Oh I have looked at the source code myself. It seems legit at protecting the content of messages and I have no reason to believe that has changed since I reviewed it. But I didn't check the source vs the APK.
When I reviewed it the app also uploaded a hash of every phone number in your address book to their server and they'd look to see if they had a public key for that phone number.
Experimental testing after they rolled out username support indicates they aren't doing this anymore (or at least, I haven't been able to trigger it) because I do NOT see the phone number of the person I'm chatting with, even though they are in my address book. This also goes against how Signal claimed the username feature would work. They said the phone number would only appear if it was already in your pgone book. That is a lie.
I'm glad that's a lie, but I'm a bit nervous because it could be something else that is causing my app to not behave as expected. I also saw that the code to rip through all contacts is still in there, so I worry that I might just not have figured out how to trigger it.
I'm not particularly motivated to keep spending my free time on that though. I've moved on to decentralized e2ee apps for everyone except the "I am ONLY on Signal" people, and there's no way Signal is getting permission to my contacts on my main phone. So I don't super care if it's lax on privacy.
I'd rather use my time building the hardware password manager that I maintain, running servers and helping other people do the same, and helping people kick Facebook, Twitter, Google and all the rest of the megacorps to the curb.
Dr. Hax
npub16v…meqha
2024-08-13 04:15:57
in reply to nevent1q…ggp4
Author Public Key
npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqhaPublished at
2024-08-13 04:15:57Event JSON
{
"id": "49522c07443cdaf93b85070ce395b18d6ff7c06f7c287c74589999fd22152441",
"pubkey": "d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511",
"created_at": 1723522557,
"kind": 1,
"tags": [
[
"e",
"24792e7e6a0eed18e58c77a7ba901f669ea719168a1e8f89136df66bf27cedad",
"",
"root"
],
[
"e",
"a65528ee398e4ce5ce31ca4de6d0266eb75c6b1713454d53733c23baa111df5a"
],
[
"e",
"768d17c24d2ec576482935844cb307e402f1d8b3ed0e9ded405269bd08340744",
"",
"reply"
],
[
"p",
"d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511"
],
[
"p",
"d49a9023a21dba1b3c8306ca369bf3243d8b44b8f0b6d1196607f7b0990fa8df"
]
],
"content": "Oh I have looked at the source code myself. It seems legit at protecting the content of messages and I have no reason to believe that has changed since I reviewed it. But I didn't check the source vs the APK.\n\nWhen I reviewed it the app also uploaded a hash of every phone number in your address book to their server and they'd look to see if they had a public key for that phone number.\n\nExperimental testing after they rolled out username support indicates they aren't doing this anymore (or at least, I haven't been able to trigger it) because I do NOT see the phone number of the person I'm chatting with, even though they are in my address book. This also goes against how Signal claimed the username feature would work. They said the phone number would only appear if it was already in your pgone book. That is a lie.\n\nI'm glad that's a lie, but I'm a bit nervous because it could be something else that is causing my app to not behave as expected. I also saw that the code to rip through all contacts is still in there, so I worry that I might just not have figured out how to trigger it.\n\nI'm not particularly motivated to keep spending my free time on that though. I've moved on to decentralized e2ee apps for everyone except the \"I am ONLY on Signal\" people, and there's no way Signal is getting permission to my contacts on my main phone. So I don't super care if it's lax on privacy.\n\nI'd rather use my time building the hardware password manager that I maintain, running servers and helping other people do the same, and helping people kick Facebook, Twitter, Google and all the rest of the megacorps to the curb.",
"sig": "a4b1b6975a9f431781265d613b1e2cbe1c40ae1a61cb80ef8c50fe189be5662258b16f2df787505d41cce76016df97047036796b982942e4e5cf45ffebc22cfb"
}