Changes

Page history
signal-cli-v0.13.5 on Tails 6.6 authored by about:privacy's avatar about:privacy
Hide whitespace changes
Inline Side-by-side
Signal/Registration-and-Provisioning-via-signal-cli.md
View page @ 98ef3f11
_This guide has been tested with Tails OS versions **6.2** and **signal-cli-v0.13.3**_ _This guide has been tested with Tails OS versions **6.6** and **signal-cli-v0.13.5**_
**Notes**: **Notes**:
* Many steps happen in the _Terminal_. To paste content in the terminal, either right-click in the terminal and choose Paste, or use CTRL-SHIFT-V (not CTRL-V). * Many steps happen in the _Terminal_. To paste content in the terminal, either right-click in the terminal and choose Paste, or use CTRL-SHIFT-V (not CTRL-V).
* **Do NOT use the _Root Terminal_** or instructions won't work! * **Do NOT use the _Root Terminal_** or instructions won't work!
* A working **internet connection is required** at every step of the howto. * A working **internet connection is required** at every step of the howto.
## Persistent Storage ## Persistent Storage
1. Make sure you are using an up to date Tails OS, check out https://tails.boum.org/doc/upgrade/. 1. Make sure you are using an up to date Tails OS, check out https://tails.boum.org/doc/upgrade/.
2. Create persistent storage, follow the steps on https://tails.boum.org/doc/persistent_storage/create/, skip to step 2 if you already have a persistent storage 2. Create persistent storage, follow the steps on https://tails.boum.org/doc/persistent_storage/create/, skip to step 2 if you already have a persistent storage
3. Configure persistent storage with [_Additonal software_](https://tails.boum.org/doc/persistent_storage/configure/#index12h2) enabled and features according to your other needs (mail, pgp, additional software) follow the steps on https://tails.boum.org/doc/persistent_storage/configure/, skip to [Install signal-cli](#install-signal-cli) if you already have configured your persistent storage with _additional software_ enabled. 3. Configure persistent storage with [_Additonal software_](https://tails.boum.org/doc/persistent_storage/configure/#index12h2) enabled and features according to your other needs (mail, pgp, additional software) follow the steps on https://tails.boum.org/doc/persistent_storage/configure/, skip to [Install signal-cli](#install-signal-cli) if you already have configured your persistent storage with _additional software_ enabled.
4. (Re)start your Tails and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/ and encrypt your Persistent on the start Screen. 4. (Re)start your Tails and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/ and encrypt your Persistent on the start Screen.
5. Choose Applications ▸ System Tools ▸ Terminal and use the password set in step 4. 5. Choose Applications ▸ System Tools ▸ Terminal and use the password set in step 4.
6. In order to keep [signal-cli's storage](https://github.com/AsamK/signal-cli#storage) persistent, execute: 6. In order to keep [signal-cli's storage](https://github.com/AsamK/signal-cli#storage) persistent, execute:
```plaintext ```plaintext
sudo sed -i '$ a /home/amnesia/.local/share/signal-cli/ source=signal-cli' /live/persistence/TailsData_unlocked/persistence.conf sudo sed -i '$ a /home/amnesia/.local/share/signal-cli/ source=signal-cli' /live/persistence/TailsData_unlocked/persistence.conf
``` ```
7. Shutdown Tails. 7. Shutdown Tails.
<!-- ## ~~Configuring additional APT repositories for signal-cli~~ <!-- ## ~~Configuring additional APT repositories for signal-cli~~
<details> <details>
<summary> <summary>
~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~ ~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~
</summary> </summary>
1. ~~Start your Tails unlocking your persistent storage and setup an administration password, follow section *Set up an administration password\* at <span dir="">\~\~\~\~</span>\~\~\~\~~~~~https://tails.boum.org/doc/first_steps/welcome_screen/administration_password~~ 1. ~~Start your Tails unlocking your persistent storage and setup an administration password, follow section *Set up an administration password\* at <span dir="">\~\~\~\~</span>\~\~\~\~~~~~https://tails.boum.org/doc/first_steps/welcome_screen/administration_password~~
2. ~~Choose Applications ▸ System Tools ▸ Root Terminal use the password set in step 1.~~ 2. ~~Choose Applications ▸ System Tools ▸ Root Terminal use the password set in step 1.~~
3. ~~Create an apt-sources.list.d folder in your Persistent Storage:~~ 3. ~~Create an apt-sources.list.d folder in your Persistent Storage:~~
```plaintext ```plaintext
install -d -m 755 /live/persistence/TailsData_unlocked/apt-sources.list.d install -d -m 755 /live/persistence/TailsData_unlocked/apt-sources.list.d
``` ```
5. ~~We need to make the `apt-sources.list.d` folder persistent, by executing:~~ 5. ~~We need to make the `apt-sources.list.d` folder persistent, by executing:~~
```plaintext ```plaintext
sed -i '$ a /etc/apt/sources.list.d source=apt-sources.list.d,link' /live/persistence/TailsData_unlocked/persistence.conf sed -i '$ a /etc/apt/sources.list.d source=apt-sources.list.d,link' /live/persistence/TailsData_unlocked/persistence.conf
``` ```
6. ~~Now we add the ~~[~~signal-cli debian repository~~](https://packaging.gitlab.io/signal-cli/installation/standalone/#repository)~~ to a new file `/live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list` and set correct file ownership and permissions:~~ 6. ~~Now we add the ~~[~~signal-cli debian repository~~](https://packaging.gitlab.io/signal-cli/installation/standalone/#repository)~~ to a new file `/live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list` and set correct file ownership and permissions:~~
```plaintext ```plaintext
echo -e 'deb tor+https://packaging.gitlab.io/signal-cli signalcli main' | tee -a /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list && chown root:root /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list && chmod 644 /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list echo -e 'deb tor+https://packaging.gitlab.io/signal-cli signalcli main' | tee -a /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list && chown root:root /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list && chmod 644 /live/persistence/TailsData_unlocked/apt-sources.list.d/morph027-signal-cli.list
``` ```
7. ~~We need to download and add the signal-cli's repo signing key to apt:~~ 7. ~~We need to download and add the signal-cli's repo signing key to apt:~~
```plaintext ```plaintext
torify wget --retry-connrefused -O /home/amnesia/Persistent/morph027-signal-cli.asc https://packaging.gitlab.io/signal-cli/gpg.key && chown amnesia:amnesia /home/amnesia/Persistent/morph027-signal-cli.asc && cp /home/amnesia/Persistent/morph027-signal-cli.asc /etc/apt/trusted.gpg.d/ torify wget --retry-connrefused -O /home/amnesia/Persistent/morph027-signal-cli.asc https://packaging.gitlab.io/signal-cli/gpg.key && chown amnesia:amnesia /home/amnesia/Persistent/morph027-signal-cli.asc && cp /home/amnesia/Persistent/morph027-signal-cli.asc /etc/apt/trusted.gpg.d/
``` ```
8. ~~Create a script for adding the signing key to apt, this needs to be done due to ~~[~~Tails not allowing to add Keys of 3rd party repos~~](https://gitlab.tails.boum.org/tails/tails/-/issues/17510)~~:~~ 8. ~~Create a script for adding the signing key to apt, this needs to be done due to ~~[~~Tails not allowing to add Keys of 3rd party repos~~](https://gitlab.tails.boum.org/tails/tails/-/issues/17510)~~:~~
```plaintext ```plaintext
echo -e '#/bin/sh\nsudo cp /home/amnesia/Persistent/morph027-signal-cli.asc /etc/apt/trusted.gpg.d/' | tee -a /home/amnesia/Persistent/apt-keys.sh && chown amnesia:amnesia /home/amnesia/Persistent/apt-keys.sh && chmod +x /home/amnesia/Persistent/apt-keys.sh echo -e '#/bin/sh\nsudo cp /home/amnesia/Persistent/morph027-signal-cli.asc /etc/apt/trusted.gpg.d/' | tee -a /home/amnesia/Persistent/apt-keys.sh && chown amnesia:amnesia /home/amnesia/Persistent/apt-keys.sh && chmod +x /home/amnesia/Persistent/apt-keys.sh
``` ```
9. ~~Shutdown Tails.~~ 9. ~~Shutdown Tails.~~
</details>--> </details>-->
## Install signal-cli ## Install signal-cli
**WARNING: In this section of the guide this is explained for signal-cli-0.13.3 released April 19th, 2024. This version might become outdated if this guide is not updated regularly. Strongly recommended to use [latest signal-cli release](https://github.com/AsamK/signal-cli/releases/latest)** **WARNING: In this section of the guide this is explained for signal-cli-0.13.5 released July 25th, 2024. This version might become outdated if this guide is not updated regularly. Strongly recommended to use [latest signal-cli release](https://github.com/AsamK/signal-cli/releases/latest)**
1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/. 1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/.
2. Choose Applications ▸ System Tools ▸ Terminal 2. Choose Applications ▸ System Tools ▸ Terminal
<!--<details> <!--<details>
<summary> <summary>
~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~ ~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~
</summary> </summary>
3\. <span dir="">\~\~</span>Run the script for adding signal-cli signing keys to apt:<span dir="">\~\~</span> 3\. <span dir="">\~\~</span>Run the script for adding signal-cli signing keys to apt:<span dir="">\~\~</span>
```plaintext ```plaintext
Persistent/apt-keys.sh Persistent/apt-keys.sh
``` ```
3. _~~Wait until additional software has been installed successfully~~_ 3. _~~Wait until additional software has been installed successfully~~_
</details>--> </details>-->
3. Update repositories and install `ca-certificates-java` and `openjdk-21` executing 3. Update repositories and install `ca-certificates-java` and `openjdk-21` executing
```plaintext ```plaintext
sudo apt-get update && sudo apt-get install ca-certificates-java && wget https://download.oracle.com/java/21/latest/jdk-21_linux-x64_bin.deb -P /home/amnesia/Persistent/ && sudo dpkg -i /home/amnesia/Persistent/jdk-21_linux-x64_bin.deb sudo apt-get update && sudo apt-get install ca-certificates-java && wget https://download.oracle.com/java/21/latest/jdk-21_linux-x64_bin.deb -P /home/amnesia/Persistent/ && sudo dpkg -i /home/amnesia/Persistent/jdk-21_linux-x64_bin.deb
``` ```
<!--<details> <!--<details>
<summary> <summary>
~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~ ~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~
</summary> </summary>
5. Install `signal-cli-jre` executing 5. Install `signal-cli-jre` executing
```plaintext ```plaintext
sudo apt-get install signal-cli-jre sudo apt-get install signal-cli-jre
``` ```
6. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2 6. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2
7. If more than one signal-cli-* is installed, we need to update-alternatives for signal-cli to run signal-cli-jre executing 7. If more than one signal-cli-* is installed, we need to update-alternatives for signal-cli to run signal-cli-jre executing
```plaintext ```plaintext
sudo update-alternatives --install /usr/bin/signal-cli signal-cli /usr/bin/signal-cli-jre 0 sudo update-alternatives --install /usr/bin/signal-cli signal-cli /usr/bin/signal-cli-jre 0
``` ```
</details>--> </details>-->
4. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2 4. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2
5. Download `signal-cli-0.13.3` and signature file, executing: 5. Download `signal-cli-0.13.5` and signature file, executing:
```plaintext ```plaintext
wget https://github.com/AsamK/signal-cli/releases/download/v0.13.3/signal-cli-0.13.3.tar.gz -P /home/amnesia/Persistent/ && wget https://github.com/AsamK/signal-cli/releases/download/v0.13.3/signal-cli-0.13.3.tar.gz.asc -P /home/amnesia/Persistent/ wget https://github.com/AsamK/signal-cli/releases/download/v0.13.5/signal-cli-0.13.5.tar.gz -P /home/amnesia/Persistent/ && wget https://github.com/AsamK/signal-cli/releases/download/v0.13.5/signal-cli-0.13.5.tar.gz.asc -P /home/amnesia/Persistent/
``` ```
6. As announced per https://github.com/AsamK/signal-cli/issues/65 repos owners PGP fingerprint is `FA10826A74907F9EC6BBB7FC2BA2CD21B5B09570` and the key id is `2BA2CD21B5B09570`. Download the pgp public key file from mentioned pgp key server: 6. As announced per https://github.com/AsamK/signal-cli/issues/65 repos owners PGP fingerprint is `FA10826A74907F9EC6BBB7FC2BA2CD21B5B09570` and the key id is `2BA2CD21B5B09570`. Download the pgp public key file from mentioned pgp key server:
```plaintext ```plaintext
torify -i gpg --keyserver pgp.mit.edu --recv-keys 0x2BA2CD21B5B09570 torify -i gpg --keyserver pgp.mit.edu --recv-keys 0x2BA2CD21B5B09570
``` ```
7. Verify the archive: 7. Verify the archive:
```plaintext ```plaintext
gpg --verify /home/amnesia/Persistent/signal-cli-0.13.3.tar.gz.asc /home/amnesia/Persistent/signal-cli-0.13.3.tar.gz gpg --verify /home/amnesia/Persistent/signal-cli-0.13.5.tar.gz.asc /home/amnesia/Persistent/signal-cli-0.13.5.tar.gz
``` ```
<!--**WARNING: It seems to be badly signed, looks likewise https://github.com/AsamK/signal-cli/issues/934**--> <!--**WARNING: It seems to be badly signed, looks likewise https://github.com/AsamK/signal-cli/issues/934**-->
8. Extract the archive: 8. Extract the archive:
```plaintext ```plaintext
tar xf signal-cli-0.13.3.tar.gz -C /home/amnesia/Persistent/ tar xf signal-cli-0.13.5.tar.gz -C /home/amnesia/Persistent/
``` ```
9. We create a script for running `signal-cli` 9. We create a script for running `signal-cli`
<details> <details>
<summary> <summary>
Further details Further details
</summary>We need to tell jre to use torsocks' SOCKS proxy and add the signal-cli directory to the path script for running `signal-cli`. Also we need to add libsignal_jni.so to the Java library path </summary>We need to tell jre to use torsocks' SOCKS proxy and add the signal-cli directory to the path script for running `signal-cli`. Also we need to add libsignal_jni.so to the Java library path
</details> </details>
```plaintext ```plaintext
echo -e '#!/bin/sh\nsudo dpkg -i jdk-21_linux-x64_bin.deb\nexport JAVA_TOOL_OPTIONS="-Djava.net.preferIPv4Stack=true"\nexport PATH="/home/amnesia/Persistent/signal-cli-0.13.3/bin:$PATH"\ntorsocks --shell' | tee -a /home/amnesia/Persistent/signal-cli_tor.sh && chmod a+x /home/amnesia/Persistent/signal-cli_tor.sh echo -e '#!/bin/sh\nsudo dpkg -i jdk-21_linux-x64_bin.deb\nexport JAVA_TOOL_OPTIONS="-Djava.net.preferIPv4Stack=true"\nexport PATH="/home/amnesia/Persistent/signal-cli-0.13.5/bin:$PATH"\ntorsocks --shell' | tee -a /home/amnesia/Persistent/signal-cli_tor.sh && chmod a+x /home/amnesia/Persistent/signal-cli_tor.sh
``` ```
## General use of `signal-cli` on Tails ## General use of `signal-cli` on Tails
**(aka steps required every time you want to use `signal-cli`)** **(aka steps required every time you want to use `signal-cli`)**
1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/. 1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/.
2. Choose Applications ▸ System Tools ▸ Terminal 2. Choose Applications ▸ System Tools ▸ Terminal
<!--<details> <!--<details>
<summary> <summary>
~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~ ~~DEPRECEATED due to signal-cli >= v.0.11.11 requires libc6 <= 2.34~~
</summary> </summary>
3. Run the script for adding signal-cli signing keys to apt: 3. Run the script for adding signal-cli signing keys to apt:
```plaintext ```plaintext
Persistent/apt-keys.sh Persistent/apt-keys.sh
``` ```
and _Wait until additional software has been installed successfully_ and _Wait until additional software has been installed successfully_
</details>--> </details>-->
<!--5. signal-cli-jre requires at least Java Runtime Environment (JRE) 17.--> <!--5. signal-cli-jre requires at least Java Runtime Environment (JRE) 17.-->
4. Start executing the signal-cli script we created in the previous section: 4. Start executing the signal-cli script we created in the previous section:
```plaintext ```plaintext
Persistent/signal-cli_tor.sh Persistent/signal-cli_tor.sh
``` ```
6. Now you can run any `signal-cli` command, refer to [man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli.1.adoc) for help. 6. Now you can run any `signal-cli` command, refer to [man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli.1.adoc) for help.
**Replace $PHONE_NR with your phone number using the international format (e. g. +15758941234 for a number registered in Truth or consequences, New Mexico)** **Replace $PHONE_NR with your phone number using the international format (e. g. +15758941234 for a number registered in Truth or consequences, New Mexico)**
_Tip: If you want to acquire an anonymous phone number for registering signal, one can do so using free temporary phone numbers for receiving text messages online. For example _**_https://quackr.io/_**_ is quite reliable service if you choose numbers of so-called "Western countries". Please note, that everyone can re-register your phone number with signal, revoking your access to your newly acquired number. Therefore _[_set a registration lock PIN_](#Registration-and-registration-lock-pin)_ immediately after successful verification. Receive/send messages **at least once every 7 days** in order to keep your number. _[**_Signal is changing the re-registration condition's forth and back_**](https://blog.privacyguides.org/2022/11/10/signal-number-registration-update/)_**, so this method might not work for keeping an anonymous phone number forever._**_ This is the reason why many of the freely available numbers can not be registered with signal w/o PIN, 'cause they already have been registered by someone else who subsequently set a registration lock pin. Be patient and keep trying either lately or old added numbers should do the trick._ _Tip: If you want to acquire an anonymous phone number for registering signal, one can do so using free temporary phone numbers for receiving text messages online. For example _**_https://quackr.io/_**_ is quite reliable service if you choose numbers of so-called "Western countries". Please note, that everyone can re-register your phone number with signal, revoking your access to your newly acquired number. Therefore _[_set a registration lock PIN_](#Registration-and-registration-lock-pin)_ immediately after successful verification. Receive/send messages **at least once every 7 days** in order to keep your number. _[**_Signal is changing the re-registration condition's forth and back_**](https://blog.privacyguides.org/2022/11/10/signal-number-registration-update/)_**, so this method might not work for keeping an anonymous phone number forever._**_ This is the reason why many of the freely available numbers can not be registered with signal w/o PIN, 'cause they already have been registered by someone else who subsequently set a registration lock pin. Be patient and keep trying either lately or old added numbers should do the trick._
## Registration and registration lock pin ## Registration and registration lock pin
1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails) 1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails)
2. Follow the steps on https://github.com/AsamK/signal-cli/wiki/Registration-with-captcha 2. Follow the steps on https://github.com/AsamK/signal-cli/wiki/Registration-with-captcha
3. You should set a registration lock pin, to prevent others from registering this number: 3. You should set a registration lock pin, to prevent others from registering this number:
```plaintext ```plaintext
signal-cli -a $PHONE_NR setPin "verysafepassword" signal-cli -a $PHONE_NR setPin "verysafepassword"
``` ```
_Tip: Use _[_KeepassXC preinstalled on tails_](https://tails.boum.org/doc/encryption_and_privacy/manage_passwords/)_ for generating and storing safe passwords._ _Tip: Use _[_KeepassXC preinstalled on tails_](https://tails.boum.org/doc/encryption_and_privacy/manage_passwords/)_ for generating and storing safe passwords._
### Additional Tips: ### Additional Tips:
- If you want to register a number which is only able to receive phone calls, add the `--voice` parameter to the register command: - If you want to register a number which is only able to receive phone calls, add the `--voice` parameter to the register command:
```plaintext ```plaintext
signal-cli -a $PHONE_NR register --voice --captcha "signalcaptcha://signal-recaptcha-v2.someshortercode.registration.someverylongcode" signal-cli -a $PHONE_NR register --voice --captcha "signalcaptcha://signal-recaptcha-v2.someshortercode.registration.someverylongcode"
``` ```
- If the number was registered before and locked with a pin, use the `--pin` parameter during `verify` command: - If the number was registered before and locked with a pin, use the `--pin` parameter during `verify` command:
```plaintext ```plaintext
signal-cli -a $PHONE_NR verify --pin "yourPIN" 123456 signal-cli -a $PHONE_NR verify --pin "yourPIN" 123456
``` ```
## Provisioning Signal-Desktop & hardening ## Provisioning Signal-Desktop & hardening
(aka coupling signal-cli with Signal Desktop) (aka coupling signal-cli with Signal Desktop)
1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/. 1. Start your Tails unlocking your persistent storage and setup an administration password, follow section _Set up an administration password_ at https://tails.boum.org/doc/first_steps/welcome_screen/administration_password/.
2. _Wait until additional software has been installed successfully_ 2. _Wait until additional software has been installed successfully_
3. Choose Applications ▸ System Tools ▸ Terminal 3. Choose Applications ▸ System Tools ▸ Terminal
4. In order to read the qrcode, we need the package `zbar-tools`, execute 4. In order to read the qrcode, we need the package `zbar-tools`, execute
```plaintext ```plaintext
sudo apt-get update && sudo apt-get install zbar-tools sudo apt-get update && sudo apt-get install zbar-tools
``` ```
4. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2 4. Make the installation persistent (_Install every time_) following step 3. at https://tails.boum.org/doc/persistent_storage/additional_software/#index4h2
5. Start Signal Desktop: Go to [Activities Overview](https://tails.boum.org/doc/first_steps/desktop/index.en.html#activities), type `Signal` and click the icon to start. 5. Start Signal Desktop: Go to [Activities Overview](https://tails.boum.org/doc/first_steps/desktop/index.en.html#activities), type `Signal` and click the icon to start.
6. [Make a screenshot](https://tails.boum.org/doc/sensitive_documents/screenshot_and_screencast/index.en.html) capturing the Signal Desktop window showing the qr-code and safe the picture in `/home/amnesia/Pictures/qr.png` 6. [Make a screenshot](https://tails.boum.org/doc/sensitive_documents/screenshot_and_screencast/index.en.html) capturing the Signal Desktop window showing the qr-code and safe the picture in `/home/amnesia/Pictures/qr.png`
7. Open a new Terminal tab (top left + icon) or window (top right burger menu) 7. Open a new Terminal tab (top left + icon) or window (top right burger menu)
8. Get the qr-code link executing 8. Get the qr-code link executing
```plaintext ```plaintext
zbarimg /home/amnesia/Pictures/qr.png zbarimg /home/amnesia/Pictures/qr.png
``` ```
6. Copy the qr decoded link (`sgnl://…`) to the clipboard. 6. Copy the qr decoded link (`sgnl://…`) to the clipboard.
7. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails) 7. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails)
8. Add your Signal Desktop to signal-cli with the qr code link from step 6 (`sgnl://…`), executing 8. Add your Signal Desktop to signal-cli with the qr code link from step 6 (`sgnl://…`), executing
```plaintext ```plaintext
signal-cli -a $PHONE_NR addDevice --uri "sgnl://…" signal-cli -a $PHONE_NR addDevice --uri "sgnl://…"
``` ```
8. Signal-Desktop should ask you to name the device (internal designation) 8. Signal-Desktop should ask you to name the device (internal designation)
9. If everything was successful, Signal Desktop should be ready to use. You can obtain a list of devices using your registered signal no. executing: 9. If everything was successful, Signal Desktop should be ready to use. You can obtain a list of devices using your registered signal no. executing:
```plaintext ```plaintext
signal-cli -a $PHONE_NR listDevices signal-cli -a $PHONE_NR listDevices
``` ```
It should list your Signal Desktop with the name you set in step 8. among the master (signal-cli). It should list your Signal Desktop with the name you set in step 8. among the master (signal-cli).
### Hardening ### Hardening
Use Settings to enable/disable features such as link preview, incoming calls etc. Recommended settings in terms of privacy are: Use Settings to enable/disable features such as link preview, incoming calls etc. Recommended settings in terms of privacy are:
- Grant access to microphone only if using voice messages or voice calling. - Grant access to microphone only if using voice messages or voice calling.
- Grant access to camera only if using video calling. - Grant access to camera only if using video calling.
- Disable link preview.<sup>*</sup> - Disable link preview.<sup>*</sup>
- Activate incoming calls only if you want to make Signal calls. - Activate incoming calls only if you want to make Signal calls.
- Set calls to indirect. - Set calls to indirect.
- Disable read receipts.<sup>*</sup> - Disable read receipts.<sup>*</sup>
- Disable typing indicators<sup>*</sup> - Disable typing indicators<sup>*</sup>
- Set a value for default disappearing messages - Set a value for default disappearing messages
*These configurations can also be set using `signal-cli` (useful if you prefer a TUI like [scli](https://github.com/isamert/scli/) over a GUI like Signal Desktop): *These configurations can also be set using `signal-cli` (useful if you prefer a TUI like [scli](https://github.com/isamert/scli/) over a GUI like Signal Desktop):
1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails) 1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails)
2. Execute: 2. Execute:
```plaintext ```plaintext
signal-cli -a $PHONE_NR updateConfiguration --read-receipts false --unidentified-delivery-indicators true --typing-indicators false --link-previews false signal-cli -a $PHONE_NR updateConfiguration --read-receipts false --unidentified-delivery-indicators true --typing-indicators false --link-previews false
``` ```
## Every now and then: Receiving messages with signal-cli ## Every now and then: Receiving messages with signal-cli
Every now and then you should also receive events with your signal-cli, so they are purged from the Signal servers: Every now and then you should also receive events with your signal-cli, so they are purged from the Signal servers:
1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails) 1. Follow steps 1 through 4 at section [General use of signal-cli on Tails](#General-use-of-signal-cli-on-Tails)
2. Receive events executing: 2. Receive events executing:
```plaintext ```plaintext
signal-cli -a $PHONE_NR receive signal-cli -a $PHONE_NR receive
``` ```