6 ms·
Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified v
by profmonocle 1y ago
Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary.
Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.
- inahga 1y agoSignal on Android is reproducible https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod..., so _theoretically_ the play store version could be monitored to detect tampering by Google (or whoever). That is, if the reproducible build didn't constantly break https://github.com/signalapp/Signal-Android/issues/13565 https://github.com/signalapp/Signal-Android/issues/13565. It also ignores the fact that the vendor could send updates targeted to specific devices.
- deleted 1y ago[deleted]