5 ms·

The article doesn't specify whether or not the encryption was "broken", or whether Cohen is simply cooperating. My hunch tells me it's the latter.

by 49bc 8y ago

craftyguy 8y ago
Yea this is key. It's possible to have Signal on your device but not implement any device locking passcode or passcode for unlocking Signal... That would make it trivial to recover data if you have the device.
- StudentStuff 8y ago
  An alternative method of protecting oneself is to set an expiry timer, which makes messages in a conversation ephemeral. 1 week seems to be a fine balance between being able to look back at old messages, while also not having those you communicate with be allowed to store data on your device for too long.
  - craftyguy 8y ago
    That's a good idea. Even if you enable FDE and a strong passphrase, the court can still compel you to unlock it. They cannot compel you to automagically undelete expired messages (hopefully those are expired and removed in a secure mannner...)
  - this_user 8y ago
    Signal also has an option to truncate your message history automatically, i.e. it only keeps the n newest messages and deletes older ones.
  - inferiorhuman 8y ago
    Signal won't prune the messages until you open the app (or maybe the conversation) again. There've been a few releases where the changelog notes that the app didn't expire ephemeral messages properly.
polar 8y ago
Is the model of the phone known? If it's a relatively new BlackBerry running Android, and if it can be rooted: * the main WhatsApp msgstore database in /data is not encrypted * the msgstore backup databases (.crypt* in /sdcard) can be decrypted easily using the key file (mentioned in the article) which is also stored in /data One could probably reverse engineer the WhatsApp APK to figure out how the key file is generated. I would hazard a guess that Signal messages are also not stored encrypted at the source and destination (beyond the protection offered by the operating system).
em3rgent0rdr 8y ago
obligatory: https://xkcd.com/538/ https://xkcd.com/538/
- jlgaddis 8y ago
  No, it's really not. We've all seen it. Hundreds of times.
  - tim333 8y ago
    It seems to have been referenced 272 times in HN comments and 3 times in story headlines.
qrbLPHiKpiux 8y ago
Bruce S. Trust the math. grugq, endpoints suck. Bet he sung.

The article doesn't specify whether or not the encryption was "broken", or whether Cohen is simply cooperating. My hunch tells me it's the latter.

by 49bc 8y ago

The article doesn't specify whether or not the encryption was "broken", or whether Cohen is simply cooperating. My hunch tells me it's the latter.

craftyguy 8y ago

Yea this is key. It's possible to have Signal on your device but not implement any device locking passcode or passcode for unlocking Signal... That would make it trivial to recover data if you have the device.

StudentStuff 8y ago
An alternative method of protecting oneself is to set an expiry timer, which makes messages in a conversation ephemeral. 1 week seems to be a fine balance between being able to look back at old messages, while also not having those you communicate with be allowed to store data on your device for too long.
- craftyguy 8y ago
  That's a good idea. Even if you enable FDE and a strong passphrase, the court can still compel you to unlock it. They cannot compel you to automagically undelete expired messages (hopefully those are expired and removed in a secure mannner...)
- this_user 8y ago
  Signal also has an option to truncate your message history automatically, i.e. it only keeps the n newest messages and deletes older ones.
- inferiorhuman 8y ago
  Signal won't prune the messages until you open the app (or maybe the conversation) again. There've been a few releases where the changelog notes that the app didn't expire ephemeral messages properly.

polar 8y ago

Is the model of the phone known? If it's a relatively new BlackBerry running Android, and if it can be rooted: * the main WhatsApp msgstore database in /data is not encrypted * the msgstore backup databases (.crypt* in /sdcard) can be decrypted easily using the key file (mentioned in the article) which is also stored in /data One could probably reverse engineer the WhatsApp APK to figure out how the key file is generated. I would hazard a guess that Signal messages are also not stored encrypted at the source and destination (beyond the protection offered by the operating system).

em3rgent0rdr 8y ago

obligatory: https://xkcd.com/538/ https://xkcd.com/538/

jlgaddis 8y ago
No, it's really not. We've all seen it. Hundreds of times.
- tim333 8y ago
  It seems to have been referenced 272 times in HN comments and 3 times in story headlines.

qrbLPHiKpiux 8y ago

Bruce S. Trust the math. grugq, endpoints suck. Bet he sung.