Signal Has Non-free Dependencies [Android]

Short Description: Signal requires proprietary software for Android
What is wrong with Signal?: Signal depends on proprietary software for its Android application. Therefore, is not “free software” as listed before.
Why does freedom matter?: Users cannot fully audit Signal’s Android application. This is particularly worrisome if it plans to replace modern SMS.
More Info: https://www.fsf.org/campaigns/priority-projects/voicevideochat

1 Like

Is this info up-to-date?

  • Signal, a messaging app for mobile phones, has earned widespread deserved praise as a free software encrypted voice and text communication client, but currently has a proprietary dependency on Google libraries. Helping the project remove this dependency and operate the necessary infrastructure is a high priority.

((article linked is dated: Published on Jan 13, 2017 03:01 PM

they also fail to mention it on their signal page: https://directory.fsf.org/wiki/Signal (This entry (in part or in whole) was last reviewed on 19 April 2018.)

nor on their full listing pages: https://directory.fsf.org/wiki/Category/Business/telephony

but do refer to list on libreplanet, but no reference there:
https://libreplanet.org/wiki/Group:Skype_Replacement

looks like your first post, welcome to PTIO forums!

edit to add: sounds like Wire has similar issue still? (something is prevent fdroid inclusion :confused:

1 Like

Signal also released the APK for direct download which doesn’t rely on the google dependencies.

That article is from 2017 and things in tech move faster than that. It’s not a good idea to be so reactionary to old information without doing further research.

1 Like

Welcome to the forums! But yes, as @anon18111482 said, these statements don’t look up to date. Is it just me, or is everyone trying to find holes in every privacy tool that exists? I understand being paranoid, but there have to be at least a few that work…right?

1 Like

it appears the issue was signal relying on the gaggle cloud messaging (GCM aka firebase, this enables push notifies on android) which depends on gaggle Play Services and became a moot point with this commit enabling websocket use instead of gcm/firebase.

Desktop version also is independent of chrome/chromium dependency now (ref: https://gist.github.com/shvchk/60b8410edf7eb00e7696f1534d47428d#install-signal-desktop-as-a-standalone-app-without-chrome-dependency
and
https://signal.org/blog/standalone-signal-desktop/

for android, also see April 2018:

Thanks in large part to moxie himself (but also to the F-Droid folks), we are much, much closer to a liberated signal than we were 4 years ago. The server side is still proprietary now publicly available under the AGPLv3. The client is also fully free software, optionally including the dependencies, so that’s really encouraging. I would recommend people reconsider their strong positions and see how it is, after all, possible to collaborate in a positive way. The Noise folks really showed us the way here, and we should probably be grateful to them as well…

if you know or suspect other non-free dependencies for Signal then please do include a credible reference for such!

2 Likes