20 ms·
82nd Airborne unit told to use Signal or Wickr on government cell phones
- sp332 7y agoSignal's auto-delete feature is optional and off by default.
- kissickas 7y agoIt could still be problematic if "With regards to transparency and records keeping requirements, Foote said he 'cannot confirm if any personnel have Signal or Wickr settings which allow auto-delete of messages at this time.'"
- nimbius 7y agoA bit alarming to see the government embracing an end-to-end chat system with perfect forward secrecy, considering both the head of the FBI and the CIA have confirmed that the lack of a back door would impede the fight against ISIS. https://www.theguardian.com/technology/2015/jul/08/fbi-chief-backdoor-access-encryption-isis https://www.theguardian.com/technology/2015/jul/08/fbi-chief...
- yonaguska 7y agoWhy is that alarming? The FBI and CIA requests for backdoors are alarming. Unless you're positing that these apps may have secretly complied with CIA and FBI requests? If anything, this is a really good thing, as the utility of publicly available comms are embraced by government entities, it should somewhat guarantee that us consumers will also have access to this.
- danso 7y agoI think nimbius was being sarcastic?
- Ill_ban_myself 7y agoPointing out a contradiction of policy and interest between civilian and military who each have independent concerns and capability doesn't necessary imply sarcasm. I took nimbius to mean that it will be interesting (as in get your popcorn) to see who's influence in the halls of power win out when such a contradiction exists.
- Shivetya 7y agoI see little conflict, there is little reason the military would observe restrictions in the battlefield. now they could limits its use only while deployed or simply run it under an exception only policy, as in you get to use it for this period of time and not otherwise. there has always been separate rules applied to the people and government, the issue comes down to the simple matter elected officials should always be considered public while in office.
- deleted 7y ago[deleted]
- 9dev 7y agoMy interpretation is that he meant it's alarming to see the government suddenly openly suggesting an e2e messenger because it might hint to the agencies having discovered a hole in the Signal protocol. I highly doubt that personally, but that's what I read from nimbius comment.
- azinman2 7y agoSo then why would they want the military to use it for internal discussion? If the govt is aware of a hole, then other nations might be aware of the same or a different issue.
- peteradio 7y agoBecause its only crackable by the 1kqb quantum computer located in Mt rushmore under Lincolns invisible top hat.
- retbull 7y agoI need me some of this invisible top hat quantum computer.
- stevehawk 7y agothey aren't using it for classified conversations so it doesn't really matter
- merpnderp 7y agoIt does matter. Soldiers talk about sensitive stuff all the time. You don’t want schedules, personnel, whatever, leaking through inane conversations to people we’re at war with.
- erikbye 7y agoUnfortunately, classified comms of various classification levels spill over into publicly available channels all the time, both accidental and out of laziness, but also sometimes an immediate necessity.
- EthanHeilman 7y ago>If anything, this is a really good thing, as the utility of publicly available comms are embraced by government entities, it should somewhat guarantee that us consumers will also have access to this. I largely agree with you but a more cynical take would be that it allows the following argument to be advanced: "If the 82nd Airborne uses it, then it is a weapon of war. Why should civilians have access to the same communication equipment as a soldier needs in a time of war." That is, they associate the technology with combat and the military. Then, they use that association as a way to argue the technology is only inherently useful for those planning to engage in combat. It also allows governments to advance the argument that if it useful for our soldiers then it should be denied to enemy soldiers and thus it should be tightly controlled (see night vision googles[0] or cryptography as a weapon[1]). [0]: https://en.wikipedia.org/wiki/Night-vision_device#Legality https://en.wikipedia.org/wiki/Night-vision_device#Legality [1]: https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
- nitemice 7y agoIf they make that argument, it shouldn't be much of a stretch to say that the 2nd amendment should apply to this technology then.
- EthanHeilman 7y agoWell they made that argument about cryptography being a munition and I don't see anyone advancing a 2nd Amendment challenge against those laws.
- big_chungus 7y agoThere's certainly a case here. If Barr goes forward with his nutty anti-encryption push, I hope the opposition uses this argument. Google lists definition #1 for "arms" as "weapons", and definition #2 of "weapons" as "a means of gaining an advantage or defending oneself in a conflict or contest." I doubt any would argue that un-breakable (at least, theoretically) comms would provide no tactical advantage. If anyone would, I'd refer him to the second world war as a prominent example. This argument could help built a bi-partisan pro-cryptography group by pulling in support from the 2A crowd. I support cryptography remaining fully legal (even if classified as a munition or armament) for the same reason I support the 2A, practical security considerations aside.
- corndoge 7y agoIt is sarcasm
- nexuist 7y agoPrivacy for me, not for thee....
- deleted 7y ago[deleted]
- phil_folrida 7y agoeh, the book Team of Teams is pretty good for that https://www.amazon.ca/Team-Teams-Rules-Engagement-Complex/dp/1591847486?SubscriptionId=AKIAILSHYYTFIVPWUY6Q&tag=duc12-20&linkCode=xm2&camp=2025&creative=165953&creativeASIN=1591847486 https://www.amazon.ca/Team-Teams-Rules-Engagement-Complex/dp... when the best of the best is beaten by people that barely know to use guns.
- tomphoolery 7y agoTo me it's a relief. Finally the information warmongers can't argue that it has no benefit to national security.
- nothrabannosir 7y agoI think it was sarcasm? Or am I completely missing the point?
- mattrp 7y agoIt’s just for this sort of turn of events that hn should allow a limited number of memes and emojis.
- deleted 7y ago[deleted]
- LoSboccacc 7y agomemes here? .'''''``---... / \ .'------..........:. '|-. ```---........:. || `-. | __|| `. | / |\ `-. ___ .|\ .'\ | `-. / \_ / | | \ ###' / --.'. .'.: \|..+`. `-._ ### / /-.-- \ .' `-. | `. `-..-' ' .' \ .' `-`. `. / .' \ | \ `. .' / | | `. `..' .:' | | `--...__ .' | | ``.' | wait, that's illegal
- LoSboccacc 7y agofor a community taking pride on appreciating novelty and creativity and interesting use of technology sure y'all hate modern solutions ,----------. ,-' ++ / ,---------++-+ / ,' \ ; ,' \ +--' _ \ | / | ______ ---- |. / / (#) \ (#) ; \/ / | \ : ; | \ | \; +-,-.,-. / __| | ; / / ,-. ; | ' : `~---- / | | / | ; / ,- / ------'--. ,--' \ ; `--. ,' \ ; `-. ,' \ / `. / ,--+--. / \ | ; | ++ | +-----------+---+---++------------------------+
- johnchristopher 7y agoWell, maybe they finally got their backdoor baked in and they now want to spy on their own people?
- rvnx 7y agoSignal protocol, partially adopted by Facebook, Skype, Google, weren't all of them caught red handed collaborating with government on spying citizens ? If the DoD approved, the DoD must have good reasons that it will increase its own control on its own troops.
- sachinag 7y agoYou really need an /s on this one
- xvector 7y agoKind of sad people can’t distinguish obvious sarcasm these days without an “/s”. Ruins the beauty of sarcasm.
- anderspitman 7y agoTo be fair, I think language barriers often make this much more difficult for folks.
- arcticfox 7y agoRecognizing sarcasm generally requires context on the author. You can make assumptions that lead to this looking like sarcasm or you can take it on face value; both are fairly likely to have some users that would write the comment. I think it's kind of silly to use for that reason.
- anigbrowl 7y agoTiming is everything; the narrower the bandwidth of the communications channel, the more important context becomes if you want to avoid falling victim to Poe's law. It's not obvious that intent is sarcastic when it expresses a commonly held position, unless the sarcastic person is well known to have different views - not so easy to discern on a site like HN. To be obvious to the casual reader, you need to articulate a position which goes to absurd extremes, eg A bit alarming to see the government embracing an end-to-end chat system with perfect forward secrecy, considering that it impede economic growth in our identity-theft and espionage industries. Of course, that might not be recognizable as sarcasm in some countries where such activities are of greater strategic importance.
- dkersten 7y agoSarcasm in text never worked well though. You also have to remember that a large percentage of HN readership are not native English speakers.
- deleted 7y ago[deleted]
- Seenso 7y ago> A bit alarming to see the government embracing an end-to-end chat system with perfect forward secrecy, considering both the head of the FBI and the CIA have confirmed that the lack of a back door would impede the fight against ISIS. Why is it alarming? I don't think the FBI and CIA are advocating backdoors for government encryption. The fact that the military endorses it for their own operational security is weak evidence that Signal is more secure than other apps.
- ThrustVectoring 7y agoE2E encryption and perfect forward secrecy doesn't matter if the protocol is leaking copious amounts of metadata about who you're talking to and when.
- dmix 7y agoThat's what OPSEC is for. A bit hard in enemey territory but def less noisy than using w/e else they were currently using.
- StavrosK 7y agoThe Signal server doesn't even know who the sender of a message is, just the recipient.
- bradenb 7y agoEven just traffic analysis makes any kind of communication potentially leaky. Encryption matters, but it doesn't protect against everything. Even the lack of communication leaks information.
- Thriptic 7y agoWhat data is known exactly? Phone number? IP?
- StavrosK 7y agoJust the IP, IIRC, but it doesn't know who you are. There are more details on their blog in one of the latest blog posts.
- frayesto 7y agohttps://signal.org/bigbrother/ https://signal.org/bigbrother/ You can see exactly what Signal is able to provide to a legal request. Time of last connection related to a phone number
- sillysaurusx 7y ago
- noobermin 7y agoThis might not count as much, but the DoD is a different organization than the FBI or the CIA.
- godelski 7y agoIt should count. The DoD has different interests than FBI and CIA. It should make sense that DoD wants encryption, it makes their jobs easier. It should also make sense that the FBI and CIA don't want encryption, lack of makes their jobs easier. Just because they're both government agencies doesn't mean they are colluding against the people. Different agencies have different agendas and prerogatives. It's also well known that agencies often fight over things and don't exactly work together well.
- ta999999171 7y ago> The DoD has different interests than FBI and CIA. Mildly off-topic, but every time I read this, it makes me ill.
- godelski 7y agoWhy? Here's an analogy. People that are in charge of defending kings are pro castles (it helps them defend their kings). People that are in charge of killing kings are anti castles (it is easier to kill a king if they aren't in a castle). Why is this a difficult concept to grasp? All agencies are pro "agenda that makes my agency's job easier".
- ta999999171 7y ago> Why is this a difficult concept to grasp? I wasn't disagreeing with you, and grasp the concept better than most. > All agencies are pro "agenda that makes my agency's job easier". They didn't used to be. These agencies used to work, with pride, for country and people. Not their own sorry selfish fucking asses.
- craftinator 7y agoI wonder what Barr thinks of this...
- egberts1 7y agoDefinitely not Wickr.
- noja 7y agoWhy?
- egberts1 7y agoAs one who studied protocol state of many Internet-based protocols, Wickr isn’t as closely guarded protocol as Signal is with regard to being able to do MitM (between a specific two protocol states). This is from a theoretical analysis. No time to do actual jerryrigging.
- choeger 7y agoAccording to the article, they also require a VPN. So why use these apps? Is the VPN purely optional or do they not trust the inner network?
- SEJeff 7y agoWouldn't you sort of expect the military to implement zero trust networking where possible?
- RobRivera 7y agoAs a prior technology acquisitions professional, the contract for that capability will touch so many different '4 letter' offices and can arguably be bid under each service's acquisition arm that the pain and dollar amount associated with it simply isn't high on the priority list. There is a reason the DoD shells millions to msft to provide xp support past EoL
- gpm 7y agoSignal supports local encryption doesn't it? Maybe they are worried about physically losing their phones? But they probably don't fully trust their vpn, good spycraft assumes that the adversary has (partial) access to your systems.
- RL_Quine 7y agoIt doesn’t have any mode that’s not encrypted.
- ziolent 7y agoSMS?
- mcpeepants 7y agothe app supports SMS for convenience, but that's not "using signal" as in the protocol
- dogman144 7y agoAG Barr, what now? Signal/Wickr use only allowed with govt employment? Good though, although most AD have been using Whatsapp anyways for comms back home
- class4behavior 7y agoWickr makes little sense. Maybe they meant Wire?
- antoncohen 7y agoWhy? I'm genuinely curious. I've never used their product, but their Wikipedia page says they are a San Francisco based company with end-to-end encrypted messaging and video conference calls[1]. And their home page[2] says "Fully encrypted. Enterprise-ready. Private." At first glance it seems like a reasonable choice. US based and end-to-end encrypted seems to be what the military wants in this case. [1] https://en.wikipedia.org/wiki/Wickr https://en.wikipedia.org/wiki/Wickr [2] https://wickr.com/ https://wickr.com/
- deleted 7y ago[deleted]
- lucasmullens 7y agoWhy does that make little sense? Isn't Wicker just like Signal?
- tptacek 7y agoWickr is not just like Signal.
- lucasmullens 7y agoCan you explain how? That's why I asked the question. From my limited knowledge they both seem to be end-to-end encrypted chat.
- slenk 7y agoJust looking at the website, it looks like Wickr might be a little more like slack. Saying it's not like Signal is just silly.
- 7y ago
- anon176 7y agoWhy not keybase?
- legionof7 7y agoThe US military has no need for Stellar.
- otachack 7y agoKeybase comes with social tools to verify identity. Would be pretty silly to see a military personnel profile in public view.
- anon176 7y agoGood point, its been a while since I signed up and I forgot about the whole "verification" process. Thanks.
- RL_Quine 7y agoPut it in context, is it ever acceptable to have all your activity publicly logged? Keybase isn’t forward secure, so so disclosure of your keys later leads to complete availability of your cleartext.
- FullyFunctional 7y agoAccording to https://keybase.io/blog/chat-apps-softer-than-tofu https://keybase.io/blog/chat-apps-softer-than-tofu ephemeral messages are indeed forward secure, but normal messages are not, strictly speaking. IMhO, Keybase is adequate to protect against spying from ISPs, Ad agencies, journalists, etc but doesn't offer resistance against a formidable foe like a state actor, but then neither does most of the devices on which Signal is run.
- vorpalhex 7y agoKeybase is miserable to use currently and its only generally gotten worse. Was an early user and have continued to be disappointed.
- rejectfinite 7y ago"told to" Why do they not have some MDM like InTune or Knox and have the apps they need pre-installed and the phone locked down to prevent any other apps from being installed?
- dogman144 7y agothe acquisitions procedure to do that would be a nightmare
- crooked-v 7y agoI can alrady imagine a three-year waiting list to get new apps remotely installed, which then inevitably fails under common international travel circumstances.
- dr-detroit 7y agoBecause their job doesn't buy them a secondary device that is strictly a thing for the elites while peasants pay out of pocket. Im sure mandatory apple watch for 2FA isnt far off.
- CKN23-ARIN 7y agoDARPA literally invented the Internet for this kind of use case and now they can't even write their own secure messaging app?
- sbmthakur 7y agoBut why do that when there are already solutions available?
- hjek 7y agoAnd they now recommend an app developed by anarchists?
- applecrazy 7y agoSource? I didn’t know that.
- zaphod12 7y agoMoxie Marlinspike (owner of the world's greatest name) is the lead of the Signal project is often described as an anarchist (as in this wired article: https://www.wired.com/2016/07/meet-moxie-marlinspike-anarchist-bringing-encryption-us/ https://www.wired.com/2016/07/meet-moxie-marlinspike-anarchi..., which is better than it's headline). He is not, in truth, an anarchist. He is a crypto-zealot, most definitely eccentric, and opposed to a lot of government intrusion. In today's world, I guess that's an anarchist
- rvnx 7y agoAn anarchist who collaborates with WhatsApp (Facebook), that's rather comical :o)
- tptacek 7y agoAn anarchist who works to get all the major messaging platforms end-to-end encrypted, so that normal people who don't think to explicitly opt-in to encryption get the benefits by default? Makes perfect sense to me. WhatsApp was (maybe still is?) the most popular messaging application in the world. Getting it E2E encrypted is a huge coup.
- rolltiide 7y agoI don't trust Wickr
- servercobra 7y agoWhy not?
- quindecagon 7y agoI'm not them but I imagine it is because Wickr is closed source.
- rolltiide 7y agoClosed source, compellable US based company, lack of emphasis on being installable on privacy OS' like Tails and Whonix. They don't do anything to dispel the notion of being a honeypot and basically do the exact opposite.
- mobilemidget 7y agoI never heard of Wickr before this post.
- bduerst 7y agoIt's a go to for dark market comms these days, but other than that, this is the first I've seen it mentioned on clear net. I also didn't know it was closed-source and privately-owned in the U.S., which should have been a red flag for dark market users.
- rolltiide 7y agoIt's a red flag for many dark market users. When I see people offer their customer support on Wickr, I think "is this guy serious? everyone is really confident in this person?" and never contact anyone on Wickr.
- maximente 7y ago> “I don’t have confidence that DoD could build a unique texting system with proper security protocols that would beat any commercial, off the shelf, version,” the former official said. so $700B in defense spending can't match some motivated, talented FLOSS devs? that's rich.
- zamadatix 7y agoQuote is about beating not matching. If the FLOSS software matches all of their requirements then there isn't a way to beat it and it's already made.
- dpeck 7y agoNot once has that ever stopped an RFP from being put out or a contract from being awarded.
- retbull 7y agoHopefully this is the first time. Honestly the government needs to make more open decisions like this (hard because of tracking budgets and how contracts are awarded and defined as complete). A bit more flexibility and open decisions with easy input from their users would do our country a HUGE service and save a metric fuck ton of money.
- mattlutze 7y agoLots of RFPs are awarded to companies with existing commercial technology, or to solution providers who bid on a plan to integrate open-source software and maybe add a little flavor.
- ineedasername 7y agoEven if there was a FLOSS option that checked every box on features, there would still need be an RFP for implementation. You can't create and manage the infrastructure of a system at that scale without spending enough money to require an RFP.
- servercobra 7y agoThere's a lot of comments here about Signal being better than Wickr, but little information on why yet. A quick Google search didn't give me any decent answers, so can anyone fill in why Signal is better?
- cloudking 7y agoSignal is open source https://github.com/signalapp https://github.com/signalapp
- BlueTemplar 7y agoEven their server code?
- bqe 7y agoYes! https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
- DonCopal 7y agoBut how can you be sure there's no additional code being run on their server?
- eitland 7y agoIt doesn't matter as the messages are end to end encrypted and the way it is done is continously verified by multiple leading/up-and-coming cryptographers as far as I understand. This is the huge advantage that Signal has over mail, the default mode in Telegram and pretty much anything there is: it does matter if NSA, FSB, MI5, Mossad, Google and Facebook all have root on a server that all the traffic passes through. To the best our knowledge - long as they don't compromise one of the endpoints - the only thing they'll get is metadata and the only thing they can do is disrupting the service.
- pfundstein 7y ago
- Kalium 7y agoGiven how much of that $700B is likely to go towards developing such a system - likely somewhat less than all of it - and the general care towards usability in DoD-built systems? I think it might not be a wildly unreasonable position to take. Doubly so when you consider that DoD procurement and development practices are not widely renowned for being quick. With those in mind, and that Signal already exists, it's worth considering if there's actually something for the DoD to gain by sinking millions of dollars and years of time into developing and maintaining something new that might not be an improvement. The answer might legitimately be "No, that's not worth it".
- mjevans 7y agoI agree; I took the comment to be rather precisely worded: 'we cannot SURPASS the existing (and free) solution already in the market' This seems more like an endorsement of the level of integrity and robustness of the product and a recognition that taxpayer dollars could be better spent not re-inventing the wheel. Additionally, off the shelf products mean that they could spent far less resources ensuring it continues to meet and exceed the necessary standards rather than building a new thing.
- jn1234 7y agoAnd also that the US Fed Gov's role in funding Signal. Hopefully, the best outcome will probably be seeing how stupid the backdoor and encryption debate is.
- IIAOPSW 7y agoI suppose I'll take a shot at a counterargument. The problem with the military using an off the shelf system like Signal isn't the tangible features (re: encryption, usable ux). The problem is one of control. What happens when the government gets into a dispute with Signal (say, over a warrantless wiretap) and Signal decides in protest that it will no longer have any DoD affiliated customers? What happens when, through a series of shell companies and legal loopholes, a controlling stake in Signal ends up in Chinese or Russian hands? From the PoV of the DoD, owning the system from end to end is a feature they shouldn't compromise on, even if the other features suffer and it costs more than it otherwise would.
- rkagerer 7y agoDidn't Bezos' phone get hacked through a WhatsApp message? I know they're not talking operational comms, but how confident are we these two apps are exploit-free?
- tptacek 7y agoNo application is exploit free. Freedom from basic framework- and language-level vulnerabilities is not an option with any modern messaging protocol, secure or not.
- arcturus17 7y agoWe are not. It’s software. E2E encryption is tight until you hack a client or system on either side, but at least it makes it nearly impossible to attack the middle.
- ravinggoose 7y agoMaybe they're confident that WhatsApp does have backdoors because they put them there...
- eitland 7y ago> but how confident are we these two apps are exploit-free? We aren't. Exploits are found in decades old software that we once believed was relatively well vetted, and in Signals case their desktop app for example had a rather nasty XSS about 14 months ago or so: https://www.cvedetails.com/cve/CVE-2018-11101/ https://www.cvedetails.com/cve/CVE-2018-11101/ That doesn't meen there isn't a huge difference between Signal and everyone else: WhatsApp keeps on uploading unencrypted backups to places where it is know to be within reach of NSA, so if NSA is in your threat model, forget about WhatsApp. They have also been sloppy when it comes to accepting remote client swaps, and they've also had at least one nasty vulnerability. Telegram, AFAIK, has managed to annoy most leading cryptographers so they don't care to put much effort into verifying it it seems.
- UI_at_80x24 7y agoWhile I appreciate that there are only 2 CVE's for Signal [1], it doesn't appear to tell the whole story.[2][3][4] I don't need 'Perfect', I do need 'Better'. OS independent: *BSD, Linux, Windows, Android, iOS I'm willing to run my own server, but the wife-unit needs something "easy" (hence the Windows requirement). What are some reasonably secure E2E IM platforms? [1]https://www.cvedetails.com/vulnerability-list/vendor_id-17912/product_id-45789/Signal-Signal.html https://www.cvedetails.com/vulnerability-list/vendor_id-1791... [2]https://www.google.com/amp/s/www.forbes.com/sites/daveywinder/2019/10/05/signal-messenger-eavesdropping-exploit-confirmedwhat-you-need-to-know/amp/ https://www.google.com/amp/s/www.forbes.com/sites/daveywinde... [3]https://www.fastcompany.com/90444005/hackers-could-have-exploited-a-whatsapp-flaw-to-create-mass-chaos-say-researchers https://www.fastcompany.com/90444005/hackers-could-have-expl... [4]https://www.scmagazineuk.com/researchers-reveal-easily-signal-telegram-whatsapp-messages-hijacked/article/1521145 https://www.scmagazineuk.com/researchers-reveal-easily-signa...
- all_blue_chucks 7y agoSignal works on Windows desktops.
- ta999999171 7y agowww.Riot.im
- nicky0 7y agoHmm. Define "reasonably secure". Your link [3] is about WhatsApp and [4] is a about a compromised platform. No app is secure once you hack the phone.
- bigcohoneypot 7y agoThis is probably because Signal and Wickr are actually intelligence operations.
- o_p 7y agoGood to know they are only US-backdoored then
- mikece 7y agoI’m curious why Wire wasn’t recommended. I prefer it because you don’t need a phone number to use it.
- godelski 7y agoSignal talked about how this is actually a security flaw. I believe they are working on implementing the feature though. It is about being able to create social graphs. So like if you get a new phone you can keep your social network (also that if you discard a phone an adversary can't pick up your identity trivially). With the current implementation you'd lose your social graph every time you got a new device. I didn't check very hard but I think it is this blog post [0]. They don't have many posts, so I'm sure you can find it if this isn't the one. [0] https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/
- kijiki 7y agohttps://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
- 0xdeadb00f 7y agoWire got bought out, apparently: https://blog.privacytools.io/delisting-wire/ https://blog.privacytools.io/delisting-wire/
- mzs 7y agoto a US company though, DoD wouldn't mind about that
- mikece 7y ago“ Electronic communications and text messages sent as part of official government business are part of the public record, and should be accessible via a Freedom of Information Act request.” Unless it’s classified and it would be very easy to make the case that all of the communication being sent on Army-issued cell phones would be Confidential at a minimum. The important stuff all gets copied into OPORDS and will be available for declassification someday.
- jokoon 7y agoWell signal is not supported on non-phone androids (there was some option on the desktop dev build but it's not supported anymore, so it's not even usable on desktop). I've heard that this limitation increases security but I have a hard time understanding why. So I can't really vouch for Signal, but I wish I would. I guess requiring a physical android phone makes it hard to create bogus accounts? I wanted to try jami to do some p2p voip on windows. It crashes when I create an account. It really sounds like secure alternatives are "disappearing" or just not usable or mature enough, in favor of mainstream apps that are known to be monitored. Not to mention the call quality of skype/discord can suffer because it's using servers.
- xrd 7y agoThe irony that Edward Snowden also recommends Signal is so thick. Isn't this a gateway drug for other whistleblowers?
- jblwps 7y agoIn what sense would it be a gateway? Because of the possibility of data exfiltration?
- xrd 7y agoThis allows people to communicate securely with certain people, say journalists, if you have something you want to share in private. If you don't know about this kind of app you might be fearful of doing that. I meant gateway drug as a joke but hopefully you get the point.
- pepve 7y ago"[...] where adversaries can exploit American communications systems, cell phones and the electromagnetic spectrum." (emphasis mine) Wait, what?
- erikbye 7y agoThis is why TEMPEST is critical.
- ryanmercer 7y ago>the electromagnetic spectrum EMP, signal jamming, GPS spoofing etc.
- godelski 7y ago> the electromagnetic spectrum. It is an all inclusive term. So this includes things like radio.
- anderspitman 7y agoEveryone's making comments about this indicating there could be a backdoor. Wouldn't that be impossible for Signal without putting it in the open source app? Otherwise wouldn't it have to be a protocol-level vulnerability?
- mr_toad 7y agoHow do you know the binary in the App Store is actually compiled from the published source. Is it possible to reproduce iOS binaries?
- anderspitman 7y agoGreat question. I would assume Signal has some sort of signed reproducible builds, but I have no idea what the Apple store process is like. Do you not just submit a binary to the store?
- calin2k 7y agowhy not backdoored whatsapp? it would be perfect government endorsement.
- aneutron 7y agoEveryone here is speaking like there HAS to be a backdoor for the messages to be auditable, forgetting that they could modify the application to abide to some sort of device management strategy that uploads a backup to some server when connected to a LAN for example. Signal already gives encrypted backups with a password you see one time when setting up. I imagine you could easily modify that to lock the app with tye Android administrator shenanigans, and then periodically upload incremental backups. The messages would of course remain encrypted but the key would be in the IT administration's hold. I believe the end-to-end part of Signal is very interesting if you consider the whole NETWORK to be hostile, but that both ENDS are friendly once authenticated. I can see a very FoA-friendly implementation of this. It always seemed kind of stupid to me that they would spend billions of dollars to reinvent another wheel. It's like saying "Physics are good and we could add some more research and engineering for our case, but no, physics is opensource so let's make our own physics" Not exactly the same but ...
- godelski 7y agoI think the idea of a backdoor comes because CIA/FBI/NSA has incentives to be anti-encryption. It is their job to break it. So they want their lives to be easier. But the DoD has an incentive to have strong encryption. It is their job to defend their communications. But I'll disagree with you (while agreeing with you) on this > Everyone here is speaking like there HAS to be a backdoor The DoD __does__ have a backdoor. It is the cellphone, not Signal. There doesn't have to be a backdoor in Signal for them to have full access to these communications.
- mirimir 7y ago> The DoD __does__ have a backdoor. It is the cellphone, not Signal. How? By compromising the baseband, and then pivoting to compromise the AP? But what about IOMMU? Or is that pwnable?
- jpeg_hero 7y agoAre we witnessing the start of the combat iPhone? These devices are staggeringly useful, I guess it just makes sense that they find their way into this aspect of human life as well. > Squad: the #1 small unit combat App >What's New in 3.14: Enhanced Scout/Recon route setting- select up to 7 types of perimeter security >In-App Purchase: Unlimited "Friendlies" List - avoid unwanted friendly fire incidents.
- alexis_fr 7y agoPrice: 10k$ per user. Fair enough if we’re billing the army for an app with a huge bug bounty.
- anon73044 7y agoCGI Federal/Raytheon has been working on something like this for the last 5-6 years for (AFATDS)
- CapricornNoble 7y agoI'd argue that ATAK is closer to a "combat iPhone" system than AFATDS, which is uniquely focused on field artillery coordination. https://en.wikipedia.org/wiki/Android_Tactical_Assault_Kit https://en.wikipedia.org/wiki/Android_Tactical_Assault_Kit
- masterjefferson 7y agoI've worked on ATAK. It is a very capable combat tool.
- mirimir 7y agoHow do they secure baseband?
- jauer 7y agoAlready exists (well, not iPhone, but...) https://www.samsung.com/us/business/solutions/industries/government/tactical-edition/ https://www.samsung.com/us/business/solutions/industries/gov... And accessories like cases and cables from Kagwerks: https://kagwerks.com/collections/smartphone-cases https://kagwerks.com/collections/smartphone-cases / https://kagwerks.com/collections/cables/products/usb-3-0-to-mighty-mouse-cable-for-s5 https://kagwerks.com/collections/cables/products/usb-3-0-to-... (aside: their training courses are A+)
- jandrewrogers 7y agoThis has been rolling out for a couple years across parts of the US government. The primary objective, as I understand it, is to eliminate the pervasive use of WhatsApp and Gmail for unclassified communication for security reasons.
- Bahamut 7y agoThe ironic part is the military lives on regular text messaging as it is.
- AcerbicZero 7y agoATAK already has several hundred thousand end users, and is likely going to continue growing in popularity in the domestic environment. Extensions of the FBCB2/BFT concept have been none stop since the 90's really. The tactical cell phone has already found its place on the modern battlefield. This directive however, likely has nothing to do with combat. Its more likely related to trying to maintain some semblance of OpSec when things which shouldn't be sent over these cell phones ends up being sent over these cell phones and to help avoid every other private from texting mom/dad/gf things which will then be immediately leaked, by reminding them of the "seriousness" of the situation.
- killjoywashere 7y agoTurns out the US military also buys lots of commercial off the shelf stuff, including vast quantities of #10 letter envelopes for their mail. The US Defense establishment has thoroughly accepted the fact that they can't out-innovate commercial companies in a commercially viable space. Using the COTS top 5 or 10 is entirely reasonable in such cases. We fly troops on Delta and American too. I bet a few even flew in Boeing 737 Maxes. Perfect? No. Excellent decision among some number of possibly better decisions, that could have been made at the time? Yes.
- upofadown 7y agoWhy wouldn't they just install and use a boring old corporate style XMPP system with auditing? Everything would be open source and entirely under their control. Why would you want something that had to send traffic outside of the VPN?