Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Friday November 03 2017, @12:07AM   Printer-friendly
from the Shhhhhhhhhhh! dept.

http://www.tomshardware.com/news/signal-messenger-standalone-desktop-app,35810.html

Open Whisper Systems (OWS), the non-profit that develops the Signal messenger and its end-to-end encryption protocol, released a new standalone desktop application that will replace the existing Signal Chrome App. The move comes as Google is preparing to end support for Chrome Apps in its browser.

[...] Because Google is deprecating its Chrome Apps, Signal's developers had to find another way to offer their users a desktop application without having to rewrite one from scratch. The group used Electron, an open source framework for creating native applications using HTML, CSS, and JavaScript. This way, OWS was able to convert its existing Chrome App code into a standalone Electron application without too many changes.

Although we don't get a truly native Signal application, there are still some advantages to be gained from this transition. For one, you don't need to install Chrome anymore, just to be able to use the desktop Signal application. Firefox and Safari users can run the new Signal app separately, just like any other desktop app.

The second advantage is that you no longer need to keep your smartphone around to be able to chat via the desktop app, as you have to do with the desktop version of WhatsApp, for instance. After the initial set-up and linking of your smartphone to the desktop app, the new desktop app can be used independently of a smartphone.

Related: Redphone and TextSecure are now Signal
Egypt has Blocked Encrypted Messaging App Signal
Encrypted Messaging App Signal Uses Google to Bypass Censorship


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1, Informative) by Anonymous Coward on Friday November 03 2017, @02:36PM

    by Anonymous Coward on Friday November 03 2017, @02:36PM (#591680)

    Which one must assume at this point in time the OS is not.

    Android you should assume google can gain access to any crypto keys on your system. Windows 10 (or earlier versions with the telemetry backported) you can assume Microsoft can gain access to any crypto keys on your system.

    Any computer running AMD PSP/Intel ME, you should assume AMD/Intel or government entities with spies embedded in them can access your keys.

    Any combination of these result in the keys being compromised while the app is running/you unsecured the keys/encrypted storage, leading to all the contents either being immediately accessable, or being decryptable in the future when they also capture the physical device.

    The only way to mitigate these risks is to have a complete trustworthy hardware/software stack, ideally with end-user provisioned secure boot. Less ideally with a secure boot compatible OS using a trustworthy third party's images (debian, devuan, or similiar, assuming you can find an organization you trust.) Current secure boot implementations are suspect because they include baked in keys relying on you trusting that microsoft, the root ca organizations, etc are all secure, which simply on account of size you should assume they are not.

    Real information security is hard, which is why even aspects of the intelligence community often fail at it.

    Starting Score:    0  points
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  

    Total Score:   1