Send Signal Messages with Kicksecure

From Kicksecure
Jump to navigation Jump to search
Signal Logo

How-to: Use Signal Private Messenger with Kicksecure.

Info COMMUNITY SUPPORT ONLY : THIS WHOLE WIKI PAGE is only supported by the community. Kicksecure developers are very unlikely to provide free support for this content. See Community Support for further information, including implications and possible alternatives.

Introduction[edit]

Signalarchive.org is a well-respected, free, open source, cross-platform encrypted messaging service. It supports individual and group messages (files, voice notes, images and video) as well as one-to-one voice and video calls. All communications are encrypted end-to-end for security, and mechanisms exist to independently verify the identity of contacts as well as the integrity of the data channel. The encryption keys are generated and stored at the endpoints (user devices), rather than by the servers. Both the client and server code is openly published, and the software is recommended by noted privacy advocates Edward Snowden and Bruce Schneier, among others. This is due to the strong architecture and limited metadata available in the ecosystem. [1] [2] [3]

It is possible to install the standalone Signal Desktop application versionarchive.org for Linux in Kicksecure. However, this configuration is not recommended because Signal requires the user provide a phone number for verification. [4] See Phone Number Validation vs User Privacyarchive.org.

Prerequisites[edit]

Signal must already be installed on your Android or iOS device -- first follow the download instructionsarchive.org on the Signal homepage if required. [5]

It is also recommended to create a separate Kicksecure that is only used for Signal because these instructions require the enabling of the Ubuntu Xenial repository for the desktop client. [6] The Signal developers do not maintain specific versions for other distributions, which is why Ubuntu is defaulted to.

Install the Signal Desktop Client[edit]

This configuration allows the standalone Signal desktop client to link with the mobile device and send/receive messages from a laptop or desktop computer. [7] As of late-2020, the desktop application also now supports one-to-one voice and video conversations. [8] After launching the desktop client, it must be linked with the (mobile) phone. Be aware that messages are synchronized with Signal on the mobile phone.

warning Security warning: Adding a third party repository and/or installing third-party software allows the vendor to replace any software on your system. Including but not limited to the installation of malware, deleting files and data harvesting. Proceed at your own risk! See also Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Kicksecure to compartmentalize VMs with additional software.

1. Add the Signal GPG key to the APT keyrings. [9]

Securely download the key.

If you are using Kicksecure (kicksecure), run.

scurl-download https://updates.signal.org/desktop/apt/keys.asc

If you are using a Qubes Template (kicksecure-17), run. [10] [11]

http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 scurl-download https://updates.signal.org/desktop/apt/keys.asc

Display the key's fingerprint. [12]

gpg --keyid-format long --import --import-options show-only --with-fingerprint keys.asc

Verify the output.

  • Digital signatures: A tool enhancing download security. Commonly used across the internet.
  • Learn more: Curious? Learn more about digital software signatures.
  • Optional: Digital signatures are optional. If you've never used them before, there might be no need to start now.
  • No worries: New to digital software signatures? It's okay, no need to worry.
  • Not a requirement: Not mandatory for using Kicksecure, but an extra security measure for advanced users.

The most important check is confirming the key fingerprint exactly matches the output below. [13]

Key fingerprint = DBA3 6B51 81D0 C816 F630 E889 D980 A174 57F6 FB06

Warning:

Do not continue if the fingerprint does not match -- this risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

Copy the signing key to the APT keyring folder. [14]

sudo cp keys.asc /usr/share/keyrings/signal-desktop-keyring.asc

2. Add the Signal third-party APT repository. [15] [16] [17]

echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.asc] tor+https://updates.signal.org/desktop/apt xenial main' | sudo tee /etc/apt/sources.list.d/signal-xenial.list

3. Install Signal.

Install signal-desktop. To accomplish that, the following steps A. to D. need to be done.

A. Update the package lists.

sudo apt update

B. Upgrade the system.

sudo apt full-upgrade

C. Install the signal-desktop package.

Using apt command line parameter --no-install-recommends is in most cases optional.

sudo apt install --no-install-recommends signal-desktop

D. Done.

The procedure of installing signal-desktop is complete.

4. Done.

The process of installing Signal is complete.

5. Note.

  • Kicksecure: No extra steps required.
  • Kicksecure for Qubes: Shutdown kicksecure-17 Template. Restart Kicksecure (kicksecure App Qube).

Start Signal[edit]

To launch Signal, run.

signal-desktop

Figure: Signal Desktop in Kicksecure

Broken Metadata Protection[edit]

Signal's metadata protection (who is communicating with whom) might be ineffective.

Hi, thank you for this thought provoking talk. You said so many things I disagree with it is tough to pick a question. But the one I want to ask is: The features that you have about private groups and sealed sender, those seem to be protecting data at rest for when the server is compromised the data that's on it is less useful to the attacker, but if the server is already compromised it is not really providing traffic analysis protection - your metadata protection is effectively a pinky-promise oriented architecture and you have outsourced the keeping of the promise to a defense contractor owned by the richest man in the world; so my question it: How confident are you that Amazon is keeping the promises that you are making?

See this question and Moxie's (founder of Signal) answer here.archive.org Moxie failed to deny or refute this.

Amazon NSA collusion:

Amazon is proud of their cooperation with law enforcement and providing them with recordings from Amazon Ring the doorbell snitch. Hard to believe they don't collaborate with higher agencies such as the NSA of the security apparatus ladder.

Claims That Signal Encryption Is Broken[edit]

Cellebritearchive.org formerly claimedarchive.org they were able to decrypt Signal encryption. However, the article details were later removed [18] because it was debunked by Moxie Marlinspikearchive.org (alternativearchive.org) (co-founder and currently CEO of Signal Messenger), Edward Snowdenarchive.org(Nitterarchive.org), and Filippo Valsordaarchive.org(Nitterarchive.org). Signal also officiallyarchive.org responded to this false claim.

Note: cryptographer Bruce Schneier wrote an article about this issue in his blog entitled "Cellebrite Can Break Signal", but he later apologizedarchive.org for his erroneous post.

Signal Delayed Updating Their Server Code On Time[edit]

Signal server code been delayedarchive.org to get updated to prevent spammers from gleaning the new anti-spam measures the company planned to enact (According to the previousarchive.org signal CEO Moxie Marlinspike [19] [20]).

See Also[edit]

Footnotes[edit]

  1. ↑ https://en.wikipedia.org/wiki/Signal_%28software%29archive.org
  2. ↑ For additional Signal features, see: Wikipedia: Signal (software) - Featuresarchive.org
  3. ↑ Signal blogarchive.org:

    By design, Signal does not have a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars. The end-to-end encrypted contents of every message and voice/video call are protected by keys that are entirely inaccessible to us. In most cases now we don’t even have access to who is messaging whom.

  4. ↑ The number can be different form the device's SIM card; it can be a landline or VOIP number, so long as the user can receive the verification code and possesses a separate device to set up the software.
  5. ↑ Also see: Installing Signalarchive.org.
  6. ↑ Common advice is to not mix repositories from related distributions like Ubuntu and Debian, since this can cause system instability.
  7. ↑ https://www.signal.org/blog/standalone-signal-desktop/archive.org
  8. ↑ https://github.com/signalapp/Signal-Desktop/releases/tag/v1.35.1archive.org
  9. ↑ https://github.com/freedomofpress/ansible-role-signal-desktoparchive.org
  10. ↑ Using Qubes UpdatesProxy (http://127.0.0.1:8082/archive.org) because Qubes Templates are non-networked by Qubes default and therefore require UpdatesProxy for connectivity. (APT in Qubes Templates is configured to use UpdatesProxy by Qubes default.)
  11. ↑ Even more secure would be to download the key Disposable and then qvm-copyarchive.org it to the Qubes Template because this would avoid curl's attack surface but this would also result in even more complicated instructions.
  12. ↑ Even more secure would be to display the key in another Disposable because this would protect the Template from curl's and gpg's attack surface but this would also result in even more complicated instructions.
  13. ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
  14. ↑ https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302archive.org
  15. ↑ https://signal.org/download/archive.org
  16. ↑ https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302archive.org
  17. ↑ See this for a comment why tor+ is useful even inside Kicksecure.
  18. ↑ https://www.cellebrite.com/en/blog/cellebrites-new-solution-for-decrypting-the-signal-app/archive.org
  19. ↑ https://github.com/signalapp/Signal-Android/issues/11101#issuecomment-815400676archive.org
  20. ↑ https://www.xda-developers.com/signal-updates-public-server-code/#update1archive.org

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 10 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Signal&oldid=77352"