I am not comfortable that signal depends proprietary google library. However, I find that Molly lags significantly behind signal (around 1 to 2 weeks, so maybe not as significant as I thought), but I am just concerned that if there is a security fix in signal, molly will not be able to react as fast.
I am also quite frustrated with the general lack of communication from the signal team (for example the lack of communication regarding username). I doubt they will have the good will to help molly when there is a critical security fix.
It is frustrating that signal no longer seems like the gold standard for privacy any more; unfortunately, all my friends are on there (ironic, isn’t it…).
I love Signal, and I have persuaded people to use it a lot. That said, it is definitely not the gold standard for privacy. It’s a good-enough compromise between actual unbreakable encryption and trivial for anyone to use. It’s always been valuable for that reason, and still is.
Don’t worry about Molly - it uses a variation of the same code that Signal does, so they don’t need “help” to get critical fixes that Signal receives. Use it if you like it!
The actual gold standard for privacy would be logging in through TOR and sending GPG-encrypted messages that way. And there’s an app which does this, too - it’s called Briar. (No phone number needed, either!) It’s not as seamless to set up as Signal is, though.
And there’s an app which does this, too - it’s called Briar.
Cool I had not heard of this, thanks!
Should note that their GitHub says:
We update Molly every two weeks to include the latest features and bug fixes from Signal. The exceptions are security issues, which are patched as soon as fixes become available.
I’m not sure on their track record, but if their claims are true, this could be a fine, secure client.
There’s a FOSS fork of Signal which removes Google dependencies from the software.
Signal-FOSS
A fork of Signal for Android with proprietary Google binary blobs removed. Uses OpenStreetMap for maps and a websocket server connection, instead of Google Maps and Firebase Cloud Messaging.
Hasn’t been updated in a year and is over 3000 commits behind Signal. I wouldn’t use
Molly, like Signal, uses Google’s proprietary code to support some features.
Right at the top of the Molly page.
AFAIK, they have a FOSS variant
To support a 100% free and auditable app, Molly comes in two flavors: one with proprietary blobs like Signal and one without. They are called Molly and Molly-FOSS, respectively. You can install the flavor of your choice at any time, and it will replace any previously installed version. The data and settings will be preserved so that you do not have to re-register.
Also the line right after your quote:
Versions
Molly, like Signal, uses Google’s proprietary code to support some features.
Molly-FOSS is the community effort to make it 100% free and open-source.
For some reason I also was able to get most of my friends and family on Signal and just a year later I set up Matrix and now nobody wants no move anymore.
It used to be - this is an improved texting client. Then they removed SMS, and I think people are drifting away which sucks.
