Also please post what you find or what works for you. I’m loving my Librem 5 but find myself sometimes going back to my old busted screen Android as a way to more conveniently use Signal. For an app meant to increase user privacy, that just sucks.
I downloaded Axolotl and tried to register but I did it wrong because I forgot or didn’t realize that I must unlink my old Signal and destroy my account on Android first to remove the PIN. Then I realized there was a long GitHub thread on Axolotl where people said that the registration process Axolotl is doing got killed off in an update to the Signal app, and that attempting to register on Axolotl like I did bans you for 7 days from any attempt at registering, and that kind of led me away from Axolotl for now.
So some time went by and then I tried Signal on GloDroid on a PinePhone which didn’t get it on a Librem 5 but seemed like a step in the right direction. But then my GloDroid install got corrupted and hosed. So I went back to Signal on Android. That got me thinking so I tried Flare app, a GTK signal solution, on my Librem 5. But unlike Axolotl that one has to bind via QR code to an Android or iOS, and the binding only works on the gnome flathub flatpak and not the PureOS flatpak because of how Signal updated their servers to kill off older versions. Also, when Flare did bind to my Android and allow me to receive messages, messages that I sent appeared on the screen visually but were not received by the other party. Someone online suggested disabling a background service process for Flare would fix that, but I didn’t put in the time to locate the proper setting.
So, again frustrated by failure I decided to go and try the actual Signal app promoted on this thread on my older non-USA Librem 5 that I’m using less now that I have a more powerful Liberty Phone as my main driver.
But of course, it only works when I link it to my stupid busted screen old Android, which is stupid.
I heard of someone else using Signal in Waydroid as the host and Signal outside Waydroid as the paired solution on Librem 5 or other FOSS phone like PinePhone, but the Waydroid install that is on my old test junker Librem 5 is infested with Google Play services and stuff for my work. I don’t want to put Signal on there!
And I don’t want Waydroid on my newer, secure daily driver because I want to live without Google on the handset. Otherwise, why wouldn’t I just be using an Android and give it all away?
So I posted on Signal’s forum on the thread where users asked for the feature of registering from a GNU Linux desktop for months or years without the Signal folks ever taking the request seriously. And when some guy had asked why Signal doesn’t implement it, I asked in a reply “maybe it’s because Signal is a government honeypot?” and posted a link to where Signal implements its communications using Google Firebase Message, and a link to where in the gradle build pipeline of the “open source” app it always checks for Google as a gradle artifacts provider, meaning it notifies Google inadvertently whenever someone compiles (or at least prepares to compile) Signal. These were both direct links to location in the “Signal-Android” source code on GitHub.
And they replied by deleting my post for being misinformation (they called it “FUD”) then proceeded to tell me that I’m wrong because “everybody” already knows about the stuff I was linking from inside the Signal source code, and that users can just turn off the part of Signal that sends messages via Google Firebase Messaging if they don’t like it.
So, in response I apologized for being “so misinformed” then made a different thread in a different place on their forum asking how to disable the Google Firebase Messaging part so that if I communicate over Signal then I would only communicate through Signals servers, and on that other thread I was told there is no setting to disable this. Instead, the only way to disable it is to use an Android device which never had Google Play services to begin with.
Now, when I was researching how to solve some other problems I was having with a different app, it became clear that the default installation of Waydroid on Librem 5 can use a Lineage ROM without Google Play services if the user picks the right ROM to download. So that might actually be a fairly straightforward workaround currently for the time being. But the camera does not work in Waydroid, so linking the non-waydroid Signal-desktop-for-Phosh solution promoted in this thread to a Waydroid Signal without Google Play would be difficult, I imagine, and probably require the Waydroid user to download the Molly fork of Signal instead of Signal itself.
But it was about this time that in my frustration I popped “Signal app government honeypot” in a search engine, and it was thus that I discovered an excellently written post that posits the possibility that Signal might be another CryptoAG-style honeypot: Why not Signal? | essays
Of course, even the guy writing all of that admits to not knowing and simply identifies the possibility that Signal may be compromised.
But he also points out that there is U.S. law that says if the 3-letter agencies of the United States ask you to spy on their behalf, and you declare publicly that they are spying through you, then you just go straight to jail forever or whatever.
And that kind of made me realize that I think, it just further solidifes in my mind that we shouldn’t try to escape from government surveillance because we physically can’t. For all you know, the U.S. government might have commanded Purism to put spyware in the “firmware jail” of the Purism devices, but if anyone at Purism tells you then they would get life in prison.
So, what we really collectively want to beat, I think at least for me, is corporate surveillance. Screw Google for eating the fabric of my consciousness with their AI experiments.
So, it’s important to pick an objective and I like to think that right now in my life, what I picked to aim for is to not use Android (or iOS which I don’t have experience with but it doesn’t sound better).
And so to that end, I would highlight another excellent point from that same article listed above which is that Signal indicated it might be against their Terms of Service to run a modified fork of Signal that touches their official servers even though the client app is GPL to make you like it. And that’s why the Molly fork I mentioned above – needed if you want to “Link a Device” from within Waydroid where the camera doesn’t work – can’t be easily available on F-Droid, since Signal app group pulled strings to pull it off there since forking Signal is a violation of their Terms of Use like that.
And so, with that in mind, maybe you can understand my frustration now that I explained what I found and what works for me. But I personally don’t want more electron stuff on my daily driver since electron is Chrome and Chrome is Google (and also stupid bloat – why can’t Signal be gtk like flare?) and so what I am doing right now on my daily driver is to not have Signal.
And then, if I need Signal, I can check that on one of the compromised devices in the evening or whatever.