4 ms·

> The letter to Judge Kimba Wood stated that "the Government was advised that the FBI’s original electronic extraction of data from telephones did not capture c

> The letter to Judge Kimba Wood stated that "the Government was advised that the FBI’s original electronic extraction of data from telephones did not capture content related to encrypted messaging applications, such as WhatsApp and Signal... The FBI has now obtained this material." I don't get this. How could you possibly decrypt encrypted messages without WhatsApp or Signal's assistance? Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys?

ipsum2 8y ago
I haven't used Whatsapp or Signal, but you don't login every time you use the chat app, right? The phone could have just been unlocked by the owner or the PIN or pattern guessed, assuming the keys are stored on the device.
- StudentStuff 8y ago
  They are very different platforms, Signal offers on-device encryption if you choose to enable it, prompting for a password when starting Signal after rebooting the phone. It will also keep a quick lock option in the menu on Android phones so you can easily prevent unauthorized access. I believe Whatsapp has made a few compromises in this regard, but obviously Michael Cohen didn't bother to use disappearing messages in Signal or encrypt his Signal DB, despite how easy it is to do.
  - Krasnol 8y ago
    You can also set Signal to ask for a password after a certain time.
  - catamorphismic 8y ago
    This is a common misconception apparently, one that I've fallen prey to myself in the past. Signal removed the option to use the password lock and now uses Android's built-in lock screen functionality to provide auth. That screen was never meant to serve an encryption role and Moxie recommends using Android's full disk encryption feature to ensure data confidentiality at rest.
ben1040 8y ago
Encryption in transit doesn't imply encryption at rest. For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.
- ebikelaw 8y ago
  Nothing on Google Drive is stored "in clear text".
  - meesles 8y ago
    ...are you a Google Drive dev? How can you possibly make this statement?
  - xwvvvvwx 8y ago
    It's clear to Google.
  - tgsovlerkhgsel 8y ago
    If I put a file with certain content into Google Drive, then Google Drive, or a subpoena for my Google Drive data, will return exactly those contents. Hence, it is reasonable to apply any distinction to the content as a user of Google Drive sees it, and not as it may be stored on the backend. Hence, if the data WhatsApp pushes to the Google Drive API is unencrypted (and we're talking about the data, not about the HTTPS-encapsulated form that passes over the network), it is reasonable to call it "in clear text", and it wouldn't be reasonable to call it encrypted.
  - asdsa5325 8y ago
    I'm pretty sure anything public on Google Drive is...
  - m-p-3 8y ago
    Unless you control the encryption keys in the communication, always assume it's accessible in plaintext.
  - Sylos 8y ago
    It's maybe not stored in clear text, but it is at the very least stored in a form that Google can decrypt. They would not be able to recover your data upon requesting a password reset, if they used proper end-to-end-encryption.
odorousrex 8y ago
>Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys? But if the person who knows the relevant keys willingly hands over appropriate passwords/etc. for a more lenient sentence then encryption is moot.
- djmips 8y ago
  What a great point. They don't even have to publicize it, officially they just got the data by good hacking.
newscracker 8y ago
They probably decrypted it on the device through some brute force methods. This may be easy or difficult depending on the passcode/PIN used by the user on the device. This is a weak point from the user's side. They may have also obtained this from backups elsewhere that weren't encrypted or strongly encrypted. There is no indication that they decrypted anything by breaking into the end-to-end transport/network encryption used by these apps. P.S.: Your honest question (which wasn't snarky) was downvoted by some people for reasons I don't understand. Upvoted in an attempt to compensate. Such questions and responses can help more people learn about encryption and the protections necessary at different stages/layers.

ipsum2 8y ago

I haven't used Whatsapp or Signal, but you don't login every time you use the chat app, right? The phone could have just been unlocked by the owner or the PIN or pattern guessed, assuming the keys are stored on the device.

StudentStuff 8y ago
They are very different platforms, Signal offers on-device encryption if you choose to enable it, prompting for a password when starting Signal after rebooting the phone. It will also keep a quick lock option in the menu on Android phones so you can easily prevent unauthorized access. I believe Whatsapp has made a few compromises in this regard, but obviously Michael Cohen didn't bother to use disappearing messages in Signal or encrypt his Signal DB, despite how easy it is to do.
- Krasnol 8y ago
  You can also set Signal to ask for a password after a certain time.
- catamorphismic 8y ago
  This is a common misconception apparently, one that I've fallen prey to myself in the past. Signal removed the option to use the password lock and now uses Android's built-in lock screen functionality to provide auth. That screen was never meant to serve an encryption role and Moxie recommends using Android's full disk encryption feature to ensure data confidentiality at rest.

ben1040 8y ago

Encryption in transit doesn't imply encryption at rest. For instance, WhatsApp on Android will happily back up to Google Drive, if you allow it, and it does so in cleartext.

ebikelaw 8y ago
Nothing on Google Drive is stored "in clear text".
- meesles 8y ago
  ...are you a Google Drive dev? How can you possibly make this statement?
- xwvvvvwx 8y ago
  It's clear to Google.
- tgsovlerkhgsel 8y ago
  If I put a file with certain content into Google Drive, then Google Drive, or a subpoena for my Google Drive data, will return exactly those contents. Hence, it is reasonable to apply any distinction to the content as a user of Google Drive sees it, and not as it may be stored on the backend. Hence, if the data WhatsApp pushes to the Google Drive API is unencrypted (and we're talking about the data, not about the HTTPS-encapsulated form that passes over the network), it is reasonable to call it "in clear text", and it wouldn't be reasonable to call it encrypted.
- asdsa5325 8y ago
  I'm pretty sure anything public on Google Drive is...
- m-p-3 8y ago
  Unless you control the encryption keys in the communication, always assume it's accessible in plaintext.
- Sylos 8y ago
  It's maybe not stored in clear text, but it is at the very least stored in a form that Google can decrypt. They would not be able to recover your data upon requesting a password reset, if they used proper end-to-end-encryption.

odorousrex 8y ago

>Isn't the whole point of encryption that no-one can decrypt it unless they have the necessary keys? But if the person who knows the relevant keys willingly hands over appropriate passwords/etc. for a more lenient sentence then encryption is moot.

djmips 8y ago
What a great point. They don't even have to publicize it, officially they just got the data by good hacking.

newscracker 8y ago

They probably decrypted it on the device through some brute force methods. This may be easy or difficult depending on the passcode/PIN used by the user on the device. This is a weak point from the user's side. They may have also obtained this from backups elsewhere that weren't encrypted or strongly encrypted. There is no indication that they decrypted anything by breaking into the end-to-end transport/network encryption used by these apps. P.S.: Your honest question (which wasn't snarky) was downvoted by some people for reasons I don't understand. Upvoted in an attempt to compensate. Such questions and responses can help more people learn about encryption and the protections necessary at different stages/layers.