SimpleX Chat

460 readers

1 users here now

Community of SimpleX Chat users – managed by the team.

SimpleX Chat is the first chat platform that is 100% private by design – it has no user identifiers of any kind and no access to your connections graph – it's a more private design than any alternative we know of.

Please ask any questions and make feature suggestions. Your ideas and criticism are very welcome!

https://github.com/simplex-chat/simplex-chat

founded 2 years ago

MODERATORS

[email protected]

Why is Simplex calling to Google? (lemmy.world)

submitted 2 weeks ago by [email protected] to c/[email protected]

15 comments fedilink hide all child comments

I may be wrong, but can someone help me interpret the results of this analysis correctly?

https://www.hybrid-analysis.com/sample/0a0238f85b8a559e8ab54f67920004db3a67a39bdbdbfa00075fd7d27e41dec4/672423b56b46e4feb006681d

See the Network Related section: Why does Simplex.apk have a hardcoded communication with

issuetracker.google.com

android.googlesource.com

developers.google.com

An app that is advertised as the most privacy-friendly?

All other indicators can (probably) be considered false positives (for example, the Camera permission, which is needed for video calls)

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 2 weeks ago (2 children)

Hello !

Version 6.1.1 (250) arm64-v8a https://f-droid.org/en/packages/chat.simplex.app/ https://f-droid.org/repo/chat.simplex.app_250.apk

Here's the analysis: https://www.hybrid-analysis.com/sample/9b14b4f80b479a7eb2a5e9fb22ad3f5d547690f4e30da6b5c6f0e9ed8d4039da/672727b3fd3db6063b002513

Same exact result:

Pattern match: "https://android.googlesource.com/toolchain/llvm-project"
Pattern match: "https://developers.google.com/protocol-buffers///"
Pattern match: "https://issuetracker.google.com/issues/new?component=618491&template=1257717"

Dunno if this is something we should worry about or not ? Maybe OP and myself are not educated enough to interpret the results, however I'm also not very comfortable seeing those Found potential URL in binary/memory from SimpleX's APK. Do you have any further thoughts?

Thanks.

[–] [email protected] 2 points 2 weeks ago

I hope @[email protected] will dispel our doubts or a member of the Simplex.chat team :(

[–] [email protected] 0 points 2 weeks ago (1 children)

In the details for potential URL in memory, it says that's for .onion address.

Thank you for posting the report, after I read through it, everything to me is clean and clear. The FDroid apk does not communicate with any outside resource that is not part of the anonymous network.

The Github version relies on Google, and to me nothing in the report suggeats that the FDroid version communicates with Google services.

[–] [email protected] 1 points 2 weeks ago (1 children)

It's not about whether the application communicates with these addresses or not. It's about the fundamental question: why are these addresses even encoded in the code of a VERY privacy-sensitive application?

My friend, in every answer you push F-Droid as a cure for all evil. There is no perfect store, F-Droid also has its problems (I wrote about it above). I am not an enemy of F-Droid (I also use it sometimes), but I will repeat: F-Droid control is insufficient (it's security theater - it's not a full audit of the source code).

[–] [email protected] -1 points 2 weeks ago

I think I can agree with the crux of your statement, the problem I see completely outside of your argument is the online privacy community is both highly toxic and highly ignorant. Most of them have never worked in IT or as an admin and have to work with customers according to what the customer is paying for and not what someone believes is a better way but the paying customer has no interest in learning, so they spout their opinions online but have never had formal employment in network security and privacy for a company.