3 ms·

And also easily defeated with commonly available end to end encrypted messaging

ehnto 8y ago
Recent Australian laws make it possible to force Australian companies and individuals to compromise software to defeat encryption. Which could be as simple as getting a boutique update delivered to a device that includes a screen recorder or keylogger, and it doesn't necessarily have to be the messaging app that gets compromised. That isn't really a problem unique to Australia or state level actors. I think apple and Android have some protections against screen recording.
- saagarjha 8y ago
  Any “boutique update” you’re talking about would require compromising the OS development process, which means that any protections against scene recording would be easy to remove or work around.
  - ehnto 8y ago
    That is the hope. But who to trust? Not to mention, some apps already have the permissions for their legitimate use cases, so why not just pick one of those? It may not even require a client update, just requisition of the data from the company. The underlying idea is that smartphones are safer, but they are still software, and your trust points are spread very thin over literally hundreds of people and companies. All of this, blasting across the internet and into dozens of other peoples servers daily. It's hard to consider it secure.
- libdjml 8y ago
  Fortunately, Australia doesn’t make any phones or popular e2e software.
  - ehnto 8y ago
    It wouldn't have to be the e2e software as the delivery app for the payload or tooling. Regardless it was more about the fact that governments and other actors have options. Phones are just like any other software platform.
TACIXAT 8y ago
No it's not. Your phone number is associated with an identifier that is used to talk to cell towers. The (US) cell providers (were) sell(ing) real time location data of their subscribers. No amount of encrypted chat is gonna fix that.
kurthr 8y ago
Not an encrypted messaging system that is linked to your phone number and thus to your IMEI number. The base station knows which IMEI it is talking to. It (and the other basestations) know the signal power and can triangulate your location. Any app which has location information (or the many who already sell it) could provide your location. If your IMEI was unknown (your carrier database must be more secure than most) then it could still be statistically found by tracking location and signaled IMEIs. Meta data is much more powerful than is commonly supposed. Timing attacks are at least as effective as keystroke statistical attacks, which are real. You're better off, if both of you are running VPNs all the time and have lots of background traffic on the same connection.
ohithereyou 8y ago
And commonly available #00 Buckshot from a fired from a commonly available hunting shotgun.

Recent Australian laws make it possible to force Australian companies and individuals to compromise software to defeat encryption. Which could be as simple as getting a boutique update delivered to a device that includes a screen recorder or keylogger, and it doesn't necessarily have to be the messaging app that gets compromised. That isn't really a problem unique to Australia or state level actors. I think apple and Android have some protections against screen recording.

saagarjha 8y ago
Any “boutique update” you’re talking about would require compromising the OS development process, which means that any protections against scene recording would be easy to remove or work around.
- ehnto 8y ago
  That is the hope. But who to trust? Not to mention, some apps already have the permissions for their legitimate use cases, so why not just pick one of those? It may not even require a client update, just requisition of the data from the company. The underlying idea is that smartphones are safer, but they are still software, and your trust points are spread very thin over literally hundreds of people and companies. All of this, blasting across the internet and into dozens of other peoples servers daily. It's hard to consider it secure.
libdjml 8y ago
Fortunately, Australia doesn’t make any phones or popular e2e software.
- ehnto 8y ago
  It wouldn't have to be the e2e software as the delivery app for the payload or tooling. Regardless it was more about the fact that governments and other actors have options. Phones are just like any other software platform.

TACIXAT 8y ago

No it's not. Your phone number is associated with an identifier that is used to talk to cell towers. The (US) cell providers (were) sell(ing) real time location data of their subscribers. No amount of encrypted chat is gonna fix that.

kurthr 8y ago

Not an encrypted messaging system that is linked to your phone number and thus to your IMEI number. The base station knows which IMEI it is talking to. It (and the other basestations) know the signal power and can triangulate your location. Any app which has location information (or the many who already sell it) could provide your location. If your IMEI was unknown (your carrier database must be more secure than most) then it could still be statistically found by tracking location and signaled IMEIs. Meta data is much more powerful than is commonly supposed. Timing attacks are at least as effective as keystroke statistical attacks, which are real. You're better off, if both of you are running VPNs all the time and have lots of background traffic on the same connection.

ohithereyou 8y ago

And commonly available #00 Buckshot from a fired from a commonly available hunting shotgun.