Recently discovered this. Molly supports link with existing device just like on signal desktop. It even has benefit of getting entire chat history unlike signal desktop. Just restore the signal backup file during setup and then click link with existing device. Then scan with you primary phone. Beauty of open source. Molly: https://molly.im/
I’m using molly for several months now it is really nice but recently I dive myself in XMPP and it is superior to molly/signal just because XMPP servers are auditable amd you can actually see if the server is using encryption or not while signal servers are closed source unfortunately, it’s their only flaw
The signal source code is open source, it is hard to prove that the servers are running the source code that’s published, and we know they have admitted to having source code they don’t publish for anti-spam purposes.
But you could take the signal server source code and stand up your own signal servers today.
The Signal protocol is built in a way where you don’t have to trust the server. The servers could be run by the NSA, it wouldn’t matter. Especially now that the Signal protocol uses post-quantum cryptography.
And how do I tell may client to use only a specific server?
If your going to run a independent signal server cluster, you will also need to modify the client applications to connect to your cluster.
You probably would find the molly developers happy to accept a push request to have some configurable backend selection.
Session demonstrates this is possible.
If yo run your signal server does it come with the new quantum E2EE?
Good question, check with the signal github
I don’t know man, seems to me XMPP is more secure (unless you trust Signal) and simple to use because you have to jump less hoops
By all means, go with the platform you like better!
https://www.privacyguides.org/en/real-time-communication/
Are all perfectly acceptable options
AFAIK it’s entirely done in the client. The server doesn’t perform any encryption/decryption other than TLS.
Your client encrypts and decrypts everything, so it is actually not a privacy concern regarding message content when we don’t know what the server does.
The server could decrypt or could be machines attached to the server that store data
Your private key stays at the client, the server doesn’t get it. Verifiable by the source code of your client
Ook thanks
The Signal servers don’t do the encryption, it’s done on your phone. That’s how end-to-end encryption works. Also, Signal’s Server code is FOSS: https://github.com/signalapp/Signal-Server