Signal on Android without Google Play Services
While Signal is open-source, the source code of the server used to make audio calls is not. That by itself is not a large issue aside from availability, since the server hosted by Open Whisper Systems is blocked in some countries. No, the real issue is that the server only accepts connections using Google Cloud Messaging, a function that is offered by the Google Play Services framework.
There are several reasons why people would refrain from installing and using the framework. One is privacy. Google's primary source of revenue is personal information. People who use Signal can be expected to value their privacy. Why else would anybody install it "if they have nothing to hide"? From a security perspective, the Google Play Services framework is closed-source and can update itself silently, without user confirmation. That should ring an alarm bell, since Google could cooperate with or be forced by governments to silently install a backdoor that would compromise the security of Signal (and any other processes running on the Android phone). From a functional perspective, there are Android devices which do not have Play Services or access to the Play Store.
In the famous words of Professor Hubert J. Farnsworth: good news, everyone! An open-source replacement for the Google Play Services framework has been released under the microG project. Also, a fork of Signal named LibreSignal has been released that can be installed through a third-party F-Droid repository.
Alas, the installation of all necessary components (all open-source, of course) is a tough road that cannot be followed by an average Android user. Users who are a bit more technically inclined can follow these instructions to install LibreSignal without Google Play Services.
- A smartphone with a recent version of Android. These instructions have been tested with Android 6.0.1, but hints will be given on how everything can be set up using older Android versions. iOS users should simply get Signal from the App Store. As for Windows Phone 8.1/Windows 10 Mobile users... you lose.
- A smartphone without Google Play Services. If you have access to the Play Store on your phone I advise that you swallow the blue pill and install Signal from the Play Store. This guide is not for you.
- A smartphone with root access.
- A smartphone with custom recovery which allows you to make backups, restore backups and install ZIP files that extend Android in a way that Android itself cannot do. Examples include TWRP and ClockworkMod Recovery.
- If the smartphone is not running OmniROM, the Xposed Framework must be downloaded. For Android versions between 4.0.3 to 4.4.4, download the APK here. For Android versions between 5.0 and 6.0.1, follow the instructions from this post. It requires you to download the attached APK file and a ZIP file that corresponds with your Android version and architecture.
- F-Droid's APK is required if it is not already installed.
Note that some of these instructions will require a file manager on your Android phone to manually install some APKs. If your phone does not come with a file manager, use your phone's browser to visit the F-Droid website to download and install F-Droid first. A file manager can then be installed through F-Droid. Alternatively, download the required files directly through your smartphone's browser.
Step 1: Make a backupSince some drastic changes will be made under the hood of the operating system in later steps, it is very important to first make a backup. Boot into recovery and make a backup of the Boot, System and Data partitions.
Step 2: Install the Xposed Framework and the FakeGApps moduleThis step is only required if you do not have OmniROM. OmniROM users should read this instead.
Xposed Framework is required to install a module that allows the phone to spoof the presence of Google Play Services. For Android 4.0.3 - 4.4.4, it is enough to simply install this APK and install the framework from within the application. Later Android versions require the user to manually install the framework through recovery in addition to a different APK file. Android 5.0 - 6.0.1 users should follow these instructions.
After the installation of the Xposed Framework, the application Xposed Installer should report that the framework has been installed. If it does, download in the application the FakeGApps module. Do not forget to enable the module! Reboot after the module is enabled.
Step 3: Install F-Droid and add required third-party repositoriesThe installation of F-Droid is only required if it is not installed yet. Use the previously downloaded F-Droid APK or visit the site on your phone to install it.
Now two repositories have to be added. Add the microG F-Droid Repository by using the smartphone's browser to visit this link (long press the link in Firefox). Alternatively, scan the first QR code on this page (for example using Barcode Scanner). Also visit the Eutopia.cz F-Droid Repository and add the repo URL by pressing it (long press in Firefox). Do not add the second (experimental) URL.
Step 4: Install and configure microG and necessary componentsOpen F-Droid and refresh the list of available packages. Search for 'microg'. Install microG Services Core, microG Services Framework Proxy and FakeStore (in that order).
Open the application microG Settings. Use the self-check. 'System spoofs signature' should be enabled, as well as all packages under 'Installed packages' (with correct signatures). It is not required to grant any of the permissions. Go back to the main menu of microG Settings and enable the option 'Enable device checkin'. After that, enable the option 'Enable Google Cloud Messaging'. Exit the application.
Step 5: Install and start LibreSignalOpen F-Droid again. Search and install LibreSignal. Run it after the installation. The application will ask for your phone number for verification. Enter it. You will receive a text message that will automatically be used by LibreSignal. After the registration you have the option to replace your standard SMS client with LibreSignal. You will not lose your text messages if you do so. Do not forget to replace the shortcut of your text message client on your home screen with LibreSignal for ease of access. Shortly after registration, LibreSignal will notify you which other users in your address book have (Libre)Signal installed. Happy chatting!
ConclusionIt is not easy to install (Libre)Signal without proprietary Google code, but it is possible. Let's hope that the developers at Open Whisper Systems get their act together.
- Add WebSocket support to the RedPhone Server (the audio call server). Your text message server already supports it. Supporting WebSocket allows others to fork Signal and add WebSocket support for both text messages and audio calls, and distribute it (under a different name, if you like) for those who cannot or do not want to use Google Play Store/Play Services. Such forks already exist, but they only support text messaging due to the exclusive use of Google Cloud Messaging by the RedPhone server.
- Add WebSocket support to the default Signal client as a fallback method if Google Cloud Messaging is unavailable, and offer Signal (signed) through an F-Droid repository of your own. This would prevent the need for a fork. There are privacy, security and functional aspects that require such a fork in order for all Android users to be able to use Signal in a secure way.
- Release the source code of the RedPhone server. This will allow others to verify the code and host their own instances for markets where the official Open Whisper Systems servers are unavailable. The code for the text message servers is already open-source. Do the same for the server that handles audio calls.
Comments are closed