The protocol may be in good shape, but Signal's permission model is flawed for an application that handles sensitive data.
A few examples of excessive permissions:
* Disable your screen lock
* Location permissions
* Set wallpaper ("kitchen sink" feature here)
* External storage (why not use internal "app only" storage?)
* System log data
Android's sandbox will do its best to protect the user from compromised applications, but it can't do anything to protect you if the application already has full permissions. Based on recent events, I would assume that Signal users are at risk of targeting as a block -- their desire for privacy makes them interesting targets from an intelligence and LEO perspective.
Many successful applications follow a plugin model, where intrusive permissions are split off into separate, optional applications. Signal should do the same.
A few examples of excessive permissions:
* Disable your screen lock
* Location permissions
* Set wallpaper ("kitchen sink" feature here)
* External storage (why not use internal "app only" storage?)
* System log data
Android's sandbox will do its best to protect the user from compromised applications, but it can't do anything to protect you if the application already has full permissions. Based on recent events, I would assume that Signal users are at risk of targeting as a block -- their desire for privacy makes them interesting targets from an intelligence and LEO perspective.
Many successful applications follow a plugin model, where intrusive permissions are split off into separate, optional applications. Signal should do the same.