this post was submitted on 09 Jan 2026
481 points (99.2% liked)

Europe

8599 readers
1174 users here now

News and information from Europe 🇪🇺

(Current banner: La Mancha, Spain. Feel free to post submissions for banner images.)

Rules (2024-08-30)

  1. This is an English-language community. Comments should be in English. Posts can link to non-English news sources when providing a full-text translation in the post description. Automated translations are fine, as long as they don't overly distort the content.
  2. No links to misinformation or commercial advertising. When you post outdated/historic articles, add the year of publication to the post title. Infographics must include a source and a year of creation; if possible, also provide a link to the source.
  3. Be kind to each other, and argue in good faith. Don't post direct insults nor disrespectful and condescending comments. Don't troll nor incite hatred. Don't look for novel argumentation strategies at Wikipedia's List of fallacies.
  4. No bigotry, sexism, racism, antisemitism, islamophobia, dehumanization of minorities, or glorification of National Socialism. We follow German law; don't question the statehood of Israel.
  5. Be the signal, not the noise: Strive to post insightful comments. Add "/s" when you're being sarcastic (and don't use it to break rule no. 3).
  6. If you link to paywalled information, please provide also a link to a freely available archived version. Alternatively, try to find a different source.
  7. Light-hearted content, memes, and posts about your European everyday belong in other communities.
  8. Don't evade bans. If we notice ban evasion, that will result in a permanent ban for all the accounts we can associate with you.
  9. No posts linking to speculative reporting about ongoing events with unclear backgrounds. Please wait at least 12 hours. (E.g., do not post breathless reporting on an ongoing terror attack.)
  10. Always provide context with posts: Don't post uncontextualized images or videos, and don't start discussions without giving some context first.

(This list may get expanded as necessary.)

Posts that link to the following sources will be removed

Unless they're the only sources, please also avoid The Sun, Daily Mail, any "thinktank" type organization, and non-Lemmy social media (incl. Substack). Don't link to Twitter directly, instead use xcancel.com. For Reddit, use old:reddit:com

(Lists may get expanded as necessary.)

Ban lengths, etc.

We will use some leeway to decide whether to remove a comment.

If need be, there are also bans: 3 days for lighter offenses, 7 or 14 days for bigger offenses, and permanent bans for people who don't show any willingness to participate productively. If we think the ban reason is obvious, we may not specifically write to you.

If you want to protest a removal or ban, feel free to write privately to the primary mod account @EuroMod@feddit.org

founded 2 years ago
MODERATORS
 

Granted, the part

The globally recommended app by privacy and security experts, Signal, is now being downloaded massively and tops the Danish Google Play Store

is a little ironic, but you gotta push this winning tide and then work from that.

you are viewing a single comment's thread
view the rest of the comments
[–] plyth@feddit.org 0 points 1 week ago (5 children)

The server running Signal’s server-side code.

What could a client detect? Signal is a US company and will comply with the government. The server can't be trusted.

Some do, and that’s the point: if there’s an attempt at tampering, interested security researchers can detect it.

They can detect if a different app was installed from the store on their phone. That's not useful for anybody to know if their own app is unaltered. Only people of interest will receive a manipulated client. So there is no security in knowing that some people received the original app.

Besides, Google runs the OS. They can change the app at runtime.

[–] Vincent@feddit.nl 2 points 1 week ago (4 children)

What could a client detect? Signal is a US company and will comply with the government. The server can’t be trusted.

As mentioned before, it could detect that the server is not running the published source code. So long as it's untampered with, and the published source code is trusted, the server can be trusted. And again, for message encryption that is only an additional layer of protection; the messages are encrypted before reaching the server, so even if the server was malicious, it still couldn't see the contents. That's the whole point.

They can detect if a different app was installed from the store on their phone

I think you're conflating points here - the detection was about detecting whether the server had been tampered with.

I'm not sure what specifically you're arguing for, here. It would've been nice for Signal to not have been in the US, and it can be coerced to stop working altogether, but your communication is at least as safe as any other app, at least the ones of comparable usability. Or are you're just saying we're all lost anyway and we might just as well give up and communicate via public Twitter posts?

[–] plyth@feddit.org 1 points 6 days ago (3 children)

it could detect that the server is not running the published source code.

How? The clients can only notice if the API works as specified. The server can constantly be replaced without anybody noticing.

is at least as safe as any other app, at least the ones of comparable usability. Or are you’re just saying we’re all lost anyway

So you know the problems of the servers.

[–] Vincent@feddit.nl 2 points 6 days ago (1 children)

How? The clients can only notice if the API works as specified. The server can constantly be replaced without anybody noticing.

See the link I posted before about the secure enclave. (Note that I could've been clearer before: it's not specifically the Signal client app that needs to detect server tampering; any software could.)

So you know the problems of the servers.

So what are you saying? Don't use anything that has a server? (To be fair, I think it's a good idea to have pure peer-to-peer apps installed as well, but for most situations that would still just come down to "do not communicate digitally at all".)

[–] plyth@feddit.org 1 points 6 days ago (1 children)

See the link I posted before

Ok, that's good.

So what are you saying?

That there is risk to rely on the server. It's unavoidable but should not be neglected.

[–] Vincent@feddit.nl 2 points 5 days ago

Ah OK. If all you're saying is "be aware of the risk while you use it", then I can get behind that.

load more comments (1 replies)
load more comments (1 replies)
load more comments (1 replies)