• Optional@lemmy.world
    link
    fedilink
    arrow-up
    26
    arrow-down
    1
    ·
    6 days ago

    per the article

    Signal can’t access user metadata. It’s not just that Signal promises not to keep logs. They’ve literally engineered their service to cryptographically prevent themselves from having access to metadata, even if they wanted to. Signal doesn’t know what groups you’re in, or even what Signal groups exist on the platform. They don’t know the names or membership of any Signal group. They can’t even access your profile picture or name. All of this is stored on user devices and shared directly from user to user. On the other hand, if WhatsApp gets a data request, Meta will turn over details about everyone in your group, exactly who sends messages to who, and when, because WhatsApp collects all of this.

      • Jean-luc Peak-hard@piefed.social
        link
        fedilink
        English
        arrow-up
        1
        ·
        22 hours ago

        So, its all done by the user client?

        Yes. The client uses what’s called “remote attestation” to verify its talking to, not just official servers, but official server code published on github. Read more about it here: https://signal.org/blog/building-faster-oram/

        To put it simply, they’re using the same technology that allows DRM protected videos to play back on your computer/phone/tablet, but against their own servers, to ensure its not a rogue host or code.