328
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Nov 2026
328 points (98.5% liked)
Today I Learned
32321 readers
905 users here now
What did you learn today? Share it with us!
We learn something new every day. This is a community dedicated to informing each other and helping to spread knowledge.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must begin with TIL. Linking to a source of info is optional, but highly recommended as it helps to spark discussion.
** Posts must be about an actual fact that you have learned, but it doesn't matter if you learned it today. See Rule 6 for all exceptions.**
Rule 2- Your post subject cannot be illegal or NSFW material.
Your post subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding non-TIL posts.
Provided it is about the community itself, you may post non-TIL posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you vocally harass or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
For further explanation, clarification and feedback about this rule, you may follow this link.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.
Partnered Communities
You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.
Community Moderation
For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.
founded 3 years ago
MODERATORS
Wow, so Signal is secure, huh?
Doubtful. Google owns the signing keys specifically so they can recompile for individual downloads.
Edit : here is google info page on it https://support.google.com/googleplay/android-developer/answer/9842756?hl=en
Google generates the apk after compiling it, and signs it with a key they previously generated. They've publically stated they want your code to recompile as they wish.
All the replies to this are dense. If google can recompile your code, they are the ultimate man-in-the-middle.
Here, google keeps signing keys to customize the apk, this means they can insert code in the app, regardless of whether it is source or compiled. This means they can copy the signal encryption keys and send them anywhere. https://developer.android.com/guide/app-bundle/
They aren't encrypting the messages with the signing keys.
Do you even know how a signing key work?
What do you mean by this? Isn't Google's signing key only used to verify an update for an app is actually the for correct app? Even if Google could decompile the app, they wouldn't have access to Signal's servers or any encryption keys so they couldn't read any messages.
Google requires source code to publish in the play store. Google owns a copy of the signing key. Google can rewrite your software in your name. It has been this way for years.
I don't know what an app bundle consists of, which the page you linked says google needs, but it can't include the source code because google has recently been paying some developers for access to their source code - https://www.techrepublic.com/article/news-google-android-code-offer/
In any case, having access to the source code will not grant access to encryption keys or allow anyone to decrypt messages. After all Signal is already open source so anyone can use the Signal protocol for encrypting messages, which is exactly what WhatsApp does.
Paying for access means licensing. And your second argument is downright incorrect.
https://developer.android.com/guide/app-bundle/ I just had to check, it doesn't require source, but just some compiler resource files, but that also doesn't matter. Google keeps the signing keys and can read all input and also signals private keys, and the user wouldn't know.
It says specifically, google generates the apk. That means they can shim the whole app, regardless of source code. People subject to government surveillance shouldn't consider any app store application safe.