8 ms·

Signal is openly against third party clients, they basically killed LibreSignal: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 ht

Signal is openly against third party clients, they basically killed LibreSignal: https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... Also how easy is it to run a custom Signal server?

ambicapter 2y ago
If they believe that uncontrolled 3rd-party clients would make it easier to breach their protocol (because they know their protocol's weaknesses), it would make sense to be openly hostile to 3rd-party clients.
- zeendo 2y ago
  The strength and security of any good protocol, especially Signal's, does not come from obscurity. See https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
- littlestymaar 2y ago
  If there's no third party client then the e2e is completely moot because Signal could be forced to push a backdoor to their customers and they would never know e2e has been removed.
  - ambicapter 2y ago
    Fair point, I guess it goes both ways.
- SahAssar 2y ago
  How would a third party client make it easier to breach the protocol? You can still study the source of the client, the protocol, make a fork of it and modify it, etc. The official client is fully open source. The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.
deleted 2y ago
[deleted]
teekert 2y ago
The "ease" with which one can run their own Matrix server is currently what causes the most problems that I see in the wild. I love matrix, I use it a lot, it has its place. But Signal just works.
zie 2y ago
It's not super easy. Both sides of the issue have fair points. Clearly it's not going to happen within upstream signal any time soon(if ever). So it would have to be a fork, and so far nobody seems particularly motivated enough.
zeendo 2y ago
Interesting how the issue there was both usage of their servers and the name. Molly (https://github.com/mollyim https://github.com/mollyim) uses their servers but not their name and seems to be operating just fine. I've been using it for almost a year now. I found it primarily because I wanted to run Signal on a tablet.
cassepipe 2y ago
If you're going to say what is said under every submission about Signal you should I least mention that it is a choice they made and that they gave reasons why [1], whether you disagree with their arguments. I am personnally glad that both options exist. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
- kuschku 2y ago
  You can only trust E2EE if whoever controls the server does not also control the client. Otherwise they can just backdoor the client. I wonder what'd happen if a three letter agency subpoena'd Signal and demanded Signal's app signing key so they can ship a backdoored update to a handful of targets.

ambicapter 2y ago

If they believe that uncontrolled 3rd-party clients would make it easier to breach their protocol (because they know their protocol's weaknesses), it would make sense to be openly hostile to 3rd-party clients.

zeendo 2y ago
The strength and security of any good protocol, especially Signal's, does not come from obscurity. See https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
littlestymaar 2y ago
If there's no third party client then the e2e is completely moot because Signal could be forced to push a backdoor to their customers and they would never know e2e has been removed.
- ambicapter 2y ago
  Fair point, I guess it goes both ways.
SahAssar 2y ago
How would a third party client make it easier to breach the protocol? You can still study the source of the client, the protocol, make a fork of it and modify it, etc. The official client is fully open source. The argument for security for disallowing other clients would be being able to modify the protocol to patch out security issues without worrying about compatibility with other clients.

deleted 2y ago

[deleted]

teekert 2y ago

The "ease" with which one can run their own Matrix server is currently what causes the most problems that I see in the wild. I love matrix, I use it a lot, it has its place. But Signal just works.

zie 2y ago

It's not super easy. Both sides of the issue have fair points. Clearly it's not going to happen within upstream signal any time soon(if ever). So it would have to be a fork, and so far nobody seems particularly motivated enough.

zeendo 2y ago

Interesting how the issue there was both usage of their servers and the name. Molly (https://github.com/mollyim https://github.com/mollyim) uses their servers but not their name and seems to be operating just fine. I've been using it for almost a year now. I found it primarily because I wanted to run Signal on a tablet.

cassepipe 2y ago

If you're going to say what is said under every submission about Signal you should I least mention that it is a choice they made and that they gave reasons why [1], whether you disagree with their arguments. I am personnally glad that both options exist. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/

kuschku 2y ago
You can only trust E2EE if whoever controls the server does not also control the client. Otherwise they can just backdoor the client. I wonder what'd happen if a three letter agency subpoena'd Signal and demanded Signal's app signing key so they can ship a backdoored update to a handful of targets.