10 ms·

This headline is extremely dangerous. The phone itself was owned. No encryption was harmed by capturing the keystrokes and audio before it reaches the applicati

This headline is extremely dangerous. The phone itself was owned. No encryption was harmed by capturing the keystrokes and audio before it reaches the application. NYTimes should be ashamed of themselves for basically lying about the nature of the hacks.

trendia 10y ago
edit: apparently NYT had a different headline and changed it... ignore this post The current title [0] is wrong, but NYTimes is relatively clear: > Among other disclosures that, if confirmed, would rock the technology world, the WikiLeaks release said that the C.I.A. and allied intelligence services had managed to bypass encryption on popular phone and messaging services such as Signal, WhatsApp and Telegram. According to the statement from WikiLeaks, government hackers can penetrate Android phones and collect “audio and message traffic before encryption is applied.” It depends on how you define "bypass". In my opinion, accessing data before encryption is a form of bypassing... but it doesn't necessarily mean they can decrypt an already encrypted signal. [0] "WikiLeaks: CIA managed to bypass encryption on popular services Signal, WhatsApp " as of this writing
- t0dd 10y ago
  They changed the headline: https://twitter.com/nytimes/status/839161021369573378 https://twitter.com/nytimes/status/839161021369573378 edit: A new tweet referencing the article: "WikiLeaks release said CIA managed to bypass encryption in mobile apps by compromising the entire phone"
  - whatok 10y ago
    They changed the tweet which I guess is factually correct but still misleading.
- 27182818284 10y ago
  When I read "bypass" I kind of read "go the alternate route. As in around the impasse" which in this case the impasse was encryption. I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent. I could see myself being bothered if they had written that the encryption was "broken" or "cracked" as if you destroyed the boulder in your path. Bypass seems fine. Hacker News doesn't normally use bypass as a synonym for break, but for some reason today it i to the commentators
  - acomar 10y ago
    > I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent. More because we're all getting blown up with "Signal is broken" messages and have to answer them one by one because of misleading/disingenuous headlines. Yes, 'bypass' is technically correct but the implication of the headline is that the problem lies with the named apps. This is not true and actively problematic.
kelnage 10y ago
Unfortunately, this is a line that Wikileaks themselves are running with: https://twitter.com/wikileaks/status/839120909625606152 https://twitter.com/wikileaks/status/839120909625606152
- tptacek 10y ago
  Running misinformation is part of Wikileaks' job. It's not the NYT's job.
  - kelnage 10y ago
    Agreed 100% - but methinks NYT (and others) still look to them for technical guidance on some matters - however misguided that might be.
    - tptacek 10y ago
      The NYT has a _huge_ list of experts to contact for stories like this. They chose not to, in the interests of getting a salacious lede printed quickly.
      - godelski 10y ago
        Well I think they put out the article first and get experts to correct the finer points later. I don't agree this is the best tactic, but reporting first is important. They have changed the title. Currently: "WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents"
        tptacek 10y ago
        See for instance WaPo, where Greg Miller and Ellen Nakashima got Nicholas Weaver from ICIR on the record for analysis for the story. Compare with the NYT's original story, which had no disclosed expert sourcing. Maybe a habit we should all develop is to first scan these things to see who they got on the record to talk about it. It's not hard for them. I'm not making this up: NYT has a huge list of experts to reach out to for stories. They just chose not to.
djKianoosh 10y ago
"sidestep" would probably have been a better word choice than "bypass" only because of the connotation of these words... the average person isn't going to parse these words however, sooo... <shrug> ?
- 1maginary 10y ago
  Completely agree that "sidestep" would have been a much better choice. I think the title is technically correct but that doesn't mean much since context matters a lot. "Sidestep" is a lot more intuitive and, I do disagree with you here, I think the average person would get a better idea of what's happening if they read "sidestep" instead of "bypass"
mtgx 10y ago
I agree. They should be called out on it. The headline is basically "fake news."
perseusprime11 10y ago
NYT is pivoting to a model that brings it more clicks.
- dwringer 10y ago
  It is a disturbing trend lately for publishers to seemingly insert deliberate fallacies into their headlines just to get more people engaged, causing them to pop up on more social media timelines.
  - perseusprime11 10y ago
    Well they want to become Drudge before Drudge becomes them.
- Melk 10y ago
  NYT corrected/changed the title. I don't get why they are getting the heat when wikileaks leaked the information.
shp0ngle 10y ago
No, it's not. The encryption is not broken, it's bypassed. The data go to an unintended third party, even when the encryption is legit, rendering the encryption useless. So the word "bypass" is correct.
- electic 10y ago
  You are 100 percent correct. Though I think the headline is a bit clickbaity but have to agree, it is accurate.
  - aero142 10y ago
    I've been thinking a lot about this as it relates to the "fake news" trend. Journalists have been using real information to lead people to wrong conclusions. Now we are very concerned about political sites using false information to lead people to wrong conclusions. Fake facts are bad but using facts to mislead people does damage to people's trust as well.
    - spullara 10y ago
      If they emphasized that no app is secure if the phone itself is compromised I wouldn't hae a problem with it. By calling out specific apps it could cause someone to switch to a less secure alternative not mentioned.
  - mcphage 10y ago
    Accurate, but dangerously misleading.
    - electic 10y ago
      How is it misleading if it is accurate? They bypassed it by compromising the phone. No encryption is going to save you in that situation and their targets were WhatsApp, Telegram, etc. So that part is accurate as well. It is a headline, I think what you are expecting is they put all the facts into the headline and there isn't enough space.
SamBam 10y ago
What's wrong with it? They were able to bypass the encryption. They got the data without it being encrypted. How is that not bypassing encryption? Furthermore, from the point of view of the end-user, the important point is that WhatsApp and Signal are not necessarily secure to use. The exact nature of the security hole is not as important for the vast majority of users.
- spullara 10y ago
  The phone itself may not be secure. Maybe they should include gmail, schwab, camera, microphone, amazon and every other thing in their description. Literally this is FUD.
  - ruleabidinguser 10y ago
    These are the most relevant apps to use, it indicates that even when using security apps there is a problem. The message is "WhatsApp is not safe", its not relevant to most people why.
  - digler999 10y ago
    And it's a rare case where FUD is absolutely applicable: Fear that using a "secure" messaging app on your rooted phone will expose you to consequences. Uncertainty that your communications are secure when using your phone with the "secure" messaging app. Doubt that using the "secure" messaging app is secure. yes, it's FUD.
revelation 10y ago
Seems like the headline is perfectly fine. The software on the device you don't own is bypassed, resulting in encryption being ineffective? That seems like a highly critical issue for whoever owns the software. Step the fuck up Google. Android security is an embarrassment.
- idlewords 10y ago
  The headline mentions specific apps; readers will remember that those apps are "insecure". Very dangerous.
  - throwaway743824 10y ago
    They are insecure from the perspective of protecting people from targeted government surveillance though. The security model doesn't support it.
idlewords 10y ago
They've corrected it; HN should do the same.
woah 10y ago
Am I missing something? The actual headline is "WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents"
squarefoot 10y ago
> No encryption was harmed by capturing the keystrokes and audio before it reaches the application. Exactly, and some people including me thought about this possibility years ago. The most secure system in the universe can still be hacked very easily by a malicious closed driver because device drivers have the highest access level to the underlying hardware. Every information being produced: (virtual) keyboard writings, data, contacts, sensors data, GPS, audio, files, etc. I mean everything can be accessed a lot before it reaches the encryption code and be relayed to a 3rd party without the user even noticing. This plague won't go away, not until enough people with enough influence will require hardware manufacturers to document their hardware in order to create OSS and trustworthy device drivers.
- senectus1 10y ago
  yup, its a chicken/egg scenario.
brudgers 10y ago
Eve operates in meat-space not a mathematical Flatland. Operationally, it does not matter how the message was read. The encryption system is compromised and users do not have practical alternatives. The reality is that no matter how good the software engineers are; no matter how sound the algorithms; no matter how well funded the startup or open source project; it's completely outnumbered and completely out gunned. Nation states operate at a different scale and easily deployable encryption systems for novice users are white horse led brightly dressed musketeers drum marching to their general's firing line in the midst of a modern free fire zone. To me, any secure communications systems that provides the convenience of app store downloads and over the air updates should be considered compromised. On the other hand, if someone thinks that a three letter agency might be interested in their communications and that person does not work for another three letter agency, they should probably assume that their signals are compromised if they are detected.
dang 10y ago
We've updated the headline to what the NYT currently says. Previously it said "WikiLeaks: CIA managed to bypass encryption on popular services Signal, WhatsApp".

trendia 10y ago

edit: apparently NYT had a different headline and changed it... ignore this post The current title [0] is wrong, but NYTimes is relatively clear: > Among other disclosures that, if confirmed, would rock the technology world, the WikiLeaks release said that the C.I.A. and allied intelligence services had managed to bypass encryption on popular phone and messaging services such as Signal, WhatsApp and Telegram. According to the statement from WikiLeaks, government hackers can penetrate Android phones and collect “audio and message traffic before encryption is applied.” It depends on how you define "bypass". In my opinion, accessing data before encryption is a form of bypassing... but it doesn't necessarily mean they can decrypt an already encrypted signal. [0] "WikiLeaks: CIA managed to bypass encryption on popular services Signal, WhatsApp " as of this writing

t0dd 10y ago
They changed the headline: https://twitter.com/nytimes/status/839161021369573378 https://twitter.com/nytimes/status/839161021369573378 edit: A new tweet referencing the article: "WikiLeaks release said CIA managed to bypass encryption in mobile apps by compromising the entire phone"
- whatok 10y ago
  They changed the tweet which I guess is factually correct but still misleading.
27182818284 10y ago
When I read "bypass" I kind of read "go the alternate route. As in around the impasse" which in this case the impasse was encryption. I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent. I could see myself being bothered if they had written that the encryption was "broken" or "cracked" as if you destroyed the boulder in your path. Bypass seems fine. Hacker News doesn't normally use bypass as a synonym for break, but for some reason today it i to the commentators
- acomar 10y ago
  > I think a lot of people in this thread are hating on NYTimes today for this headline because of the inaccurate WhatsApp encryption news stories of recent. More because we're all getting blown up with "Signal is broken" messages and have to answer them one by one because of misleading/disingenuous headlines. Yes, 'bypass' is technically correct but the implication of the headline is that the problem lies with the named apps. This is not true and actively problematic.

kelnage 10y ago

Unfortunately, this is a line that Wikileaks themselves are running with: https://twitter.com/wikileaks/status/839120909625606152 https://twitter.com/wikileaks/status/839120909625606152

tptacek 10y ago
Running misinformation is part of Wikileaks' job. It's not the NYT's job.
- kelnage 10y ago
  Agreed 100% - but methinks NYT (and others) still look to them for technical guidance on some matters - however misguided that might be.
  - tptacek 10y ago
    The NYT has a _huge_ list of experts to contact for stories like this. They chose not to, in the interests of getting a salacious lede printed quickly.
    - godelski 10y ago
      Well I think they put out the article first and get experts to correct the finer points later. I don't agree this is the best tactic, but reporting first is important. They have changed the title. Currently: "WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents"
      - tptacek 10y ago
        See for instance WaPo, where Greg Miller and Ellen Nakashima got Nicholas Weaver from ICIR on the record for analysis for the story. Compare with the NYT's original story, which had no disclosed expert sourcing. Maybe a habit we should all develop is to first scan these things to see who they got on the record to talk about it. It's not hard for them. I'm not making this up: NYT has a huge list of experts to reach out to for stories. They just chose not to.

djKianoosh 10y ago

"sidestep" would probably have been a better word choice than "bypass" only because of the connotation of these words... the average person isn't going to parse these words however, sooo... <shrug> ?

1maginary 10y ago
Completely agree that "sidestep" would have been a much better choice. I think the title is technically correct but that doesn't mean much since context matters a lot. "Sidestep" is a lot more intuitive and, I do disagree with you here, I think the average person would get a better idea of what's happening if they read "sidestep" instead of "bypass"

mtgx 10y ago

I agree. They should be called out on it. The headline is basically "fake news."

perseusprime11 10y ago

NYT is pivoting to a model that brings it more clicks.

dwringer 10y ago
It is a disturbing trend lately for publishers to seemingly insert deliberate fallacies into their headlines just to get more people engaged, causing them to pop up on more social media timelines.
- perseusprime11 10y ago
  Well they want to become Drudge before Drudge becomes them.
Melk 10y ago
NYT corrected/changed the title. I don't get why they are getting the heat when wikileaks leaked the information.

shp0ngle 10y ago

No, it's not. The encryption is not broken, it's bypassed. The data go to an unintended third party, even when the encryption is legit, rendering the encryption useless. So the word "bypass" is correct.

electic 10y ago
You are 100 percent correct. Though I think the headline is a bit clickbaity but have to agree, it is accurate.
- aero142 10y ago
  I've been thinking a lot about this as it relates to the "fake news" trend. Journalists have been using real information to lead people to wrong conclusions. Now we are very concerned about political sites using false information to lead people to wrong conclusions. Fake facts are bad but using facts to mislead people does damage to people's trust as well.
  - spullara 10y ago
    If they emphasized that no app is secure if the phone itself is compromised I wouldn't hae a problem with it. By calling out specific apps it could cause someone to switch to a less secure alternative not mentioned.
- mcphage 10y ago
  Accurate, but dangerously misleading.
  - electic 10y ago
    How is it misleading if it is accurate? They bypassed it by compromising the phone. No encryption is going to save you in that situation and their targets were WhatsApp, Telegram, etc. So that part is accurate as well. It is a headline, I think what you are expecting is they put all the facts into the headline and there isn't enough space.

SamBam 10y ago

What's wrong with it? They were able to bypass the encryption. They got the data without it being encrypted. How is that not bypassing encryption? Furthermore, from the point of view of the end-user, the important point is that WhatsApp and Signal are not necessarily secure to use. The exact nature of the security hole is not as important for the vast majority of users.

spullara 10y ago
The phone itself may not be secure. Maybe they should include gmail, schwab, camera, microphone, amazon and every other thing in their description. Literally this is FUD.
- ruleabidinguser 10y ago
  These are the most relevant apps to use, it indicates that even when using security apps there is a problem. The message is "WhatsApp is not safe", its not relevant to most people why.
- digler999 10y ago
  And it's a rare case where FUD is absolutely applicable: Fear that using a "secure" messaging app on your rooted phone will expose you to consequences. Uncertainty that your communications are secure when using your phone with the "secure" messaging app. Doubt that using the "secure" messaging app is secure. yes, it's FUD.

revelation 10y ago

Seems like the headline is perfectly fine. The software on the device you don't own is bypassed, resulting in encryption being ineffective? That seems like a highly critical issue for whoever owns the software. Step the fuck up Google. Android security is an embarrassment.

idlewords 10y ago
The headline mentions specific apps; readers will remember that those apps are "insecure". Very dangerous.
- throwaway743824 10y ago
  They are insecure from the perspective of protecting people from targeted government surveillance though. The security model doesn't support it.

idlewords 10y ago

They've corrected it; HN should do the same.

woah 10y ago

Am I missing something? The actual headline is "WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents"

squarefoot 10y ago

> No encryption was harmed by capturing the keystrokes and audio before it reaches the application. Exactly, and some people including me thought about this possibility years ago. The most secure system in the universe can still be hacked very easily by a malicious closed driver because device drivers have the highest access level to the underlying hardware. Every information being produced: (virtual) keyboard writings, data, contacts, sensors data, GPS, audio, files, etc. I mean everything can be accessed a lot before it reaches the encryption code and be relayed to a 3rd party without the user even noticing. This plague won't go away, not until enough people with enough influence will require hardware manufacturers to document their hardware in order to create OSS and trustworthy device drivers.

senectus1 10y ago
yup, its a chicken/egg scenario.

brudgers 10y ago

Eve operates in meat-space not a mathematical Flatland. Operationally, it does not matter how the message was read. The encryption system is compromised and users do not have practical alternatives. The reality is that no matter how good the software engineers are; no matter how sound the algorithms; no matter how well funded the startup or open source project; it's completely outnumbered and completely out gunned. Nation states operate at a different scale and easily deployable encryption systems for novice users are white horse led brightly dressed musketeers drum marching to their general's firing line in the midst of a modern free fire zone. To me, any secure communications systems that provides the convenience of app store downloads and over the air updates should be considered compromised. On the other hand, if someone thinks that a three letter agency might be interested in their communications and that person does not work for another three letter agency, they should probably assume that their signals are compromised if they are detected.

dang 10y ago

We've updated the headline to what the NYT currently says. Previously it said "WikiLeaks: CIA managed to bypass encryption on popular services Signal, WhatsApp".