blog/archive/2016/07/07.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from July 2016</title>
   5                 <description>Entries from July 2016</description>
   6                 <link>http://people.skolelinux.org/pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>How to use the Signal app if you only have a land line (ie no mobile phone)</title>
  11                 <link>http://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html</link>
  12                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html</guid>
  13                 <pubDate>Sun, 3 Jul 2016 14:20:00 +0200</pubDate>
  14                 <description>&lt;p&gt;For a while now, I have wanted to test
  15 &lt;a href=&quot;https://whispersystems.org/&quot;&gt;the Signal app&lt;/a&gt;, as it is
  16 said to provide end to end encrypted communication and several of my
  17 friends and family are already using it.  As I by choice do not own a
  18 mobile phone, this proved to be harder than expected.  And I wanted to
  19 have the source of the client and know that it was the code used on my
  20 machine.  But yesterday I managed to get it working.  I used the
  21 Github source, compared it to the source in
  22 &lt;a href=&quot;https://chrome.google.com/webstore/detail/signal-private-messenger/bikioccmkafdpakkkcpdbppfkghcmihk?hl=en-US&quot;&gt;the
  23 Signal Chrome app&lt;/a&gt; available from the Chrome web store, applied
  24 patches to use the production Signal servers, started the app and
  25 asked for the hidden &quot;register without a smart phone&quot; form.  Here is
  26 the recipe how I did it.&lt;/p&gt;
  27
  28 &lt;p&gt;First, I fetched the Signal desktop source from Github, using
  29
  30 &lt;pre&gt;
  31 git clone https://github.com/WhisperSystems/Signal-Desktop.git
  32 &lt;/pre&gt;
  33
  34 &lt;p&gt;Next, I patched the source to use the production servers, to be
  35 able to talk to other Signal users:&lt;/p&gt;
  36
  37 &lt;pre&gt;
  38 cat &amp;lt;&amp;lt;EOF | patch -p0
  39 diff -ur ./js/background.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js
  40 --- ./js/background.js  2016-06-29 13:43:15.630344628 +0200
  41 +++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js    2016-06-29 14:06:29.530300934 +0200
  42 @@ -47,8 +47,8 @@
  43          });
  44      });
  45
  46 -    var SERVER_URL = &#39;https://textsecure-service-staging.whispersystems.org&#39;;
  47 -    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com&#39;;
  48 +    var SERVER_URL = &#39;https://textsecure-service-ca.whispersystems.org:4433&#39;;
  49 +    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments.s3.amazonaws.com&#39;;
  50      var messageReceiver;
  51      window.getSocketStatus = function() {
  52          if (messageReceiver) {
  53 diff -ur ./js/expire.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js
  54 --- ./js/expire.js      2016-06-29 13:43:15.630344628 +0200
  55 +++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js2016-06-29 14:06:29.530300934 +0200
  56 @@ -1,6 +1,6 @@
  57  ;(function() {
  58      &#39;use strict&#39;;
  59 -    var BUILD_EXPIRATION = 0;
  60 +    var BUILD_EXPIRATION = 1474492690000;
  61
  62      window.extension = window.extension || {};
  63
  64 EOF
  65 &lt;/pre&gt;
  66
  67 &lt;p&gt;The first part is changing the servers, and the second is updating
  68 an expiration timestamp.  This timestamp need to be updated regularly.
  69 It is set 90 days in the future by the build process (Gruntfile.js).
  70 The value is seconds since 1970 times 1000, as far as I can tell.&lt;/p&gt;
  71
  72 &lt;p&gt;Based on a tip and good help from the #nuug IRC channel, I wrote a
  73 script to launch Signal in Chromium.&lt;/p&gt;
  74
  75 &lt;pre&gt;
  76 #!/bin/sh
  77 cd $(dirname $0)
  78 mkdir -p userdata
  79 exec chromium \
  80   --proxy-server=&quot;socks://localhost:9050&quot; \
  81   --user-data-dir=`pwd`/userdata --load-and-launch-app=`pwd`
  82 &lt;/pre&gt;
  83
  84 &lt;p&gt; The script start the app and configure Chromium to use the Tor
  85 SOCKS5 proxy to make sure those controlling the Signal servers (today
  86 Amazon and Whisper Systems) as well as those listening on the lines
  87 will have a harder time location my laptop based on the Signal
  88 connections if they use source IP address.&lt;/p&gt;
  89
  90 &lt;p&gt;When the script starts, one need to follow the instructions under
  91 &quot;Standalone Registration&quot; in the CONTRIBUTING.md file in the git
  92 repository.  I right clicked on the Signal window to get up the
  93 Chromium debugging tool, visited the &#39;Console&#39; tab and wrote
  94 &#39;extension.install(&quot;standalone&quot;)&#39; on the console prompt to get the
  95 registration form.  Then I entered by land line phone number and
  96 pressed &#39;Call&#39;.  5 seconds later the phone rang and a robot voice
  97 repeated the verification code three times.  After entering the number
  98 into the verification code field in the form, I could start using
  99 Signal from my laptop.
 100
 101 &lt;p&gt;As far as I can tell, The Signal app will leak who is talking to
 102 whom and thus who know who to those controlling the central server,
 103 but such leakage is hard to avoid with a centrally controlled server
 104 setup.  It is something to keep in mind when using Signal - the
 105 content of your chats are harder to intercept, but the meta data
 106 exposing your contact network is available to people you do not know.
 107 So better than many options, but not great.  And sadly the usage is
 108 connected to my land line, thus allowing those controlling the server
 109 to associate it to my home and person.  I would prefer it if only
 110 those I knew could tell who I was on Signal.  There are options
 111 avoiding such information leakage, but most of my friends are not
 112 using them, so I am stuck with Signal for now.&lt;/p&gt;
 113 </description>
 114         </item>
 115
 116         </channel>
 117 </rss>