search

mollyim / mollyim-android

Enhanced and security-focused fork of Signal.
GNU Affero General Public License v3.0
1.5k stars 85 forks source link

Call recording #161

Open CodeCracker-oss opened 1 year ago

CodeCracker-oss commented 1 year ago

Hello,

Would you consider adding a feature to record all incoming/outgoing calls the moment the call is established?

This would avoid having a 3rd party app do this. The only one I know of that is capable of recording signal calls is ACR Cube recorder, but its proprietary, has unneccesary permissions, and ads/trackers which could comprimise the security of signal.

Thank you

Ryuo1 commented 1 year ago

It's funny how you think a proprietary call recording app could compromise the security of Signal when recording a call. Because, it completely throws away the point of call encryption in Signal when you are recording a call from it

CodeCracker-oss commented 1 year ago

@ryu0q As long as my device is secure, no one would be able to view recording anyway. It could also utilize pgp encryption during VOIP call recording for extra security.

With standard phone call recording, the keys to encrypt call are handled by cell provider so they could listen in if they wish, unlike signal. So, depending on your attack vector it wouldn't hurt security.

For me personally, when I make a call where I have to exhange personal info like an SSN for verification at my bank, I will encrypt the recording afterwards or shred it if I don't need it.

valldrac commented 1 year ago

Would you consider adding a feature to record all incoming/outgoing calls the moment the call is established?

To get a better idea of the use case... Should the app notify the call participants, before the call begins, that the call is recorded?

Ryuo1 commented 1 year ago

Yeah. There should be a big text in red background saying that the call is being recorded. Considering if this ever turns into a feature.

CodeCracker-oss commented 1 year ago

@valldrac

To get a better idea of the use case... Should the app notify the call participants, before the call begins, that the call is recorded?

Maybe it would be nice to have that as an optional setting. Like for those in countries that are two party consent laws, then a caller wouldn't have to remember to inform the other of the recording.

As I am in the US, and well aware of the legality, this would not be neccessary and may just get annoying.

h3ph4est7s commented 1 year ago

This feature may look simple but i don't think it is. The java part of the app is handling only signaling and state changes as far as i see through the code. The actual audio - video data is handled by RingRTC. Any additions should add code there + new interface changes between native and java, plus ui additions to enable, disable, handle that feature this translates to multiple languages expertise (Java - Kotlin, c++ - rust) and a greater level of complexity - testing. In any case i would like to add on this that when a privacy invading feature is added a counterweight should be added also (please feel free to open another issue for this if needed) a good candidate for that can be this. With some research and the utilization of the pixel tensor processor, this can be integrated and provide a good anonymization layer to the user's voice to counter any recording effort especially from the moment that any notification can be reliably removed from any malicious party. The only thing left is the value of the recorded information but this is out of any technical scope and lies only on the user's discretion.

schklom commented 1 year ago

may just get annoying

@dhammel There are situations where this is counter-productive. This can be an opt-out option, but forcing this on everyone is very bad. If this is forced, I would rather use a third-party like ACR Cube Recorder.

CodeCracker-oss commented 1 year ago

@schklom I never mentioned to force anything on anyone, as i've even mentioned it should be optional. Wether its opt-in or opt-out doesn't matter to me personally.

Using something such as ACR is what could actually hurt security/privacy, since the app is proprietary, contains ads and trackers and who knows what else.

schklom commented 1 year ago

@dhammel I must have misread then, my bad. I prevent ACR from connecting to the Internet, so no privacy problems. I agree it is not ideal, but I cannot always use a recording method that always warns the other party.

CodeCracker-oss commented 1 year ago

@schklom I agree with you, sometimes warning the other party is not ideal or may interfere with reson for recording.

I never actually used ACR, I've used a hardware device plugged in via usb-c that records the mic and speakers internally when I know in advance I need to record from VOIP apps.