don't you agree?
Because there is no end to end encryption (other than some very limited temporary one on one chats that only work between two mobile devices) which means the server can (and does) read and store all your messages. Getting access to your full chat history is as simple as intercepting a single text, because the server has access to your plain text messages.
They might do some form of encryption to store the messages, but this is meaningless when they also have access to the keys and can decrypt any message whenever they want.
Although Signal is not closed-source, they tend to discontinue useful features of their product. For example RedPhone server code has been removed from GitHub after it was discontinued.
Last time I checked, it is not really feasible to setup a standalone Signal instance. Is there any guide to deploying a standalone version of Signal on your own servers or a successful example of it? If not, their approach may be more of "see but not touch" than being a free software. Also decisions like dependency on GCM and discontinuing features to increase development speed make Signal less reliable as a open source project.
I assume they removed it because they don't want anyone to use old insecure code. The RedPhone server hasn't been used for years now and was replaced with a better implementation.
You're right there's no official support on their server, but there are some unofficial guides on their community forums on how to set it up. Also, GCM is not a hard dependency. On Android it will fall back to using only websockets (and no GCM) when Google Play Services is not installed since some time. What other features have they removed without replacement?
But that's more of a feature request, or even a completely different product ("I would like to send SMS from my desktop"), than a design decision for a chat application's protocol.
Your message history is always synchronised between devices, it doesn't sound like rocket science to make the client detect when a message is meant to be sent as SMS. No need to make the design choice of routing all traffic through the phone for that.
Only the encryption layer of the protocol is the same, they are not really compatible otherwise.
I assume it's a design trade-off when you have E2EE and don't store any messages on the server. With Signal (and I assume Wire) you have to register each device and each device needs to manage its keys. Every message is send multiple times, once for each device, and each device has an independent message queue on the server. That's why you only get the messages from after you registered the device.
Whatsapp doesn't have to do any of that and can just keep the keys on one device.
Signal Desktop works without having your phone turned on. It acts like a full, independent client after linking it to your smartphone app (unlike WhatsApp, which does require your phone to be turned on).
You still need a phone with a registered Signal on iOS or Android initially to activate the desktop version (sorry if that wasn't clear), but you can turn your phone off after.
Edit: It actually has the option to register without smartphone, but it's only enabled in the debug versions.
Speaking of edits, you should probably edit the misinformation out of your original post, while you have time. It's ranked pretty high up the thread and it's completely inaccurate.
The original poster was correct though. Just because you only need to do it once doesn't mean it isn't required. As a person without a smart phone I can't use it.
Nor would I since it still requires a phone number to use.
You can build it yourself from source. While it's true that the debug version uses different servers, the functionality is there and can probably be enabled in a production build with little modifications.
You can get a google voice number and just activate through that. On iOS you have to type a confirmation code in manually, so there is no need for a debug version there.
Actually, Signal works without routing the messages trough your phone. Instead they use a browser extension to store the keys client side, which acts as a full client with its own, separate keypair.
You could even register only the browser, without having a smartphone at all.
And even if the servers turn out to be malicious, the clients are designed to expose as little metadata as possible with things like private contact discovery[2], sealed sender[3] and private groups[4]. It's not perfect, but the data a malicious server could collect is limited.
[1] https://github.com/signalapp/Signal-Android/tree/master/repr...
[2] https://signal.org/blog/private-contact-discovery/
[3] https://signal.org/blog/sealed-sender/
[4] https://signal.org/blog/signal-private-group-system/