Hacker News new | ask | show | jobs
by UFOFlyer 1979 days ago
IIRC Signal doesn't have a web app for security reasons. With a iOS/Android/Desktop app, you can verify the checksum of the binary against what signal provides.

But with a web app you redownload the application everytime which means you'd have to recheck that checksum every time you use the app. I guess that WhatsApp, Discord, et al have decided that this is a reasonable risk. But the privacy oriented Signal team disagrees.

I don't think it's a prioritization issue, the desktop app is currently running via electron which means it's effectively a web app already.

2 comments

Something being Electron doesn't mean it's ready to be a web app it means the UI is web and the rest of the app is somewhere between "the standard web sandbox" and "a native app" in terms of what it has access to do.
No, you can't verify the checksum; it downloads and runs new code without asking.

https://github.com/signalapp/Signal-Desktop/issues/4578

Wow... I was totally convinced by the security argument until I read through this thread, which completely obsoletes that premise. It's no different from a PWA (like WhatsApp) in its update behavior then.