Joe-FastFeet But do I understand correctly that database encryption is no longer necessary on GrapheneOS?
Not only on GrapheneOS. Molly implemented the database encryption, because signal deprecated it's variant.
Joe-FastFeet as well as the fact that Molly never managed to pass the audit
Molly never did an audit. I don't know what you mean by "failed to pass the audit".
Joe-FastFeet Please remind me when Molly was last audited and what is the peer review of the audit?
Please tell me when signal was last audited. There is only an audit done for the protocol in 2019.
Joe-FastFeet By the way, the representative of Molly in this discussion has long said that he is preparing for the audit.
We would love to do an audit. Will you pay for it? Preferably at Cure53 or SRLab. It would cost around 20k. From our point of view, it only makes sense to do this audit once further features have been implemented. Our financial resources are very limited. We are barely able to keep the project alive.
Joe-FastFeet I read discussions in this chat that Molly has been preparing for an audit for a long time, but for some reason it has not yet passed. For me, this is the main disadvantage
Even an audit would not satisfy you, as it would only be a snapshot of the current situation.
Joe-FastFeet As early as Jun 13, 2022 in this chat there is a message for all participants in the discussion, about the upcoming important event - attestation - that has to take place, and about the event of which users will have to be notified. But until now, no one knows about any certification, or about its results. This is all that can be said today. But, I note that this event was presented by the author of the message as important and significant for the further work and development of Molly.
You seem to have completely misunderstood what this is about. “Attestation” is a planned feature based on https://attestation.app/.
Joe-FastFeet This is what we are talking about. How can Molly, a fork of Signal, be more reliable and secure than Signal if it hasn't been able to replicate a similar Signal feature for three years?
Signal doesn't have similar feature.
23Sha-ger You clearly underestimate some capabilities, even on GOS,
when you provide AFU password to the authorities.
Molly will add an extra layer. Because a fully unlocked device,
even with GOS, will give the adversary to fully extract all content.
Absolutely correct. On top it allows for a weak OS password and a strong database password for example. Also we don't know how long AFU is considered secure.