Why doesn't Signal forbid third party clients or at least offer a client certification program to ensure security?

Signal forks can have unexpected behaviours like retaining deleted messages and also they don't get updated at the same rate that Signal get updated.
Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossible or very hard to be done If they blocked third party clients. (Ex: 1)
The amount of people who use third party Signal clients are very few anyway.

I saw what WhatsApp did to forbid modification of it's app which works in stopping a lot of distributions, why doesn't Signal do the same?

30 points · 15 comments · view on lemmy.world

15 Comments

AllNewTypeFace@leminal.space · 34 pts · 1y (6 replies)

IIRC, they do forbid third-party clients from their network. You can build it from source, but you won’t be able to connect to production Signal servers.

Third-party clients would not necessarily be a bad thing. Signal has limited resources, and as such has to cut corners. I for one would love a native desktop client that’s not Electron bloatware.

Dot@feddit.org · 3 pts · 1y (5 replies)

[ removed ]

Static_Rocket@lemmy.world · 11 pts · 1y

I could appreciate a client certification that is optional, like a list of approved clients on their website or something along those lines.

It should not be enforced by killing the client. I like security, but I enjoy software freedom more.

just_another_person@lemmy.world · 2 pts · 1y

It takes resources to run and maintain such things. Probably not something they feel they can or want to take on.

rottingleaf@lemmy.world · 0 pts · 1y (2 replies)

As I said, a compromise here would be to have a client security certification program, where no other clients outside it would be able to use Signal.

You mean running a trojan "as a mean of security", similar to anticheats? Are you sure this is a good idea?

Or if by "program" you mean having some allowed clients as opposite to only the official one allowed, it's a social thing, not a technical one. So it still won't prevent anyone from connecting with another client.

Dot@feddit.org · 3 pts · 1y (1 reply)

[ removed ]

rottingleaf@lemmy.world · 1 pts · 1y

How do you imagine this working?

tekato@lemmy.world · 19 pts · 1y (1 reply)

They don’t allow 3rd party clients, as per their ToS:

You must not (or assist others to) access, use, modify, distribute, transfer, or exploit our Services in unauthorized manners, or in ways that harm Signal, our Services, or systems. For example you must not (a) gain or try to gain unauthorized access to our Services or systems; (b) disrupt the integrity or performance of our Services; (c) create accounts for our Services through unauthorized or automated means; (d) collect information about our users in any unauthorized manner; or (e) sell, rent, or charge for our Services.

You need authorization to access Signal servers, which they don’t give:

we really don't want forked versions of the app maintained by other parties connecting to our servers. Not only could the users using the forked version have a subpar experience, but the people they're talking to (using official clients) could also have a subpar experience (for example, an official client could try to send a new kind of message that the fork, having fallen out of date, doesn't support). I know you say you'd advocate for a build expiry, but you know how things go. Of course you have our full support if you'd like to fork Signal, name it something else, and use your own servers.

In my opinion, this is a horrible decision from Signal.

visor841@lemmy.world · 13 pts · 1y

Yeah this is a big part why I'm very skeptical of Signal. It feels a lot like Ubuntu's snap store, it's technically open but you can't really interact with the main corporate controlled ecosystem.

hummingbird@lemmy.world · 16 pts · 1y (1 reply)

Signal forks can have unexpected behaviours like retaining deleted messages and also they don’t get updated at the same rate that Signal get updated.

There are ways to save messages before they are deleted even if the stock app is used. Do not ever rely on this feature to work in a "safe" way.

Every couple of years I hear a story about hackers disturbing signal with backdoors, which would be impossible or very hard to be done If they blocked third party clients. (Ex: 1)

That is a problem the users who prefer 3rd party clients have to deal with. Obviously if you care enough to not use the official build, you of cause have to take care of using a trustworthy source. That is not "your problem" though.

The amount of people who use third party Signal clients are very few anyway.

That sounds a lot like "I don't use it, so none else needs it either" argument. In my opinion, none of your arguments above are a good reason to combat 3rd party clients.

LodeMike@lemmy.today · 1 pts · 1y

That's a lot of flack from an application which refuses to distribute itself outside the play store.

jet@hackertalks.com · 10 pts · 1y (3 replies)

https://molly.im/

There are dozens of us! Dozens

progandy@feddit.org · 2 pts · 1y (2 replies)

This is the way. I might be open to switch back if they [signal] added [official] support for unified push, though

jet@hackertalks.com · 1 pts · 1y (1 reply)

Good news! https://github.com/mollyim/mollyim-android-unifiedpush

progandy@feddit.org · 2 pts · 1y

I know. I meant switch back to signal if signal added official support.

EngineerGaming@feddit.nl · 2 pts · 1y

[ removed ]

0x0@programming.dev · 2 pts · 1y

SimpleX Chat seems to be the new kid on the block.

avidamoeba@lemmy.ca · 1 pts · 1y

How do Signal stop forks from connecting to their servers?