3 ms·
Any messenger, tied to phone number, is not safe. possible attacks are: 1) create copy of sim-card; 2) force mobile operator to intercept password-code, sent to
by EugeneOZ 10y ago
Any messenger, tied to phone number, is not safe. possible attacks are: 1) create copy of sim-card; 2) force mobile operator to intercept password-code, sent to your number, and "restore" password this way.
It may sound ridiculous for you, but in Russia it's reality (both vectors), it's real cases from life. And when user really need safe messenger, all of them are too careless to implement really safe way of messaging. And if you think these vectors are not possible in your country - be sure, we were thinking the same way.
- trimbo 10y agoThis is why there is a fingerprint ("Safety Numbers" in Signal), and a warning on every message when that fingerprint changes.
- codedokode 10y agoWarning still does not fully prevent the attack. The attacker can still access the account and obtain the data stored at a server (like contact list if it is stored there).
- majewsky 10y ago> like contact list if it is stored there The only thing that we know they store is the creation timestamp and last-seen timestamp for each account: http://arstechnica.com/tech-policy/2016/10/fbi-demands-signal-user-data-but-theres-not-much-to-hand-over/ http://arstechnica.com/tech-policy/2016/10/fbi-demands-signa... Reading over the article again, though, it neither confirms nor denies where these timestamps are the only thing stored about an account. They explain these are the only data matching the concrete subpoena they received.
- deleted 10y ago[deleted]
- lawnchair_larry 10y agoWhich everyone, including myself, clicks through.