5 ms·
> If you have your device, Cellebrite is not your concern. But if the attacker has a 0day, which likely all the big players do, they don't need your physical d
by rapsey 6y ago
> If you have your device, Cellebrite is not your concern.
But if the attacker has a 0day, which likely all the big players do, they don't need your physical device. Which means signal will do squat to protect your data in that case.
- edm0nd 6y agoAll nation-state governments are just buying 0days from companies like NSO Group and Zerodium. The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. I think Signal is pretty safe from such things. Better than for example Whatsapp. Which seems to be where a majority of these nation-states using their 0days and exploits on.
- rapsey 6y ago> All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. USA/Russia/Israel for sure have these programs. > The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+. This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person. > I think Signal is pretty safe from such things. You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.
- richardlblair 6y agoIf someone has gained root you're done. Every application must be assumed to be unsafe at that point. This isn't news, and it doesn't mean signal is broken.
- Erlich_Bachman 6y agoGood luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...
- rapsey 6y ago> Not sure what you expect Signal to do about this... Be upfront about it. The vast majority of their users, even those who should know better do not realize this. 0days are not that expensive. Within reach of practically any bad guy really. They are highly proud of Snowden recommending them. But anyone operating on the level he did is a moron to trust Signal. So what the fuck?
- NateEag 6y agohttps://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
- roywiggins 6y agoIf you're worried about dragnet surveillance- which is a large proportion of what Snowden revealed- then Signal is not a bad thing to recommend. There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition.
- rapsey 6y ago> There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition. I don't know why everybody is repeating this as if I somehow don't understand that. My point is Signal is promoted as some sort of panacea by security professionals even though all that security can be bypassed, likely routinely by actual bad guys.
- roywiggins 6y agoI mean that that Snowden specifically agitated about dragnet surveillance, so it's not at all surprising that he'd promote the encrypted messaging app that he thinks is the most effective against it. Has he ever said that Signal is the end-all, perfect solution that will prevent all kinds of threats and provide perfect privacy? I am sure there is a lot of sloppy messaging out there, but an endorsement along the lines of "I trust Signal's encryption and that it's not backdoored" is not unreasonable
- Technically 6y agoWhat app can withstand attack from a rooted process?
- pkulak 6y agoUnless you use disappearing messages and view-once media messages like mentioned in the linked post.
- roywiggins 6y agoThose features help against Cellebrite but not against actual 0days which can read incoming messages in real-time. If the NSO has a rootkit installed on your phone, it doesn't matter that Signal is shredding messages after you read them.
- richardlblair 6y agoYes, this is true for literally anything. All you just said is "If your device is compromised your device is compromised". That's not profound.
- rapsey 6y agoIt is when the vast majority of users relying on Signal security, sometimes with their lives, do not know that fact.
- Throwaway1771 6y agoThis isn't a Signal problem. It's a pervasive problem of lack of technology and security education in the West. Not a priority for US etc to show people how to secure themselves.
- croes 6y agoIf anyone has access to your device, your data can't be protected, don't matter if physical or remote access. The attacker could simply log all your passwords, so there is nothing signal nor any other software could to.
- londons_explore 6y agoAnd more importantly, any software which claims to have "antimalware" or "anti-rootkit" or similar techniques is snake oil... Above using the platforms secure storage for secrets, there is nothing more an app should do.
- Brian_K_White 6y agoThis isn't a useful observation. A communication has many links in a chain. Some links in most chains will have some weakness or other. So what? That does not mean that there is no value in the strong links. You might as well say "But if the attacker has a sniper, which likely all the big players do, they don't need to read you communications to get you, they can just shoot you from across the street. Which means Signal will do squat to protect your life in that case."
- rapsey 6y agoIt is a useful observation when the vast majority of users using Signal do not realize this.