Signal to Ottawa: We'll Leave Canada Before We Help You Spy on Users
cross-posted from: https://piefed.ca/c/canada/p/727265/signal-to-ottawa-we-ll-leave-canada-before-we-help-you-spy-on-users
Signal is drawing a hard line on the federal government’s proposed surveillance legislation: comply with Bill C-22 or leave the country. The secure messaging app says it would rather ditch the Canadian market than be forced to weaken the privacy protections it has built its reputation on. In an interview with The Globe and Mail
https://www.iphoneincanada.ca/2026/05/14/signal-to-ottawa-well-leave-canada-before-we-help-you-spy-on-users/Open linkView original on lemmy.ca525
Comments48
so THAT'S why they are clamping down on installing apps from outside the play store.
If they left the Canadian market, what’s preventing Canadians from still using it?
The Canada-region app stores like Apple or Android would be unwilling to let you download the app if the law passes. So without sideloading, it just wouldn’t be accessible.
And by side loading you mean installing software on a device you own, like PCs have been forever. Side loading is a 100% bullshit term created by Apple and Google to try and make sure you don't think you actually own your devices
Ok, I'm on board. So like what do we call installing an app outside of a store?
Installing a downloaded application.
Installing for short
Installing an apk, installing directly, ...
As opposed to installing from Fdroid, from gplay, ...
You can also go by source, like with the stores. For example Signal android can be installed from their website (by downloading an apk).
That’s factually not true though. Side loading was a term used before Google was even a company and before devices had internet access or peripherals/accessories to directly connect media other than plugging into your computer. Before devices had internet and you had to plug them into your computer to transfer files and install non-stock software. They would just say unauthorized or unofficial software if side loading wasn’t a term. It’s not like they need that term to exist for their shit behavior.
It's not sideloading.
we called it installing in our days
installing and Installing^TM^ have become different things and the people who grew up on mobile devices never installed anything but they did Install^TM^ plenty.
Am I the only one who has app store accounts for multiple regions?
But actually, if this happens (and it won’t, at least this time), the next bill to go through would have to be for the right to sideload. Because all of the politicians use Signal and would need a way to install it.
Any reason Signal couldn't offer a web app client?
cuz they dont store msgs on a server. feature, not a bug
Web browsers have a local storage API.
Signal mentioned that their apps were best for security and a web browser had too many vulnerabilities that they couldn't guarantee.
They prefer to manage their own apps - a signal desktop app being one of them.
i'll never cease to be amazed how much sideloading has become synonymous with obscurity at best and app-death at the worst.
Or people could just install it from fdroid.
Oh wait, signal isn't FOSS so it isn't allowed on fdroid.
Molly is on fdroid I believe
Yep and Molly is even better :)
Not the official repo...because they couldn't meet it's acceptance criteria. Which is a red flag
I think it used to, but unfortunely Molly is not on Fdroid's repo. You can download it from the app, but you'd need to add Molly's repo
https://github.com/signalapp/Signal-Android AGPL
Lol no.
Download the apk. It includes that AGPL and also non free blobs. Just because part of if is Foss does not make if foss
Nothing to laugh at here in my view. It is FOSS. The reason it isn’t on there is sort of procedural. You could easily build signal from source, but signal prefers only their builds connect to their servers. They of course can’t enforce this but fdroid is happy to do so.
I get it from FDroid via the Guardian repo. No issues.
Security issues. guardian repo has no acceptances criteria. Closed source blobs? Allowed.
what about Molly, then?
Molly is Foss, but it's not on fdroid for likely other sketchy reasons
Its on Accrescent though
You can import the repo into F-Droid.
...and make yourself less secure, sure
Well unless they want to add verified APKs of all the apps I do use to their app store, their frowning is useless because every graphene user basically needs f-droid as it stands now.
And we frown upon grapheneOS because of numerous human concerns
I think they can use the VPN to get access to it. It’s a way to make sure governments doesn’t exert too much pressure to give up data!
True, until VPNs are also banned (like some US states are doing). One anti-privacy law passed will bring up another, then another, then another.
This is one of the things that bugs me.
If you're in Country A, with all your operations in Country A, and what you do is legal in Country A, why should you give a single fuck about Country B's laws?
Seems to me the appropriate answer is basically to do what The Pirate Bay did with DMCA notices- respond that your laws don't apply to us as we have nothing to do with your country, and if your citizens use our software that's between you and them. It's not our job to enforce your laws on your citizens.
OpenKeychain has an implementation like this (not 100%) maybe that fits your use case?
https://www.openkeychain.org/
Look up oversec.io
It basically uses android accessibility features to both encrypt and decrypt messages.
I couldnt find the source code. is it foss?
https://github.com/oversecio/oversec
It was last updated 7 years ago.
So it's open source but outdated.
It is a bit tedious but works: https://fdroid.gitlab.io/jekyll-fdroid/packages/com.amnesica.kryptey/
Edit: Just saw that the last update was 3 years ago, just keep that in mind. I think for some situations it is still useful and can be used, as the encryption and key-exchange seems to be solid.
Pretty sure I read stories in the past of Google or someone like them banning people who were sending pre encrypted messages over one of their chat services.
A computer was anyway. These services arent necessarily reading our messages personally, but the algorithms parse them for ad placements or whatever, and it probably got flagged as being unreadable.
Edit: Some services that arent intending to be secure chat might not like the idea of encrypted content on their system either. What is it? What are they now harboring which wasn't their intent at all? Like if you made a lemmy community and only had encrypted messages on it, a mod from the server might have something to say about it.
They still ban you now and then, if you encrypyt to their drive.
Oversec is like that, but IIRC it doesn't work correctly on the latest versions of android
Legislators who try to make such laws should be summarily executed.