Benvenuto nel Poliverso

sic_semper_tyrannis via Privacy

7 mesi fa • •

sic_semper_tyrannis
7 mesi fa • •

Signal on F-droid Guardian Repo

I just noticed today that Signal (not talking Molly) is now available on F-Droid via the "Guardian" repository.

Just wanted to give everyone a heads up.

Questa voce è stata modificata (7 mesi fa)

like this

in reply to sic_semper_tyrannis

iii

in reply to sic_semper_tyrannis • 7 mesi fa • •

Perhaps a result of the proposed ban on distributing tiktok via google and apple is that some developers rethink their distribution mechanisms

like this

in reply to sic_semper_tyrannis

flatbield

in reply to sic_semper_tyrannis • 7 mesi fa • •

Thanks. You can get it by Obtainium too.

in reply to sic_semper_tyrannis

zqwzzle

in reply to sic_semper_tyrannis • 7 mesi fa • •

It’s weird that this isn’t mentioned on the signal website or blog? They also distribute the binary with a signature you can check there if you want a non-play store source that’s actually verifiable.

Questa voce è stata modificata (7 mesi fa)

in reply to zqwzzle

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to zqwzzle • 7 mesi fa • •

It's probably not an official thing. F-Droid can't distribute apps in the official repo via their own policy if the developer doesn't agree. Third-party repos like Guardian can.

Questa voce è stata modificata (7 mesi fa)

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

zqwzzle

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

If it’s not official, how do you verify who is building the binary?

in reply to zqwzzle

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to zqwzzle • 7 mesi fa • •

I think they ship prebuilt binaries, i.e. the exact same ones you find on the Signal website

AFAIK this also applies to Tor Browser, Orbot and other third-party apps distributed by Guardian

Edit: I downloaded the files and manually verified the signatures. They are indeed the exact same files.

Because I didn't really know how to grab an APK from the Guardian F-Droid repo, I used their S3 bucket and downloaded the Signal APK. It's named Signal-Android-website-prod-universal-release-7.30.2.apk, which is the exact same file name as the one of the APK you can get from the Signal website.

I then used keytool to print the signature certificate fingerprint: (renamed the files to make it less confusing)

keytool -printcert -jarfile signal-website.apk

Signer #1:

Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
     SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
     SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3

keytool -printcert -jarfile signal-guardian.apk

Signer #1:

Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
     SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
     SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3

The fingerprints are identical.

Another edit: I just noticed that Signal even has official instructions for checking the signature on their APK download page. They use apksigner instead of keytool, but it's basically the same process.

Signal Android APK

Advanced users with special needs can download the Signal APK directly here.

^{Signal Messenger}

Questa voce è stata modificata (7 mesi fa)

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

sic_semper_tyrannis

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

Thanks for doing this!

in reply to sic_semper_tyrannis

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to sic_semper_tyrannis • 7 mesi fa • •

Takes like 2 minutes 😅

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

QuazarOmega

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

You have quite a bit of background knowledge to know how to do that though, you should give yourself more credit!

in reply to QuazarOmega

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to QuazarOmega • 7 mesi fa • •

Thanks, I mean I used to work as a Java developer before, and I'm quite interested in the Android platform, so I'm familiar with the SDK and build tools, and know how app signatures work

But it's really not that hard to figure out. There are countless guides on the internet, and as I said, Signal even has a quick guide for how to verify the APK signature on the download page

Questa voce è stata modificata (7 mesi fa)

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

lady_mongrel

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

Can confirm, the repository was Guardian Project

in reply to lady_mongrel

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to lady_mongrel • 7 mesi fa • •

I know, it even says so in the post:

I just noticed today that Signal (not talking Molly) is now available on F-Droid via the "Guardian" repository.

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

lady_mongrel

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

Haha it would help if I could read 🤣

in reply to sic_semper_tyrannis

KnightontheSun

in reply to sic_semper_tyrannis • 7 mesi fa • •

Please forgive if this is a stupid question, but what is the difference between the play store version and this? Assuming it is not altered by a bad actor.

Questa voce è stata modificata (7 mesi fa)

in reply to KnightontheSun

Wolfie

in reply to KnightontheSun • 7 mesi fa • •

As i recall, ALL apps in google play store, have to have some sort of google shit embedded into it. Therefore, its better to download something outside of google if you want to remain degoogled.

in reply to KnightontheSun

refalo

in reply to KnightontheSun • 7 mesi fa • •

I would hope the difference is that the f-droid version does not contain any proprietary code.

in reply to refalo

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to refalo • 7 mesi fa • •

No, it's not a special "FOSS" version, it's just the official binary distributed through the Guardian Project repo (as I have proven: lemmy.dbzer0.com/comment/16230…). If you want a FOSS variant, check out Signal-FOSS or Molly, they also offer a FOSS variant. You can either download it from their custom F-Droid repo, pull the APK from GitHub using Obtainium or get it from Accrescent.

Molly

Molly is an independent Signal fork for Android.

^{Molly Instant Messenger}

Andromxda 🇺🇦🇵🇸🇹🇼

2025-01-25 18:25:02

I think they ship prebuilt binaries, i.e. the exact same ones you find on the Signal website
AFAIK this also applies to Tor Browser, Orbot and other third-party apps distributed by Guardian
Edit: I downloaded the files and manually verified the signatures. They are indeed the exact same files.
Because I didn't really know how to grab an APK from the Guardian F-Droid repo, I used their S3 bucket and downloaded the Signal APK. It's named Signal-Android-website-prod-universal-release-7.30.2.apk, which is the exact same file name as the one of the APK you can get from the Signal website.
I then used keytool to print the signature certificate fingerprint: (renamed the files to make it less confusing)
keytool -printcert -jarfile signal-website.apk
Signer #1:

Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
     SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
     SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3
keytool -printcert -jarfile signal-guardian.apk
Signer #1:

Certificate #1:
Owner: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Issuer: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Serial number: 4bfbebba
Valid from: Tue May 25 17:24:42 CEST 2010 until: Tue May 16 17:24:42 CEST 2045
Certificate fingerprints:
     SHA1: 45:98:9D:C9:AD:87:28:C2:AA:9A:82:FA:55:50:3E:34:A8:87:93:74
     SHA256: 29:F3:4E:5F:27:F2:11:B4:24:BC:5B:F9:D6:71:62:C0:EA:FB:A2:DA:35:AF:35:C1:64:16:FC:44:62:76:BA:26
Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3
The fingerprints are identical.
Another edit: I just noticed that Signal even has official instructions for checking the signature on their APK download page. They use apksigner instead of keytool, but it's basically the same process.

Signal Android APK
Advanced users with special needs can download the Signal APK directly here.
^{Signal Messenger}

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

refalo

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

Yikes. Thanks for the info.

in reply to KnightontheSun

povario

in reply to KnightontheSun • 7 mesi fa • •

I think the main difference is that the Play Store version can use FCM (Google Play Services) for notifications, while the APK Signal distributes only receives notifications over a background WebSocket connection.

in reply to povario

KnightontheSun

in reply to povario • 7 mesi fa • •

That is interesting. Thanks to you and the others.

Does the use of the google play services allow google to sort of…listen in or be privy to your app usage in any way?

in reply to KnightontheSun

povario

in reply to KnightontheSun • 7 mesi fa • •

Google cannot see any message content of Signal notifications through FCM. It's more like a "heads up" to the Signal app, telling it "hey, there are new messsges. wake up and check what they are.". The Signal app then checks for messages and does all the decrypting and whatnot itself.

While it's possible that the timing of FCM telling the app to check for notifications could be used to correlate activity, that's an edge case that if you are concerned about can be easily avoided by just using the background WebSocket or a fork of Signal like Molly that allows you to use a third-party UnifiedPush provider to check for messages in the background, instead of FCM.

Molly

Molly is an independent Signal fork for Android.

^{Molly Instant Messenger}

in reply to povario

KnightontheSun

in reply to povario • 7 mesi fa • •

Yes, the activity was what I thought of. Thank you for helping to educate me!

in reply to sic_semper_tyrannis

JubilantJaguar

in reply to sic_semper_tyrannis • 7 mesi fa • •

I have a tangential question. Would it not make sense for an OS, in this case Android, to have some proper mechanism for installing apps (in this case APKs) directly from a website (as lots of people have been doing fastidiously from signal.org by necessity)?

After all, this is all about trust. With software, assuming that you trust the developer, the goal is to be sure that nobody interfered with the developer's compiled software - and who better to guarantee that than the developer themself, at their own domain? DNS resolution is already based on the "web of trust" principle, which is why you can trust your bank's website. Arguably F-Droid performs a valuable role as a curator and selector of good software, but is there any good technical need for it to actually distribute the software?

Questa voce è stata modificata (7 mesi fa)

in reply to JubilantJaguar

said

in reply to JubilantJaguar • 7 mesi fa • •

Not exactly answering your question but you can use the app Obtainium to fetch the apk URL from a website/github repo and many other sources to install directly. It also supports fdroid repos and many other sources out of the box. Kinda half way what you mentioned in your first paragraph.

GitHub - ImranR98/Obtainium: Get Android app updates straight from the source.

Get Android app updates straight from the source. Contribute to ImranR98/Obtainium development by creating an account on GitHub.

^GitHub

in reply to said

JubilantJaguar

in reply to said • 7 mesi fa • •

Yes true! Forgot about Obtainium. ~~Personally I'm not much tempted because all it does is swap out F-Droid for Github (i.e. Microsoft) as the middleman.~~ But I agree that it's definitely a win for convenience.

PS: Turns out Obtainium is source-agnostic. Good news.

Questa voce è stata modificata (7 mesi fa)

in reply to JubilantJaguar

said

in reply to JubilantJaguar • 7 mesi fa • •

Of course Github is just an example but you can pretty much regex any URL and further filter out anything in order to get the apk link with it. So depending on your level of privacy requirement and trusted sources, you can skip all the centralized ones and build your own list of sources.

in reply to said

JubilantJaguar

in reply to said • 7 mesi fa • •

So it does! OK so this is pretty close to a decent solution after all (the ideal one being IMO exactly the same thing but native to the OS). Thanks for the correction.

in reply to said

logging_strict

in reply to said • 7 mesi fa • •

Thank you for posting the link

in reply to JubilantJaguar

refalo

in reply to JubilantJaguar • 7 mesi fa • •

Not sure if this fits your definition of OS, proper, or install, but FWIW you can already download an apk directly from github using most Android browsers and it will open (or give you the option to open) it with the system's package installer.

in reply to refalo

JubilantJaguar

in reply to refalo • 7 mesi fa • •

Yep and that's exactly what we doing with Signal to avoid the Play Store. It's a bit of a PITA and it's the same on desktop. It's because they don't want third parties maintaining their packages.

My crazy utopian idea is for some kind of protocol (or equivalent) that would allow native package managers (mobile or desktop) to "plug in" to the website repos of authors, directly.

in reply to JubilantJaguar

refalo

in reply to JubilantJaguar • 7 mesi fa • •

Isn't this basically the same thing as clicking a .apk or .exe link in a browser (which already works on mobile/desktop)?

in reply to refalo

JubilantJaguar

in reply to refalo • 7 mesi fa • •

Other than (a) having to use a browser and (b) no update mechanism, yes.

Unknown parent

sic_semper_tyrannis

Unknown parent • 7 mesi fa • •

No, nothing wrong with it. I use it actually. People are used to Molly being on F-Droid so I didn't want anyone to think that I was referencing that instead of actual Signal.

Unknown parent

scoobford

Unknown parent • 7 mesi fa • •

Iirc Molly in F-droid still using FCM and the google maps API. If you want Molly-Foss, you have to use Obtanium to pull APKs from their git releases.

Edit: I was wrong, you can get it off their F-Droid repository.

Questa voce è stata modificata (7 mesi fa)

in reply to scoobford

Kairos

in reply to scoobford • 7 mesi fa • •

No. You can use their f-droid repo to get molly-foss

in reply to sic_semper_tyrannis

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to sic_semper_tyrannis • 7 mesi fa • •

Please rename the thread to "Signal in the Guardian project F-Droid repo" or something like that to avoid confusion, because as you have noticed, it's not available in the main F-Droid repo, just in the third-party repo maintained by the Guardian project

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

sic_semper_tyrannis

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

Done

in reply to sic_semper_tyrannis

beautiful_orca

in reply to sic_semper_tyrannis • 7 mesi fa • •

Molly-FOSS is awesome and it now has UnifiedPush support built-in!

Get it with Obtainium

GitHub - mollyim/mollyim-android: Enhanced and security-focused fork of Signal.

Enhanced and security-focused fork of Signal. Contribute to mollyim/mollyim-android development by creating an account on GitHub.

^GitHub

in reply to beautiful_orca

sic_semper_tyrannis

in reply to beautiful_orca • 7 mesi fa • •

Woah that's awesome to hear about the FOSS variant. I'll switch over to that version now

in reply to sic_semper_tyrannis

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to sic_semper_tyrannis • 7 mesi fa • •

Just make sure to set up UnifiedPush if you want to receive notifications while your Molly database is locked. I recommend the new Sunup UP distributor. I wanted to make a post about it in !unifiedpush@lemmy.dbzer0.com, but never got around to do it.

For Mollysocket, there are a few public instances. molly.adminforge.de is one of them. You can also set up your own on Fly.io, check out this repo: github.com/pcrockett/mollysock…
Or you can obviously self-host it on any VPS or hardware that you own

android

^Codeberg.org

in reply to Andromxda 🇺🇦🇵🇸🇹🇼

beautiful_orca

in reply to Andromxda 🇺🇦🇵🇸🇹🇼 • 7 mesi fa • •

I have my own mollysocket and ntfy, both on tailscale domains with funnel. You can restrict your mollysocket to only your ID.

What makes Sunup different from ntfy? Is it better?

Questa voce è stata modificata (7 mesi fa)

in reply to beautiful_orca

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to beautiful_orca • 7 mesi fa • •

The Ntfy Android app hasn't been updated in almost a year, and in my experience it consumes more battery than Sunup.

in reply to beautiful_orca

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to beautiful_orca • 7 mesi fa • •

Or via Accrescent

Accrescent

Accrescent is an Android app store focused on security, privacy, and usability.

^Accrescent

Unknown parent

transitinoir

Unknown parent • 7 mesi fa • •

They do not ship updates as fast as official Signal client does. Do not use it unless you specifically need one of its security features

in reply to scoobford

Andromxda 🇺🇦🇵🇸🇹🇼

in reply to scoobford • 7 mesi fa • •

You can also get it from Accrescent

Accrescent

Accrescent is an Android app store focused on security, privacy, and usability.

^Accrescent

in reply to sic_semper_tyrannis

fmstrat

in reply to sic_semper_tyrannis • 7 mesi fa • •

You can also install directly from Signal via Obtainium. apps.obtainium.imranr.dev/

{"id":"org.thoughtcrime.securesms","url":"https://updates.signal.org/android/latest.json","author":"Signal","name":"Signal","preferredApkIndex":0,"additionalSettings":"{\"intermediateLink\":[],\"customLinkFilterRegex\":\"\",\"filterByLinkText\":false,\"skipSort\":false,\"reverseSort\":false,\"sortByLastLinkSegment\":false,\"versionExtractWholePage\":false,\"requestHeader\":[{\"requestHeader\":\"User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36\"}],\"defaultPseudoVersioningMethod\":\"partialAPKHash\",\"trackOnly\":false,\"versionExtractionRegEx\":\"\\\\d+.\\\\d+.\\\\d+\",\"matchGroupToUse\":\"\",\"versionDetection\":true,\"useVersionCodeAsOSVersion\":false,\"apkFilterRegEx\":\"\",\"invertAPKFilter\":false,\"autoApkFilterByArch\":true,\"appName\":\"\",\"shizukuPretendToBeGooglePlay\":false,\"allowInsecure\":false,\"exemptFromBackgroundUpdates\":false,\"skipUpdateNotifications\":false,\"about\":\"Signal is an open-source end to end encrypted messaging app.\"}","overrideSource":null}

Obtainium Apps

Crowdsourced App Configurations for Obtainium.

^{apps.obtainium.imranr.dev}

⇧

sic_semper_tyrannis

sic_semper_tyrannis via Privacy

sic_semper_tyrannis 7 mesi fa • •

sic_semper_tyrannis
7 mesi fa • •