4 ms·

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a c

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of shady Russian download sites could one day save the world?

soheil 11y ago
I'd doubt users of an encryption app not using a simple checksum to verify its legitimacy before using it.
- deleted 11y ago
  [deleted]
- pen2l 11y ago
  Probably not true. E.g., do you think the average user of Tor takes this precaution? Thinking back to the times I have downloaded Tor, I never did that. It reminds me of a time when I wanted to get in touch with an HN user... they had their pgp key in their user page... I tried sending the email but it didn't work (formatting issues). Finally I reached this user and asked what was up with it... and he responded by saying, "Oh, noone in the past 10 years has made use of this!" And this is a pretty smart security guy. I think there are very, very few people who actually take the trouble of verifying checksums and everything. I used to do it /sometimes/ years ago, but it gets to be a hassle pretty quickly and you start taking shortcuts everywhere. A lot of us sort of plan to start doing it, but never actually do it. Kind of like exercising or eating healthy or whatever. :) Anyway, as for this news about ISIS having their own encrypted chat app - I'm happy to hear it. If they made it on their own, it's bound to have a good dozen holes that NSA will have no trouble poking through. :)
  - marcosdumay 11y ago
    Well, differently from you and your friend, ISIS does have somebody out to get them. It's very hard to think someone would get to the trouble of creating and using a secure chat application, but then fail to secure its distribution.
    - pipeline_tux 11y ago
      As someone who works in infosec, this doesn't surprise me at all. I've tested many applications which claim to be secure, designed for security/privacy sensitive tasks, yet are very easy to compromise (simple OWASP top 10 stuff). Even if the app developers are great and know their stuff, I can still see them slipping up on the distribution. It's normally handled for most developers and is outside the realm of any secure development guidelines they might be following.
    - jevinskie 11y ago
      The submitted headline is just plain wrong. The article mentions no ISIS-produced messaging app, just a news app.
      - pen2l 11y ago
        This article talks about an ISIS chat app: http://techcrunch.com/2016/01/16/isis-app/ http://techcrunch.com/2016/01/16/isis-app/
    - EthanHeilman 11y ago
      Interestingly secure distribution is a harder problem than encrypted messaging. If both you and I have an shared app, then we have some shared data and protocols we can use to protect our communications and maintain security, but when you download an app you do not yet have any protection unless that protection is provided by an app store (and such app store protections disappear at the first court order). Bootstrapping security over insecure channels against nation state threats is close to impossible, maintaining security you have already achieved over a brief window of time is still hard but achieve given existing technologies. I see no evidence ISIS is capable of doing either. As further evidence observe that the US just blew up their super secret cash reserve.
- startling 11y ago
  Where would you get a checksum from? How would you know to trust it?
golergka 11y ago
But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?
- vonklaus 11y ago
  I am not pro survellience but, in my opinion, sort of surveiling terrorists using the official chat.ISIS distro is basically the narrow usecase where moderates find it acceptable. Obviously, the problem is that it is not being used this narrowly and that the power to do a global sweep is a negatively skewed power imbalance. That said, I wonder who Is going to fund the A round.
- krapp 11y ago
  I'm pretty sure subverting ISIS' crypto falls under the legitimate purview of state intelligence agencies - mass domestic surveillance and backdooring consumer hardware and software are different. If these were drug dealers, though, and not terrorists, HN would be in an uproar.
- gkoberger 11y ago
  Nobody is against using technology against known foreign terrorists. We're against mass surveillance against our own people.
  - eva1984 11y ago
    Well sometimes you cannot tell...
    - bad_user 11y ago
      Since when it's better to assume that everybody is guilty?
      - eva1984 11y ago
        I won't make a suggestion, because I don't have one. However, I am against the circlejerk that we don't need to change anything to battle the seemingly rising terrorism.
akerro 11y ago
ISIS has a list of "allowed" devices, that can be used bye its members, iOS was banned long time ago for privacy invasions. I bet they forked Android and you can install only apps signed with a key and Android validates them before installation. If I did it with my Paranoid ROM and F-Droid key, why can't them?
- tootie 11y ago
  ISIS IT must get the most irritating tech support calls. I'd hate to manage their Exchange server.
izacus 11y ago
No, the obvious solution is to prevent people on Android from installing their own apps and then forcing Google (a private company) to play police for the whole world according to USA law. We shall then continue by discontinuing production of all cars that ISIS drives and demanding that they have killswitches enabled so Toyota can be forced to disable them when they detect a terrorist driving. Windows and OS X will need to have terrorist killswitch ("kill laptop if arabic word bomb is entered by keyboard into any textview") built in as well. Logical isn't it? At least according to our lovely politicians. (The first paragraph is sarcasm by the way.)

soheil 11y ago

I'd doubt users of an encryption app not using a simple checksum to verify its legitimacy before using it.

deleted 11y ago
[deleted]
pen2l 11y ago
Probably not true. E.g., do you think the average user of Tor takes this precaution? Thinking back to the times I have downloaded Tor, I never did that. It reminds me of a time when I wanted to get in touch with an HN user... they had their pgp key in their user page... I tried sending the email but it didn't work (formatting issues). Finally I reached this user and asked what was up with it... and he responded by saying, "Oh, noone in the past 10 years has made use of this!" And this is a pretty smart security guy. I think there are very, very few people who actually take the trouble of verifying checksums and everything. I used to do it /sometimes/ years ago, but it gets to be a hassle pretty quickly and you start taking shortcuts everywhere. A lot of us sort of plan to start doing it, but never actually do it. Kind of like exercising or eating healthy or whatever. :) Anyway, as for this news about ISIS having their own encrypted chat app - I'm happy to hear it. If they made it on their own, it's bound to have a good dozen holes that NSA will have no trouble poking through. :)
- marcosdumay 11y ago
  Well, differently from you and your friend, ISIS does have somebody out to get them. It's very hard to think someone would get to the trouble of creating and using a secure chat application, but then fail to secure its distribution.
  - pipeline_tux 11y ago
    As someone who works in infosec, this doesn't surprise me at all. I've tested many applications which claim to be secure, designed for security/privacy sensitive tasks, yet are very easy to compromise (simple OWASP top 10 stuff). Even if the app developers are great and know their stuff, I can still see them slipping up on the distribution. It's normally handled for most developers and is outside the realm of any secure development guidelines they might be following.
  - jevinskie 11y ago
    The submitted headline is just plain wrong. The article mentions no ISIS-produced messaging app, just a news app.
    - pen2l 11y ago
      This article talks about an ISIS chat app: http://techcrunch.com/2016/01/16/isis-app/ http://techcrunch.com/2016/01/16/isis-app/
  - EthanHeilman 11y ago
    Interestingly secure distribution is a harder problem than encrypted messaging. If both you and I have an shared app, then we have some shared data and protocols we can use to protect our communications and maintain security, but when you download an app you do not yet have any protection unless that protection is provided by an app store (and such app store protections disappear at the first court order). Bootstrapping security over insecure channels against nation state threats is close to impossible, maintaining security you have already achieved over a brief window of time is still hard but achieve given existing technologies. I see no evidence ISIS is capable of doing either. As further evidence observe that the US just blew up their super secret cash reserve.
startling 11y ago
Where would you get a checksum from? How would you know to trust it?

golergka 11y ago

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

vonklaus 11y ago
I am not pro survellience but, in my opinion, sort of surveiling terrorists using the official chat.ISIS distro is basically the narrow usecase where moderates find it acceptable. Obviously, the problem is that it is not being used this narrowly and that the power to do a global sweep is a negatively skewed power imbalance. That said, I wonder who Is going to fund the A round.
krapp 11y ago
I'm pretty sure subverting ISIS' crypto falls under the legitimate purview of state intelligence agencies - mass domestic surveillance and backdooring consumer hardware and software are different. If these were drug dealers, though, and not terrorists, HN would be in an uproar.
gkoberger 11y ago
Nobody is against using technology against known foreign terrorists. We're against mass surveillance against our own people.
- eva1984 11y ago
  Well sometimes you cannot tell...
  - bad_user 11y ago
    Since when it's better to assume that everybody is guilty?
    - eva1984 11y ago
      I won't make a suggestion, because I don't have one. However, I am against the circlejerk that we don't need to change anything to battle the seemingly rising terrorism.

akerro 11y ago

ISIS has a list of "allowed" devices, that can be used bye its members, iOS was banned long time ago for privacy invasions. I bet they forked Android and you can install only apps signed with a key and Android validates them before installation. If I did it with my Paranoid ROM and F-Droid key, why can't them?

tootie 11y ago
ISIS IT must get the most irritating tech support calls. I'd hate to manage their Exchange server.

izacus 11y ago

No, the obvious solution is to prevent people on Android from installing their own apps and then forcing Google (a private company) to play police for the whole world according to USA law. We shall then continue by discontinuing production of all cars that ISIS drives and demanding that they have killswitches enabled so Toyota can be forced to disable them when they detect a terrorist driving. Windows and OS X will need to have terrorist killswitch ("kill laptop if arabic word bomb is entered by keyboard into any textview") built in as well. Logical isn't it? At least according to our lovely politicians. (The first paragraph is sarcasm by the way.)