4 ms·

The backdoor referred to can be applied to any Android app that uses Google Maps. Also mentioned is that using the built-in Google keyboard is a vulnerability,

by roddux 10y ago

The backdoor referred to can be applied to any Android app that uses Google Maps. Also mentioned is that using the built-in Google keyboard is a vulnerability, because in theory it gives Google the ability to keylog you. I supposed this boils down to knowing your adversaries. If you number Google amongst that list, life is going to be really difficult - no matter who you are.

em3rgent0rdr 10y ago
Yes, any app that uses Google Maps is backdoored, but a secure messaging app needs to be held to a higher security standard than any old app that uses Google Maps. It is still possible to run a phone with Signal without any proprietary google code on your phone (see: microG).
antihero 10y ago
Indeed, but the point is that it's the combination of using GCM and their software that makes this a problem. Because not only does Google know what you're sending, but who you're sending it too, because they have both the OS and the network, they can correlate. I mean yes, it's basically impossible to do this. Even if you used a completely free OS, you still have radio chips to contend with etc.
jordskott 10y ago
I guess it mostly boils down to Moxie and his ridiculous claims of how much more secure Signal is when compared to other solutions (like XMPP and anything based on PGP). Don't get me wrong, I understand the design and user experience decisions of making Signal depending on GCM but Moxie just loves to bash on XMPP and federated protocols and putting Signal on a pedestal of exemplary security. I admire the dedication on putting together the Axolotl protocol but I hate when he mixes his business interests with secure crypto solutions, because by the end of the day that is what he wants, to sell Axolotl to companies like Google and WhatsApp. And of course, bashing on XMPP is just a business pitch to those companies.
- tptacek 10y ago
  It's not Moxie doing that, it's virtually the entire community of cryptographic engineers. And Open Whisper Systems is a grant-funded nonprofit that until recently could so barely afford developers they were considering withdrawing their iOS version, so the idea that this is all about Moxie's business interests is horseshit.
- em3rgent0rdr 10y ago
  isn't Axolotl an open protocol to be freely implemented by anyone? https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm#Usage https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm#Usage

by roddux 10y ago

em3rgent0rdr 10y ago

Yes, any app that uses Google Maps is backdoored, but a secure messaging app needs to be held to a higher security standard than any old app that uses Google Maps. It is still possible to run a phone with Signal without any proprietary google code on your phone (see: microG).

antihero 10y ago

Indeed, but the point is that it's the combination of using GCM and their software that makes this a problem. Because not only does Google know what you're sending, but who you're sending it too, because they have both the OS and the network, they can correlate. I mean yes, it's basically impossible to do this. Even if you used a completely free OS, you still have radio chips to contend with etc.

jordskott 10y ago

I guess it mostly boils down to Moxie and his ridiculous claims of how much more secure Signal is when compared to other solutions (like XMPP and anything based on PGP). Don't get me wrong, I understand the design and user experience decisions of making Signal depending on GCM but Moxie just loves to bash on XMPP and federated protocols and putting Signal on a pedestal of exemplary security. I admire the dedication on putting together the Axolotl protocol but I hate when he mixes his business interests with secure crypto solutions, because by the end of the day that is what he wants, to sell Axolotl to companies like Google and WhatsApp. And of course, bashing on XMPP is just a business pitch to those companies.

tptacek 10y ago
It's not Moxie doing that, it's virtually the entire community of cryptographic engineers. And Open Whisper Systems is a grant-funded nonprofit that until recently could so barely afford developers they were considering withdrawing their iOS version, so the idea that this is all about Moxie's business interests is horseshit.
em3rgent0rdr 10y ago
isn't Axolotl an open protocol to be freely implemented by anyone? https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm#Usage https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm#Usage