On: Why you should delete WhatsApp and install Signal

[tcfhgj]

The point of e2ee is already lost anyways.

What does E2EE potentially give you? A promise, which does not involve trusting the service provider, that messages can only read by the recipient.

What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook

[maqp → tcfhgj]

"What does making the app closed source take from you? The freedom of requiring trusting the service provider = facebook"

It does change the requirement of collection.

It's no longer "Well all this data is rolling in, what shall we do with it".

It's "Hey, if we commit THREE BILLION FELONIES of backdooring our every users' encryption, we can access all that data".

Surely you realize that's a leap.

[Kwpolska → tcfhgj]

How do you prove that the Signal app you download from the Play Store is compiled from the source code on GitHub?

[selfhoster11 → Kwpolska]

If I care about binary integrity, I wouldn't involve an app store. https://signal.org/android/apk/ is a perfectly cromulent way to get your hands on the APK file directly from the source.

[JetSpiegel → selfhoster11]

How do you keep that updated? What if there is a security issue?

[maqp → Kwpolska]

pull the apk from your phone with apktool. Compile Signal reproducibly with their instructions. Use the diff.py tool they provide and check for the message that confirms the APKs match.

[31337Logic → Kwpolska]

Compile it yourself and compare the hash.

[tcfhgj → Kwpolska]

idk, diff the binaries?