9 ms·

All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. The question is are you a valuable enough asset that they are gu

• rapsey 6y ago
  > All nation-state governments are just buying 0days from companies like NSO Group and Zerodium. USA/Russia/Israel for sure have these programs. > The question is are you a valuable enough asset that they are gunna burn their $50M 0day just to get your device. You are at least an order of magnitude overshooting the price. Also what is the percentage of Android phones not on the latest security patches and pretty much wide open for known 0days? For sure 90%+. This tech is available for anyone with enough money, there are plenty of bad guy rich people. An actual investigative journalist can easily make an enemy of a rich person. > I think Signal is pretty safe from such things. You base this information on what? If someone is executing code as root on your phone they can absolutely use the method describe in the Cellebrite article.
  • richardlblair 6y ago
    If someone has gained root you're done. Every application must be assumed to be unsafe at that point. This isn't news, and it doesn't mean signal is broken.
  • Erlich_Bachman 6y ago
    Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...
    • rapsey 6y ago
      > Not sure what you expect Signal to do about this... Be upfront about it. The vast majority of their users, even those who should know better do not realize this. 0days are not that expensive. Within reach of practically any bad guy really. They are highly proud of Snowden recommending them. But anyone operating on the level he did is a moron to trust Signal. So what the fuck?
      • NateEag 6y ago
        https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
      • roywiggins 6y ago
        If you're worried about dragnet surveillance- which is a large proportion of what Snowden revealed- then Signal is not a bad thing to recommend. There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition.
        • rapsey 6y ago
          > There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition. I don't know why everybody is repeating this as if I somehow don't understand that. My point is Signal is promoted as some sort of panacea by security professionals even though all that security can be bypassed, likely routinely by actual bad guys.
          • roywiggins 6y ago
            I mean that that Snowden specifically agitated about dragnet surveillance, so it's not at all surprising that he'd promote the encrypted messaging app that he thinks is the most effective against it. Has he ever said that Signal is the end-all, perfect solution that will prevent all kinds of threats and provide perfect privacy? I am sure there is a lot of sloppy messaging out there, but an endorsement along the lines of "I trust Signal's encryption and that it's not backdoored" is not unreasonable
          • 6y ago
    • grumple 6y ago
      Are there not any apps that do this? I notice that signal unlocks when you unlock the phone; are there not e2e messaging apps that require authentication (whether passcode or biometric) on unlocked devices? Just checked, Signal has this; does this actually serve to unencrypt the encryption key or is that still accessible as root?
      • Technically 6y ago
        It doesn't matter. You wait until the user auths and sniff the plaintext password out of memory. Root = game over.
  • Technically 6y ago
    What app can withstand attack from a rooted process?