For a while now, I have wanted to test
the Signal app, as it is
said to provide end to end encrypted communication and several of my
friends and family are already using it. As I by choice do not own a
mobile phone, this proved to be harder than expected. And I wanted to
have the source of the client and know that it was the code used on my
machine. But yesterday I managed to get it working. I used the
Github source, compared it to the source in
the
Signal Chrome app available from the Chrome web store, applied
patches to use the production Signal servers, started the app and
asked for the hidden "register without a smart phone" form. Here is
the recipe how I did it.
First, I fetched the Signal desktop source from Github, using
git clone https://github.com/WhisperSystems/Signal-Desktop.git
Next, I patched the source to use the production servers, to be
able to talk to other Signal users:
cat <<EOF | patch -p0
diff -ur ./js/background.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js
--- ./js/background.js 2016-06-29 13:43:15.630344628 +0200
+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js 2016-06-29 14:06:29.530300934 +0200
@@ -47,8 +47,8 @@
});
});
- var SERVER_URL = 'https://textsecure-service-staging.whispersystems.org';
- var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com';
+ var SERVER_URL = 'https://textsecure-service-ca.whispersystems.org:4433';
+ var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments.s3.amazonaws.com';
var messageReceiver;
window.getSocketStatus = function() {
if (messageReceiver) {
diff -ur ./js/expire.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js
--- ./js/expire.js 2016-06-29 13:43:15.630344628 +0200
+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js2016-06-29 14:06:29.530300934 +0200
@@ -1,6 +1,6 @@
;(function() {
'use strict';
- var BUILD_EXPIRATION = 0;
+ var BUILD_EXPIRATION = 1474492690000;
window.extension = window.extension || {};
EOF
The first part is changing the servers, and the second is updating
an expiration timestamp. This timestamp need to be updated regularly.
It is set 90 days in the future by the build process (Gruntfile.js).
The value is seconds since 1970 times 1000, as far as I can tell.
Based on a tip and good help from the #nuug IRC channel, I wrote a
script to launch Signal in Chromium.
#!/bin/sh
cd $(dirname $0)
mkdir -p userdata
exec chromium \
--proxy-server="socks://localhost:9050" \
--user-data-dir=`pwd`/userdata --load-and-launch-app=`pwd`
The script start the app and configure Chromium to use the Tor
SOCKS5 proxy to make sure those controlling the Signal servers (today
Amazon and Whisper Systems) as well as those listening on the lines
will have a harder time location my laptop based on the Signal
connections if they use source IP address.
When the script starts, one need to follow the instructions under
"Standalone Registration" in the CONTRIBUTING.md file in the git
repository. I right clicked on the Signal window to get up the
Chromium debugging tool, visited the 'Console' tab and wrote
'extension.install("standalone")' on the console prompt to get the
registration form. Then I entered by land line phone number and
pressed 'Call'. 5 seconds later the phone rang and a robot voice
repeated the verification code three times. After entering the number
into the verification code field in the form, I could start using
Signal from my laptop.
As far as I can tell, The Signal app will leak who is talking to
whom and thus who know who to those controlling the central server,
but such leakage is hard to avoid with a centrally controlled server
setup. It is something to keep in mind when using Signal - the
content of your chats are harder to intercept, but the meta data
exposing your contact network is available to people you do not know.
So better than many options, but not great. And sadly the usage is
connected to my land line, thus allowing those controlling the server
to associate it to my home and person. I would prefer it if only
those I knew could tell who I was on Signal. There are options
avoiding such information leakage, but most of my friends are not
using them, so I am stuck with Signal for now.
