4 ms·

Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do abou

Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...

rapsey 6y ago
> Not sure what you expect Signal to do about this... Be upfront about it. The vast majority of their users, even those who should know better do not realize this. 0days are not that expensive. Within reach of practically any bad guy really. They are highly proud of Snowden recommending them. But anyone operating on the level he did is a moron to trust Signal. So what the fuck?
- NateEag 6y ago
  https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
- roywiggins 6y ago
  If you're worried about dragnet surveillance- which is a large proportion of what Snowden revealed- then Signal is not a bad thing to recommend. There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition.
  - rapsey 6y ago
    > There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition. I don't know why everybody is repeating this as if I somehow don't understand that. My point is Signal is promoted as some sort of panacea by security professionals even though all that security can be bypassed, likely routinely by actual bad guys.
    - roywiggins 6y ago
      I mean that that Snowden specifically agitated about dragnet surveillance, so it's not at all surprising that he'd promote the encrypted messaging app that he thinks is the most effective against it. Has he ever said that Signal is the end-all, perfect solution that will prevent all kinds of threats and provide perfect privacy? I am sure there is a lot of sloppy messaging out there, but an endorsement along the lines of "I trust Signal's encryption and that it's not backdoored" is not unreasonable
    - renewiltord 6y ago
      I think the problem here is that you have misinterpreted a recommendation that is using the median risk as a recommendation that is using the p100 risk. Allow me to correct that for you: security professionals are not recommending Signal as protection against the p100 risk. Hope that helps.
    - Throwaway1771 6y ago
      You can't say a firewall is insecure because someone installed it in a network where one can walk in freely and take the passwords off of the sticky note on the desk.
  - SVFafgg0t 6y ago
    I wonder why noone makes a 'no root system' su root NO su no YES. so you're user YES, which is NO-root, but YES rm -rf / Great Sucess. NO or NON root system, it seems like a marketable gimmick. Must be up your people's ass.
grumple 6y ago
Are there not any apps that do this? I notice that signal unlocks when you unlock the phone; are there not e2e messaging apps that require authentication (whether passcode or biometric) on unlocked devices? Just checked, Signal has this; does this actually serve to unencrypt the encryption key or is that still accessible as root?
- Technically 6y ago
  It doesn't matter. You wait until the user auths and sniff the plaintext password out of memory. Root = game over.

Good luck finding a messenger app that can help you when "they have root access to my phone" is in your threat model. Not sure what you expect Signal to do about this...

rapsey 6y ago

> Not sure what you expect Signal to do about this... Be upfront about it. The vast majority of their users, even those who should know better do not realize this. 0days are not that expensive. Within reach of practically any bad guy really. They are highly proud of Snowden recommending them. But anyone operating on the level he did is a moron to trust Signal. So what the fuck?

NateEag 6y ago
https://medium.com/message/everything-is-broken-81e5f33a24e1 https://medium.com/message/everything-is-broken-81e5f33a24e1
roywiggins 6y ago
If you're worried about dragnet surveillance- which is a large proportion of what Snowden revealed- then Signal is not a bad thing to recommend. There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition.
- rapsey 6y ago
  > There are no apps that resist the phone being rooted. Everyone is vulnerable to 0days by definition. I don't know why everybody is repeating this as if I somehow don't understand that. My point is Signal is promoted as some sort of panacea by security professionals even though all that security can be bypassed, likely routinely by actual bad guys.
  - roywiggins 6y ago
    I mean that that Snowden specifically agitated about dragnet surveillance, so it's not at all surprising that he'd promote the encrypted messaging app that he thinks is the most effective against it. Has he ever said that Signal is the end-all, perfect solution that will prevent all kinds of threats and provide perfect privacy? I am sure there is a lot of sloppy messaging out there, but an endorsement along the lines of "I trust Signal's encryption and that it's not backdoored" is not unreasonable
  - renewiltord 6y ago
    I think the problem here is that you have misinterpreted a recommendation that is using the median risk as a recommendation that is using the p100 risk. Allow me to correct that for you: security professionals are not recommending Signal as protection against the p100 risk. Hope that helps.
  - Throwaway1771 6y ago
    You can't say a firewall is insecure because someone installed it in a network where one can walk in freely and take the passwords off of the sticky note on the desk.
- SVFafgg0t 6y ago
  I wonder why noone makes a 'no root system' su root NO su no YES. so you're user YES, which is NO-root, but YES rm -rf / Great Sucess. NO or NON root system, it seems like a marketable gimmick. Must be up your people's ass.

grumple 6y ago

Are there not any apps that do this? I notice that signal unlocks when you unlock the phone; are there not e2e messaging apps that require authentication (whether passcode or biometric) on unlocked devices? Just checked, Signal has this; does this actually serve to unencrypt the encryption key or is that still accessible as root?

Technically 6y ago
It doesn't matter. You wait until the user auths and sniff the plaintext password out of memory. Root = game over.