cross-posted from: https://piefed.world/c/ysk/p/1503393/ysk-molly-signal-fork-has-not-been-updated-since-3-months-and-is-vulnerable-to-attacks-f
As of now, Molly lastest release was in 31 July (Version v8.19.2-4).
It contains vulnerabilities that had been simply fixed in mainline Signal.
Take for example the latest exploit disclosed in October, it has been fixed in Signal 8.27. 1. Meanwhile Molly remains vulnerable.
It’s currently recommended to use mainline Signal and delete Molly till they at least return to updating their app adequately, if they ever will.
Weird they posted this, started some updates again. Then nothing?
Signal-FOSS as alternative
I use Signal-FOSS by twinhelix. It exists since many years and upatches are fully automated.
They are very simple, deblob signal, remove firebase messages and maps and whatnot.
Twinhelix has also added some of the jw patches, which are nice to have.
It does not
- remove donations (which is nice and kinda shit of molly)
- remove payments with mobilecoin (kinda useless sadly as very few exchanges support it)
- add blobfree firebase messaging
- add unifiedpush support
- support linking multiple phones
- support encrypting the database
- probably more
If you dont need those features, I highly recommend it. Signal shipping Google blobs and having no F-Droid repo is very bad and that shouldn’t be supported.
See the list of known 3rd party F-Droid repos
UnifiedPush issues
Note that UnifiedPush needs to be supported by the server. The server then sends the push message to a UnifiedPush distributor (like Conversations, ntfy or Sunup). That distributor wakes up the app, which sends you the notification.
There is a slight polling delay of about 1 minute, so notifications are delayed.
I measured the effect of this by comparing molly with UP and the Signal APK with websocket. On a Pixel 8a running GrapheneOS, 12 hours idle on Wifi, airplane mode on (as the modem uses by far the most battery). I configured to send 10 messages to the device using Signals “send later” feature.
Websocket used 3% of the batterylife. Thats it.
And that effect is only significant for people who rarely use Signal, so the likelyhood of a nerd configuring MollySocket falling into that category is pretty low. If you regularly open Signal, this only delays notification alerts for no benefit.
And because the Signal servers don’t officially support this you need to either selfhost MollySocket (which would be fine apart from potential update delays, what this post is about) or trust some server operator. MollySocket is registered as another device, so the Signal servers and any standard Signal client would treat it as a trusted device with its own decryption key.
Apparently MollySocket discards the key and only receives “you have a message” (and no other metadata? I have obviously not researched this a lot), and I suppose Molly ensures that the device will never get a decryption key either. Still, it increases attack surface for very limited benefit.
It would be great if Signal officially supported UP instead of Google FCM.
Why run Molly when Signal is right there? Is this about getting it via places other than the Play store?
It does some extra stuff signal doesn’t ( apparently). Though there’s always a risk using a 3rd party client. And I guess it might be against the TOS of signal?
- encrypt the database with a password
- not using google for notifications
- ram shedding And some others…
I’m running it specifically for the UnifiedPush support which gives me push notifications without Google Play Services.
Signal works perfectly with MicroG for reference.
I have no Google Play Services on my GrapheneOS phone, or any Google account. Signal with MicroG works fast and accurate for all notifications.
I don’t use it but I think the biggest reason is it’s degoogled
That and unified push (although I didn’t get that to work yet) are my main selling point, yes. I seriously don’t understand how signal is only on the PlayStore
As a Android developer who has an app in the Play store as well as in f-droid, I’ll be the first to say that the f-droid people make it an absolute pain to put things there. I’ve almost stopped pushing there because of how annoying it is. My app went 3 months without being updated there because of how they manage things. They are way way way way. Way too frustrating to deal with.
So yeah I’m not surprised. A lot of stuff is not there. I support the concept and it was my main goal to put it there, but they have radically changed my opinion about using it and anyone who refuses to use an app because it’s not there. Should try publish in there sometime
What about your own repo then? I would be totally fine with that if signal did that.
Sure that is the work around that guardian did for signal. It’s just a passion because everyone needs to add that repo manually. Very free people are going to bother with that additional friction if they even know it’s there
Are you messing with me? It’s literally right below: https://signal.org/android/apk/
doesn’t get updates tho
I’m aware of that. But I’m not going to manually download a file every time. And I especially can’t expect that from family members who don’t have the playstore and can’t use a phone very well. A child I manage the phone for does not even have a browser so yeah
So use Obtainium? It’s no worse than f-droid or wherever you get Molly from
Edit: The page just fetches
https://updates.signal.org/android/latest.json, which contains a link to the APK you want to download, so you can feed that to any periodic update service you want
I didn’t know but you can use obtanium and this
Yeah, that’s what I did for a while until I discovered molly… Its annoying but probably the best option if molly becomes abandoned
Signal is distributed by the Guardian Project on Fdroid.
Yeah unofficially… that is very much a bandaid. It is really bad of Signal to not have a blobfree reproducible build on F-Droid and Flathub, or even just external repos (for F-Droid and flathub).
Instead they have a hidden self-updating APK (which is a very cursed concept) with blobs, and a damn Appimage on Linux.
Yeah, is there any actual reason given by Signal for this?
With Molly you can use one Signal account on two devices.
What does this mean? I use signal with the official client on like 5 devices just fine?
Signal supports two android devices in one account as standard
Yeah, since a month or so, and emphasis on 2 and not unlimited
Really? That’s new to me… I’ll check it out
I use molly because i have an android smartphone and tablet and running both with signal is not possible with signal. (Maybe the changed it? I have to check it)
They did! (If you’re talking about pairing a tablet with your smart phone like how their desktop app pairs).
https://aboutsignal.com/news/signal-allows-android-phones-to-be-linked-as-secondary-devices/
Perfect, will switch back to signal.
On an unrelated not my signal backup has corruptes sticker cache, so all old stickers are not showing correctly, does anyone know a way to force it to download it a new one?
Thanks, I’ve been using Molly on my tab for a while. Have now installed Signal
Why run Signal when Session is right there? Maybe you just like leaking metadata?
https://abcnews.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata/
Session has removed perfect forward secrecy. I dont know if they still have broken autodeletion and still store all messages in a blockchain. Overall though, I would stay away from it.
It’s just forward secrecy, not “perfect forward secrecy”, unless you are writing Signal press material.
https://en.wikipedia.org/wiki/Forward_secrecy
I feel that such marketing can impart a false sense of security that has bitten Session users many a time. Ask Pete Hegseth, as much as I like to see him faceplant.
Not relying on the central server largely removes the need for forward security, since you can get a similar result by creating a new account (with a new private key) on your device as often as you like. It is Signal’s reliance on a fixed identity that complicates the matter of rotating keys.
In other words, Signal is not better because it has “perfect forward secrecy”. It is worse because it needs it.
Even so, it is such a talking point that Session does intend to implement “perfect forward secrecy”.
https://getsession.org/blog/session-protocol-v2
As for “store all messages in a blockchain”, I believe that is the alternative to storing them on a central server, as Signal does. They have to be stored somewhere until you are online to receive them. If they weren’t, someone would be replying in your stead and complaining that Session does allow users to receive messages sent while they were offline. Of course the messages are stored encrypted in both cases but only Signal associates them with your metadata.
That sucks. Does the original Signal app deliver notifications properly without Play Services?
The APK from Signal’s website doesn’t require Play services, just don’t install Signal via Play Store. DaNgEr ZoNE eye rolls aside:
https://signal.org/android/apk
Annoying, I rather liked Molly.
Use Verified-Apps from PrivacyGuides to verify the signature of the APK before installing.
Before Appverifier was a thing, it was very obscure how to even check that signature.
I’m going go try Signal-FOSS instead that you mentioned earlier.
I’m new to GrapheneOS and running Signal without anything configured with the word Google in it. I am receiving notifications just fine.
That depends on where you got the APK from
- the playstore apk only supports FCM
- the standalone, hidden (you only find it via search engines), apk on their website also supports websocket
- Twinhelix Signal-FOSS only supports websocket
- molly also supports blobfree FCM and UnifiedPush
But note that UnifiedPush is not supported by signal, so you need to register a fake device on a server running MollySocket. Which is very much additional attack surface and only worth it if you really rarely use signal
i have no problems with notifications on crdroid (lineageOS fork) and microG
Iirc, the push notifications are flowing through Google firebase, which is why you still get them.
Aww bummer
