10 ms·
Political World Embraces Encrypted-Messaging App Signal Amid Fears of Hacking
- hendzen 10y agoreally awesome that cutting edge crypto is being used by our elected officials & their aides to avoid public records laws!
- Esau 10y agoWorse, they are using it while trying to place back doors in it.
- RangerScience 10y ago:D:
- tptacek 10y agoThinking about the last year's worth of stories, there's really no way for them to win here, is there?
- hendzen 10y agoSure... they should just use their (clearnet) government email addresses, secured with mandatory 2FA. If those get hacked it would be potentially embarrassing, but it would be less likely if they all had reasonable security measures. For any classified material officials can use their SIPRNET/JWICS emails, for which suspicious access is much more closely monitored, of course.
- tptacek 10y agoIt's worth remembering that the fundamental premise of that position is that the government might be able to field a better security team to protect the most sensitive email in the world than could Google. Not many security people in the world would sign on to that position.
- hendzen 10y agoThat's not really an issue. The government is perfectly free to use Google Apps for clearnet email. Do you mean to suggest that Gmail is more secure than government classified networks?
- tptacek 10y agoYes, that is exactly what I mean to suggest.
- hendzen 10y agoWhat gives you that impression?
- smileysteve 10y agoCompetition. Also simple things like spf and tls when many state and federal sites fail at it.
- ComputerGuru 10y agoEh. At some point, the threat isn't how good your crypto is but rather how much you're willing to sacrifice to keep it that way. Signal's authors may be more technically competent than a government security officer, but Signal can be coerced into releasing an update that surreptitiously changes the behavior of the application whereas well-protected NSA officers are (theoretically) more immune.
- hackuser 10y agoIf Hillary Clinton had used Signal instead of her private email server, would it have been ok? (No.)
- chrisabrams 10y agoWould we ever know?
- ufmace 10y agoCould be an interesting article, anybody know how to read it? WSJ has been hiding the article text behind a paywall, and even Google doesn't seem to cache the full text.
- grzm 10y agoThe "web" link works for me. I know that it hasn't been working consistently, so YMMV.
- jdavis703 10y agoThe trick is do it on your mobile phone, or emulate an Android or iOS user agent string.
- ufmace 10y agoTried web link, incognito mode, user agent spoofer, and my Android phone, none of them work. Thanks for trying, but I gotta flag this article. I don't support paywalled content being on HN.
- hendzen 10y agoIt's pretty simple, you just pay the WSJ for a subscription.
- gcp 10y agoMadness. Next thing you know they stop putting out clickbaity titles, too. Then what are we going to do? Read the actual articles? Get real.
- Tenobrus 10y agoMake this a bookmark: javascript:location.href='https://www.google.com/webhp?%23q='%20+%20encodeURIComponent(location.href)%20+%20'&btnI=I' Click it when on the page.
- 10y ago
- joshpadnick 10y agoSo, government argues it needs broad spying powers for the "security" of the people, but many individuals in the government personally use tools they believe to be beyond the government's reach. Since I don't anticipate the USA ever outlawing unbreakable crypto for use by private citizens or companies, does that mean eventually government can only spy on those citizens not savvy enough to use secured tech to communicate? I guess the flipside here is: how many of those officials using Signal have an Amazon Echo in their homes that's recording all their conversations?
- adventured 10y ago> how many of those officials using Signal have an Amazon Echo in their homes that's recording all their conversations? None is the correct answer.
- andreyf 10y agoEcho only records if you trigger it with the key phrase. Or do mean Echos that have been hacked?
- eecc 10y agoThe copy on the package says it only records when triggered, by a key phrase. There's nothing that prevents it to record and process differently on other "key phrases", or on receipt of a remote command
- andreyf 10y agoThere's nothing to prevent your phone or laptop or smart TV / fire alarm / etc from doing so, either. Why single out Alexa?
- abofh 10y agoSigh. I was with you right until the end. Of _course_ those in power believe themselves smart enough to avoid the rules they wrote - they want to be secure, and know the presence of very real threats both within and outside of the US. I'm not defending it - but you'd have to be extremely foolish to commit a crime from your @whitehouse.gov email address. You'd have to be equally foolish to commit any crime over email or unencrypted IM if you'd talked to a lawyer with half a braincell to rub against a rock. And the US /has/ banned unbreakable crypto - those 56 bit ciphers in old browsers? That was export law banning the export of 'weapons' to unfriendly states. While the law has been recinded, nothing has made it hard for congress (or even the executive) to change that. And lastly - Echo does NOT transmit to amazon when the light is off (perhaps unless compelled to by court order - but I leave paranoia to your imagination). Don't believe me? Disconnect your internet and ask for the time - it knows how to do a few very minimal things without the network -- No AWS transmission needed if your clock's in sync.
- TheSageMage 10y agoHow does the use of this technology fit in with the FOIA, etc?
- tonyztan 10y agoSignal has a built in 'export' function that produces a plaintext file with chat logs. However that might defeat the point of end-to-end encrypted messages.
- subliminalpanda 10y agoUseful if you want to preserve your chats and move to a new device however.
- amboar 10y agoAnother approach is to use Signal's "Linked Devices" capability. Designate a central "device" (server) for FOIA purposes, and mandate all relevant public servants/elected officials using Signal add that as a linked device. Then there's no need to retrieve a device and dump its message store, which obviously depends on the device being in a functional state. Instead there's a one-time setup when Signal is first installed.
- xenotb 10y agoIt protects the message in transport, its metadata, as well as offer some endpoint security. That doesn't mean the user can't export the messages himself.
- deleted 10y ago[deleted]
- jcfrei 10y agoI wonder how long Signal will stay up before they get a knock on the door - just like lavabit did: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
- x1798DE 10y agoIIRC Signal did get a "knock at the door" and, rightly, had almost nothing to give the government - mostly because of how they designed their architecture, but admittedly partially because of the metadata they chose not to store. Lavabit's situation was different because they were a "choose not to look" solution, not a "can't look" solution. That said, Signal is centralized, so it's not like they are particularly robust against that sort of thing, just that other than getting Signal shut down, any strong-arm tactics are unlikely to result in very useful information from OWS.
- jacobush 10y agoAnd besides, if Signal was shut down, who knows what solutions might crop up, that are even harder to strong-arm.
- m3rc 10y agoTruly decentralized solutions like riot may be the next step. I have a group of friends that have been in a singular group chat since high school and I plus one other convinced everyone to move to Signal the day after election day. In another couple years if riot matures and/or Signal shows signs of being inadequate, one or more of us will probably host our own riot messaging server
- mtgx 10y agoFor anyone interested, he's referring to this: https://www.aclu.org/blog/free-future/new-documents-reveal-government-effort-impose-secrecy-encryption-company https://www.aclu.org/blog/free-future/new-documents-reveal-g...
- m3rc 10y ago
- Neliquat 10y agoWhat happened to the ban on paywalled stuff?
- grzm 10y agoPlease read the rest of this thread. There's been plenty of discussion on this already: - https://news.ycombinator.com/item?id=13502730 https://news.ycombinator.com/item?id=13502730
- krapp 10y ago> What happened to the ban on paywalled stuff? It never existed, it doesn't exist now, and it is unlikely to exist in the future.
- zeveb 10y agoSo, there are a few things that OWS can do with its privileged position: it can, for example, lie about what your public key is and then receive all messages intended for you. I wonder if any of the folks over there would be tempted to do that, if they disagreed strongly enough with one politician or another. I'd hope not, and I rather think they they all hope not. But I wonder what happens when push comes to shove.
- tonyztan 10y agoSignal does allow users to manually compare key fingerprints ("safety numbers"), and it does ask for confirmation when the numbers change. Whether users actually verify is a different story.
- MichaelGG 10y agoIf you make audio calls does it still incorporate your messaging keys? That is if you read the confirmation code in the audio call are you all good? And yes, if you're doing something critical, verify the security codes first!
- deleted 10y ago[deleted]
- Dan_JiuJitsu 10y agoI love signal, and it's heartening to me that the userbase is increasing.
- 1_2__3 10y agoI like how "our duly-represented governments ignore the will of the people and their own laws and constitutions to effect illegal searches of citizens who've done nothing wrong" as "hacking".
- johnhenry 10y agoDoes anyone know if signal is can be infiltrated via SS7 vulnerabilities because of it's reliance on telephone numbers?
- willstrafach 10y agoWorst case would mean the other user will at least get a key change notification. If they care to verify that out of band, then there is no issue.
- dcposch 10y agoGood. I'd rather have an infosec-competent government than one that's an open book to foreign adversaries. The last few months have been embarrassing. We had one top official run their own email server out of a private basement in suburban New York, unsecured and unmonitored. We had John Podesta, seventy years old, fall for a Russian phishing scheme that involved downloading an executable email attachment, presumably clicking thru the warning and running it anyway. In the wake of that, political officials may have been scared into caring about infosec. We may be winning the fight against apathy and incompetence -- but we are still losing the fight against hypocrisy. -- Both the current and previous administrations are full of powerful people who want privacy and security for themselves, while denying the same to the citizens they serve. The previous administration promised, in 2008, to be the most transparent ever. It proceeded to have an abysmal record with respect to whistleblower prosecution, government transparency, and FOIA obstruction. The new administration looks likely to be even worse. Laws like the Snoopers Charter, recently passed in the UK, cast an ominous shadow over the whole American security profession. Thoroughly nontechnical old men run our government. We must convince them and the public that strong encryption with no backdoors is critical both for national security and for the preservation of our First Amendment rights. Call your senators and call your representative. Demand better.
- deleted 10y ago[deleted]
- ComputerGuru 10y ago> We had John Podesta, seventy years old, fall for a Russian phishing scheme that involved downloading an executable email attachment, presumably clicking thru the warning and running it anyway What does Podesta's age have to do with anything at all??
- dcposch 10y agoLike it or not, computer illiteracy has had a major effect on recent political events.
- 10y ago
- georgecmu 10y agoHeh, there was this business insider piece from Aug 2016: A month before the hacking revelations, Bilton reported, DNC staffers were told they should use this "Snowden-approved" app whenever they were mentioning Donald Trump, especially if their message was disparaging. Signal is an incredibly easy-to-use app for iPhone and Android that allows both encrypted text and voice communications. Founded by Moxie Marlinspike in 2014, it requires no sign-up, registration, or exchange of information between parties. You just download the app, install it on your phone, and call whoever you want to talk to, using regular phone number. http://www.businessinsider.com/clinton-dnc-snowden-signal-2016-8 http://www.businessinsider.com/clinton-dnc-snowden-signal-20...
- Gaelan 10y agoPaywall-proof AMP link: https://www.google.com/amp/www.wsj.com/amp/articles/political-world-embraces-encrypted-messaging-app-amid-fears-of-hacking-1485492485 https://www.google.com/amp/www.wsj.com/amp/articles/politica.... You'll need to set your user agent to a smartphone.
- slaviotheslav 10y agoBro im on a smartphone pay wall prompt still pops up thanks though.
- anondon 10y agoThe way Signal handles key changes is a not very user friendly for non-tech users. When the user's key changes, Signal does not automatically resend dropped messages like Whatsapp does. Curious whether the Signal users in the Government are aware of this.
- jug5 10y agoThat's actually a security feature. Automatically resending is not.
- jakeogh 10y agoon closed baseband with DMA access.
- aphextron 10y agoGood. Maybe it has finally sunk into mainstream consciousness that e-mail is completely insecure.