Users of the Signal messaging app got hit by a hacker attack. We analyze what happened and why the attack demonstrates that Signal is reliable.

  • Jones@lemmy.ml
    link
    fedilink
    arrow-up
    4
    arrow-down
    3
    ·
    2 years ago

    What’s that closed-source server side? What does it do? Source?

      • Jones@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        2 years ago

        The whole point of end-to-end encryption is that you don’t have to trust their server: it cannot read your messages. Then for metadata, the question is about what metadata they are receiving at all (if they don’t receive it, then you don’t care if the server is proprietary) and what they do with it (e.g. for the private contact discovery, the idea is that you can verify that the code receiving your contact list is doing what it should (it’s open source), and you can verify that this code is the one running in the secure enclave.

        You don’t need the whole server to be open source: only the important parts.

        • Sandra@idiomdrottning.org
          link
          fedilink
          arrow-up
          3
          ·
          2 years ago

          For the purposes of security and encryption, you’re right, and that’s not why it looked bad.

          For someone coming from open protocols like email, XMPP, atom, and Fedi, it was not a good first impression to see their system grown ever more owned-by-them.