6 ms·

No, it's not. The encryption is not broken, it's bypassed. The data go to an unintended third party, even when the encryption is legit, rendering the encryptio

No, it's not. The encryption is not broken, it's bypassed. The data go to an unintended third party, even when the encryption is legit, rendering the encryption useless. So the word "bypass" is correct.

electic 10y ago
You are 100 percent correct. Though I think the headline is a bit clickbaity but have to agree, it is accurate.
- aero142 10y ago
  I've been thinking a lot about this as it relates to the "fake news" trend. Journalists have been using real information to lead people to wrong conclusions. Now we are very concerned about political sites using false information to lead people to wrong conclusions. Fake facts are bad but using facts to mislead people does damage to people's trust as well.
  - spullara 10y ago
    If they emphasized that no app is secure if the phone itself is compromised I wouldn't hae a problem with it. By calling out specific apps it could cause someone to switch to a less secure alternative not mentioned.
- mcphage 10y ago
  Accurate, but dangerously misleading.
  - electic 10y ago
    How is it misleading if it is accurate? They bypassed it by compromising the phone. No encryption is going to save you in that situation and their targets were WhatsApp, Telegram, etc. So that part is accurate as well. It is a headline, I think what you are expecting is they put all the facts into the headline and there isn't enough space.
    - nostrademons 10y ago
      They bypassed it by compromising Android phones. There is a clear action item here if you want to be secure: switch to an iPhone, which is what tptacek has been saying here all along.
      - mschuster91 10y ago
        Have you read the announcement? iPhones are wide open for the 3-letter-agencies, too.
        deleted 10y ago
        [deleted]
        lvh 10y ago
        I don't think that's a fair description of the information. Comments GP refers to include e.g. SEP -- iOS' threat model includes kernel-level 0days.
        FabHK 10y ago
        While the Wikileaks announcement explicitly mentions the iPhone (zero-days to "control, infest, and exfiltrate data"), the NY Times article mentions only Android in the context of bypassing Signal, WhatsApp.
    - r3bl 10y ago
      Well, why singling out the two services in the headline when this applies to basically every application ever? Luckily, they've realized the mistake and apparently changed the headline.
    - Certhas 10y ago
      It's misleading by omission. Until I read the article I was under the impression that they had found a flaw or something exploitable in the OWS protocol. If the problem was with Signal or Whatsapp, as the headline suggested to me, switching to another messaging service is the natural reaction. If people understand that the problem is with the platform, and that all platforms are compromised that solution doesn't work, and using signal is still better than SMS because it still protects against other forms of surveillance.
maxerickson 10y ago
The article should be emphasizing that they actively attack devices of targeted individuals, not leading with the particular consequence of this that Wikileaks mentioned in a tweet.
spullara 10y ago
If the app and service were not involved the only reason to mention them is to create doubt they are secure.
- rising-sky 10y ago
  "The strongest chain will break at it's weakest point". If I as a user, believe that a sequence of actions, from my keystrokes to voice input, which I perceive to be a direct interaction with a secure app are in fact insecure, then is the app really secure? I guess that's the question being posed here
  - spullara 10y ago
    Also make sure no one is looking over your shoulder or listening nearby. "Signal encryption bypasssed by new look over shoulder attack."
    - accountface 10y ago
      I think it's a little different when the person "looking over your shoulder" is omnipotent.
  - ballenf 10y ago
    There is a balance -- one is reminded of the constant "data charged may apply" footnote to so many free services. The same goes here: you really shouldn't tout your impenetrable security without also informing users that things external to the service may undermine its utility.
- daenney 10y ago
  Not necessarily. To a lot of people encryption is "using Signal" or "using WhatsApp". They don't necessarily understand that these are distinct things and that their communications could still be captured by virtue of simply using a phone.
- accountface 10y ago
  The OS these services run on isn't secure, so wouldn't these services by definition not be secure?
scblock 10y ago
This is a dangerous headline because it implies that Signal was broken, which could lead to people moving to LESS SECURE SERVICES because they think the more secure one is broken. When in reality is the phone and OS. They have similar end result for the phone in question, but headlines like this can lead to people being less secure on the whole.
- cmdrfred 10y ago
  If people really require security from state level agencies perhaps they should read more than the headline.
- cloakandswagger 10y ago
  I'm sure someone savvy enough to use end-to-end encrypted communication channels will switch to less secure methods based off of a headline /s
  - scblock 10y ago
    It already happened with Whatsapp and the Guardian's irresponsible reporting. Organizers and protesters switching to unencrypted messaging or even SMS, because of the perception that Whatsapp was hacked. Someone savvy enough to use end to end encryption may be someone who values privacy, but there's not reason to assume they are also someone who is themselves a security expert. The point of apps like Whatsapp and Signal working to make end to end encryption easy for the average person is to increase encrypted messaging use, not make everyone a security expert.
  - derefr 10y ago
    It's not really that savvy people would be switching away; it's that non-savvy friends/family of savvy people who read this article now will have a slight negative connotation to those product names, so if their savvy friend/relative tries to convince them to switch to either of them, they might say no for stupid reasons. This is the point of the majority of propaganda, really: it's not to convince the people who know anything about the issue; it's to prejudice the people who don't, so that it'll be harder for the people in the know to communicate the facts to them.
vog 10y ago
The point is that the title mentions explicitly Signal and WhatsApp, generating the false impression that it was a weakness in these applications. However, it was a weakness in the OS, so a proper title would have been: | WikiLeaks: CIA managed to bypass encryption on popular messaging services on Android phone (nytimes.com)
- sverige 10y ago
  They pwned iPhones too. And servers. And desktops, tablets, and your TV. While Signal and WhatsApp have not been broken (apparently), pretty much every platform they are hosted on has been. The main point is that the CIA can read your encrypted messages before they become encrypted, if they really want to. So while your encryption works, you can still be pwned.
- Certhas 10y ago
  Or even just "CIA managed to hack into Android phones."
Glyptodon 10y ago
I think the part that's misleading is that with a loose/typical/casual reading it sounds like the bypass is at the application level as opposed to the OS/host level. By suggesting specific apps/services may be "bypassed" they fail to make it crystal clear to all readers that any breakage is likely app/service agnostic. Of course this source is part of the same media that continually calls the election "hacked" despite there being no known technical irregularities with voting machines or vote recording or the actual election itself [^1] (that I'm aware of, at least). (Yes, computer systems were compromised, and data was exfiltrated from the DNC/related parties and released by foreign state actors. Unfortunately that is not "hacking an election." It's just plain and traditional information ops.) So it's pretty par. Mainstream news sources seem to continually get worse at reporting tech related stories, and I think there must be an even greater level of confusion when it comes to typical non-techinical individual citizens. [^1]: Whether anybody is actually interested in actual elections running in auditable, effective, and functional way is apparently another question entirely, and the answer from most seems to be "nope."
fhood 10y ago
Headline does imply the issue was with the messaging services and not the phones.
deleted 10y ago
[deleted]
nailer 10y ago
You're both right: encryption was bypassed, but mentioning specific apps implies those apps were specifically affected and is misleading.
skywhopper 10y ago
But the rest of the headline is misleading. It's Android that was broken into, not Whatsapp or Signal. The headline encourages a false idea that those apps have a systemic flaw that allows the CIA to read any messages sent over them, which is incorrect. "Bypass" is the right word, but the sentence as a whole misses the point and spreads a misleading message.

electic 10y ago

You are 100 percent correct. Though I think the headline is a bit clickbaity but have to agree, it is accurate.

aero142 10y ago
I've been thinking a lot about this as it relates to the "fake news" trend. Journalists have been using real information to lead people to wrong conclusions. Now we are very concerned about political sites using false information to lead people to wrong conclusions. Fake facts are bad but using facts to mislead people does damage to people's trust as well.
- spullara 10y ago
  If they emphasized that no app is secure if the phone itself is compromised I wouldn't hae a problem with it. By calling out specific apps it could cause someone to switch to a less secure alternative not mentioned.
mcphage 10y ago
Accurate, but dangerously misleading.
- electic 10y ago
  How is it misleading if it is accurate? They bypassed it by compromising the phone. No encryption is going to save you in that situation and their targets were WhatsApp, Telegram, etc. So that part is accurate as well. It is a headline, I think what you are expecting is they put all the facts into the headline and there isn't enough space.
  - nostrademons 10y ago
    They bypassed it by compromising Android phones. There is a clear action item here if you want to be secure: switch to an iPhone, which is what tptacek has been saying here all along.
    - mschuster91 10y ago
      Have you read the announcement? iPhones are wide open for the 3-letter-agencies, too.
      - deleted 10y ago
        [deleted]
      - lvh 10y ago
        I don't think that's a fair description of the information. Comments GP refers to include e.g. SEP -- iOS' threat model includes kernel-level 0days.
      - FabHK 10y ago
        While the Wikileaks announcement explicitly mentions the iPhone (zero-days to "control, infest, and exfiltrate data"), the NY Times article mentions only Android in the context of bypassing Signal, WhatsApp.
  - r3bl 10y ago
    Well, why singling out the two services in the headline when this applies to basically every application ever? Luckily, they've realized the mistake and apparently changed the headline.
  - Certhas 10y ago
    It's misleading by omission. Until I read the article I was under the impression that they had found a flaw or something exploitable in the OWS protocol. If the problem was with Signal or Whatsapp, as the headline suggested to me, switching to another messaging service is the natural reaction. If people understand that the problem is with the platform, and that all platforms are compromised that solution doesn't work, and using signal is still better than SMS because it still protects against other forms of surveillance.

maxerickson 10y ago

The article should be emphasizing that they actively attack devices of targeted individuals, not leading with the particular consequence of this that Wikileaks mentioned in a tweet.

spullara 10y ago

If the app and service were not involved the only reason to mention them is to create doubt they are secure.

rising-sky 10y ago
"The strongest chain will break at it's weakest point". If I as a user, believe that a sequence of actions, from my keystrokes to voice input, which I perceive to be a direct interaction with a secure app are in fact insecure, then is the app really secure? I guess that's the question being posed here
- spullara 10y ago
  Also make sure no one is looking over your shoulder or listening nearby. "Signal encryption bypasssed by new look over shoulder attack."
  - accountface 10y ago
    I think it's a little different when the person "looking over your shoulder" is omnipotent.
- ballenf 10y ago
  There is a balance -- one is reminded of the constant "data charged may apply" footnote to so many free services. The same goes here: you really shouldn't tout your impenetrable security without also informing users that things external to the service may undermine its utility.
daenney 10y ago
Not necessarily. To a lot of people encryption is "using Signal" or "using WhatsApp". They don't necessarily understand that these are distinct things and that their communications could still be captured by virtue of simply using a phone.
accountface 10y ago
The OS these services run on isn't secure, so wouldn't these services by definition not be secure?

scblock 10y ago

This is a dangerous headline because it implies that Signal was broken, which could lead to people moving to LESS SECURE SERVICES because they think the more secure one is broken. When in reality is the phone and OS. They have similar end result for the phone in question, but headlines like this can lead to people being less secure on the whole.

cmdrfred 10y ago
If people really require security from state level agencies perhaps they should read more than the headline.
cloakandswagger 10y ago
I'm sure someone savvy enough to use end-to-end encrypted communication channels will switch to less secure methods based off of a headline /s
- scblock 10y ago
  It already happened with Whatsapp and the Guardian's irresponsible reporting. Organizers and protesters switching to unencrypted messaging or even SMS, because of the perception that Whatsapp was hacked. Someone savvy enough to use end to end encryption may be someone who values privacy, but there's not reason to assume they are also someone who is themselves a security expert. The point of apps like Whatsapp and Signal working to make end to end encryption easy for the average person is to increase encrypted messaging use, not make everyone a security expert.
- derefr 10y ago
  It's not really that savvy people would be switching away; it's that non-savvy friends/family of savvy people who read this article now will have a slight negative connotation to those product names, so if their savvy friend/relative tries to convince them to switch to either of them, they might say no for stupid reasons. This is the point of the majority of propaganda, really: it's not to convince the people who know anything about the issue; it's to prejudice the people who don't, so that it'll be harder for the people in the know to communicate the facts to them.

vog 10y ago

The point is that the title mentions explicitly Signal and WhatsApp, generating the false impression that it was a weakness in these applications. However, it was a weakness in the OS, so a proper title would have been: | WikiLeaks: CIA managed to bypass encryption on popular messaging services on Android phone (nytimes.com)

sverige 10y ago
They pwned iPhones too. And servers. And desktops, tablets, and your TV. While Signal and WhatsApp have not been broken (apparently), pretty much every platform they are hosted on has been. The main point is that the CIA can read your encrypted messages before they become encrypted, if they really want to. So while your encryption works, you can still be pwned.
Certhas 10y ago
Or even just "CIA managed to hack into Android phones."

Glyptodon 10y ago

I think the part that's misleading is that with a loose/typical/casual reading it sounds like the bypass is at the application level as opposed to the OS/host level. By suggesting specific apps/services may be "bypassed" they fail to make it crystal clear to all readers that any breakage is likely app/service agnostic. Of course this source is part of the same media that continually calls the election "hacked" despite there being no known technical irregularities with voting machines or vote recording or the actual election itself [^1] (that I'm aware of, at least). (Yes, computer systems were compromised, and data was exfiltrated from the DNC/related parties and released by foreign state actors. Unfortunately that is not "hacking an election." It's just plain and traditional information ops.) So it's pretty par. Mainstream news sources seem to continually get worse at reporting tech related stories, and I think there must be an even greater level of confusion when it comes to typical non-techinical individual citizens. [^1]: Whether anybody is actually interested in actual elections running in auditable, effective, and functional way is apparently another question entirely, and the answer from most seems to be "nope."

fhood 10y ago

Headline does imply the issue was with the messaging services and not the phones.

deleted 10y ago

[deleted]

nailer 10y ago

You're both right: encryption was bypassed, but mentioning specific apps implies those apps were specifically affected and is misleading.

skywhopper 10y ago

But the rest of the headline is misleading. It's Android that was broken into, not Whatsapp or Signal. The headline encourages a false idea that those apps have a systemic flaw that allows the CIA to read any messages sent over them, which is incorrect. "Bypass" is the right word, but the sentence as a whole misses the point and spreads a misleading message.