Alright I'm gonna put a bigger effort to switch to Signal this time around and get a few friends roped in. I installed the APK just recently. I have some questions and am hoping some of y'all fedibrains would have an answer.
1. Is there any privacy difference between Signal from the Google Play store vs installing the APK from Github?
2. Given how locked down iPhones are, could that make Signal inherently less private?
3. Are calls also e2e encrypted?
4. Is it safe to put my Signal username on my bio? Or should that only ever be shared in private?
5. Can anyone with my Signal username also see what name I set as my first name?
Some of these questions might be dumb because I'm still learning the ropes. Thanks in advance!
@topher@infosec.space@lenkotarski This is truly a spectacular set of questions and I'm looking forward to following this thread for answers to several that I'm not 100% certain myself.
The APK is most notably for de-Googled phones that don't even have a play store whatsoever (as many of us here use), but there was a whole to-do a while back over push notifications going through Apple and Google being vulnerable to metadata spying by those respective platforms. I'm very keen as to whether installing the APK directly (on a non-de-googled phone) functions differently in that regard.
@topher Thanks!
That actually gives me quite a bit to think about. Maybe I should set the notifications to where the message preview doesn't come up. I think I saw something like that when poking through the settings earlier.
I have a Samsung Galaxy S22U so I'm not so sure if it can be de-googled in any meaningful way.
@topher@infosec.space@lenkotarski
I do that on mine in the interest of avoiding both malware and tracking (e.g. tracking URLs being automatically previewed and thus elements on that page being loaded and those beacons being sent)
In fact in iMessage it's even been a vector for malware and spyware installation. It was how Pegasus was ending up installed on iPhones during one of the waves within the past couple years.
@topher That sounds serious. Better not to take any chances then!
@topher@infosec.space@lenkotarski Good motto. Happens to be mine :)