3 ms·

How do they get the key? This sounded like just the process you’d use once you have the key, but getting the key is presumably the hardest part. So, is Signal

by ada1981 6y ago

How do they get the key? This sounded like just the process you’d use once you have the key, but getting the key is presumably the hardest part. So, is Signal Secure?

gizzlon 6y ago
Secure vs what? Or whom? Or in what scenarios? Nothing on earth "is secure" =)
MacsHeadroom 6y ago
> How do they get the key Cellebrite doesn't have a way to extract secrets from an HSM for Signal or any other app. If the secrets aren't in an HSM, then they have this new feature to automatically take advantage of that. So Signal is still secure. Just perhaps not on a $50 Cricket phone with no HSM. But then again, neither is anything else.
- polar 6y ago
  > Just perhaps not on a $50 Cricket phone with no HSM. On some more expensive devices keys can be obtained from RAM[1]. [1] https://www.cellebrite.com/en/blog/decrypting-databases-using-ram-dump-health-data/ https://www.cellebrite.com/en/blog/decrypting-databases-usin...
  - MacsHeadroom 6y ago
    If the keys are in RAM then they aren't in an HSM- they're in RAM (as well as the HSM, but that's irrelevant). More importantly, the app is already unlocked anyway if the keys are in RAM. So that just lets you keep it unlocked. It doesn't help you unlock an app that was locked when you got access to the device.
    - polar 6y ago
      Indeed. It is still very useful to an investigator who has to examine an unlocked device -- in most corporate investigations this is unlikely to be an issue. Forensic examiners working for the police are likely to have more of a hard time getting codes etc., but they have access to more advanced services[1][2]. [1] https://www.msab.com/2018/12/11/msab-introduces-access-services-to-help-customers-get-access-to-the-most-challenging-mobile-phones/ https://www.msab.com/2018/12/11/msab-introduces-access-servi... [2] https://www.cellebrite.com/en/advanced-services/ https://www.cellebrite.com/en/advanced-services/

How do they get the key? This sounded like just the process you’d use once you have the key, but getting the key is presumably the hardest part. So, is Signal Secure?

gizzlon 6y ago

Secure vs what? Or whom? Or in what scenarios? Nothing on earth "is secure" =)

MacsHeadroom 6y ago

> How do they get the key Cellebrite doesn't have a way to extract secrets from an HSM for Signal or any other app. If the secrets aren't in an HSM, then they have this new feature to automatically take advantage of that. So Signal is still secure. Just perhaps not on a $50 Cricket phone with no HSM. But then again, neither is anything else.

polar 6y ago
> Just perhaps not on a $50 Cricket phone with no HSM. On some more expensive devices keys can be obtained from RAM[1]. [1] https://www.cellebrite.com/en/blog/decrypting-databases-using-ram-dump-health-data/ https://www.cellebrite.com/en/blog/decrypting-databases-usin...
- MacsHeadroom 6y ago
  If the keys are in RAM then they aren't in an HSM- they're in RAM (as well as the HSM, but that's irrelevant). More importantly, the app is already unlocked anyway if the keys are in RAM. So that just lets you keep it unlocked. It doesn't help you unlock an app that was locked when you got access to the device.
  - polar 6y ago
    Indeed. It is still very useful to an investigator who has to examine an unlocked device -- in most corporate investigations this is unlikely to be an issue. Forensic examiners working for the police are likely to have more of a hard time getting codes etc., but they have access to more advanced services[1][2]. [1] https://www.msab.com/2018/12/11/msab-introduces-access-services-to-help-customers-get-access-to-the-most-challenging-mobile-phones/ https://www.msab.com/2018/12/11/msab-introduces-access-servi... [2] https://www.cellebrite.com/en/advanced-services/ https://www.cellebrite.com/en/advanced-services/