Actions

Send Signal Messages over Tor with Whonix ™

From Whonix



Signal Logo

Introduction[edit]

Signal [archive] is a well-respected, free, open source, cross-platform encrypted messaging service. It supports individual and group messages (files, voice notes, images and video) as well as one-to-one voice and video calls. All communications are encrypted end-to-end for security, and mechanisms exist to independently verify the identity of contacts as well as the integrity of the data channel. The encryption keys are generated and stored at the endpoints (user devices), rather than by the servers. Both the client and server code is openly published, and the software is recommended by noted privacy advocates Edward Snowden and Bruce Schneier, among others. This is due to the strong architecture and limited metadata available in the ecosystem. [1] [2] [3]

Ambox warning pn.svg.png It is possible to pair Signal with Whonix ™ by installing the standalone Signal Desktop application [archive] for Linux in Whonix-Workstation ™, and tunneling the application over the Tor network. However, this configuration is not recommended because although the traffic will be routed over the Tor network, Signal requires the user provide a phone number for verification. [4] See Phone Number Validation vs User Privacy.

The mandatory linkage of the desktop software application with a phone number makes it very likely adversaries can easily link any 'anonymous' use of Signal in Whonix ™ with a user's real identity, even if a secondary phone number is used as a limited workaround. Notably, to date Signal has ignored user requests to enable registration with an email account as a possible alternative. For this reason alone, alternative options like Gajim and HexChat should be investigated instead; see Instant Messenger Chat for further information. Readers are of course free to ignore this advice -- see below for Whonix ™ instructions.

Community Support Only!:
Info

Community Support Only means Whonix ™ developers are unlikely to provide free support for wiki chapters or pages with this tag. See Community Support for further information, including implications and possible alternatives.

Prerequisites[edit]

Signal must already be installed on your Android or iOS device -- first follow the download instructions [archive] on the Signal homepage if required. [5]

It is also recommended to create a separate Whonix-Workstation ™ that is only used for Signal because these instructions require the enabling of the Ubuntu Xenial repository for the desktop client. [6] The Signal developers do not maintain specific versions for other distributions, which is why Ubuntu is defaulted to.

Install the Signal Desktop Client[edit]

This configuration allows the standalone Signal desktop client to link with the mobile device and send/receive messages from a laptop or desktop computer. [7] As of late-2020, the desktop application also now supports one-to-one voice and video conversations. [8] After launching the desktop client, it must be linked with the (mobile) phone. Be aware that messages are synchronized with Signal on the mobile phone.

warning Security warning: Adding a third party repository allows the vendor to replace any package on your system. Proceed at your own risk! See Foreign Sources for further information. For greater safety, users adding third party repositories should always use Multiple Whonix-Workstation ™ to compartmentalize VMs with additional software.

1. Add the Signal GPG key to the APT keyrings. [9]

Securely download the key.

If you are using Whonix-Workstation ™ (anon-whonix), run. 

scurl-download https://updates.signal.org/desktop/apt/keys.asc

If you are using a Qubes Template (whonix-ws-16), run. [10] [11] 

scurl-download --proxy http://127.0.0.1:8082/ https://updates.signal.org/desktop/apt/keys.asc

Display the key's fingerprint. [12] 

gpg --keyid-format long --import --import-options show-only --with-fingerprint keys.asc

Verify the output.

notice Digital signatures can increase security but this requires knowledge. Learn more about digital software signature verification.

The most important check is confirming the key fingerprint exactly matches the output below. [13]

Key fingerprint = DBA3 6B51 81D0 C816 F630 E889 D980 A174 57F6 FB06

Ambox warning pn.svg.png Warning:

Do not continue if the fingerprint does not match -- this risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

Copy the signing key to the APT keyring folder. [14] 

sudo cp keys.asc /usr/share/keyrings/signal-desktop-keyring.asc

2. Add the Signal third-party APT repository. [15] [16] [17] 

echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.asc] tor+https://updates.signal.org/desktop/apt xenial main' | sudo tee /etc/apt/sources.list.d/signal-xenial.list

3. Install Signal.

Install signal-desktop.

1. Update the package lists. 

sudo apt-get update

2. Upgrade the system. 

sudo apt-get dist-upgrade

3. Install the signal-desktop package.

Using apt-get command line parameter --no-install-recommends is in most cases optional. 

sudo apt-get install --no-install-recommends signal-desktop

The procedure of installing signal-desktop is complete.

4. Done.

The process of installing Signal is complete.

5. Note.

  • Non-Qubes-Whonix ™: No extra steps required.
  • Qubes-Whonix ™: Shutdown whonix-ws-16 Template. Restart Whonix-Workstation ™ (anon-whonix).

Start Signal[edit]

Inside Whonix-Workstation ™ (anon-whonix).

To launch Signal, run. 

signal-desktop

Figure: Signal Desktop in Whonix ™

Signaldesktop.png

Claims That Signal Encryption Is Broken[edit]

Cellebrite [archive] formerly claimed [archive] they were able to decrypt Signal encryption. However, the article details were later removed [archive] because it was debunked by Moxie Marlinspike [archive] (co-founder and currently CEO of Signal Messenger) , Edward Snowden [archive], and Filippo Valsorda [archive]. Signal also officially [archive] responded to this false claim.

Note: cryptographer Bruce Schneier wrote an article about this issue in his blog entitled "Cellebrite Can Break Signal", but he later apologized [archive] for his erroneous post.

See Also[edit]

Footnotes[edit]

  1. ↑ https://en.wikipedia.org/wiki/Signal_%28software%29 [archive]
  2. ↑ For additional Signal features, see: Wikipedia: Signal (software) - Features [archive]
  3. ↑ Signal blog [archive]:

    By design, Signal does not have a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars. The end-to-end encrypted contents of every message and voice/video call are protected by keys that are entirely inaccessible to us. In most cases now we don’t even have access to who is messaging whom.

  4. ↑ The number can be different form the device's SIM card; it can be a landline or VOIP number, so long as the user can receive the verification code and possesses a separate device to set up the software.
  5. ↑ Also see: Installing Signal [archive].
  6. ↑ Common advice is to not mix repositories from related distributions like Ubuntu and Debian, since this can cause system instability.
  7. ↑ https://www.signal.org/blog/standalone-signal-desktop/ [archive]
  8. ↑ https://github.com/signalapp/Signal-Desktop/releases/tag/v1.35.1 [archive]
  9. ↑ https://github.com/freedomofpress/ansible-role-signal-desktop [archive]
  10. ↑ Using Qubes UpdatesProxy (--proxy http://127.0.0.1:8082/ [archive]) because Qubes Templates are non-networked by Qubes default and therefore require UpdatesProxy for connectivity. (APT in Qubes Templates is configured to use UpdatesProxy by Qubes default.)
  11. ↑ Even more secure would be to download the key Disposable and then qvm-copy [archive] it to the Qubes Template because this would avoid curl's attack surface but this would also result in even more complicated instructions.
  12. ↑ Even more secure would be to display the key in another Disposable because this would protect the Template from curl's and gpg's attack surface but this would also result in even more complicated instructions.
  13. ↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
  14. ↑ https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302 [archive]
  15. ↑ https://signal.org/download [archive]
  16. ↑ https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302 [archive]
  17. ↑ See this for a comment why tor+ is useful even inside Whonix ™.
Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: Discourse logo.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

Have you read our Documentation, Design and Developer Portal links yet?

https link onion link Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Retrieved from "https://www.whonix.org/w/index.php?title=Signal&oldid=69108"
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.
More information