6 ms·
If you own the phone, the messages are decrypted. This seems to be more about the phone access than anything to do with Signal, right?
by everdrive 6y ago
If you own the phone, the messages are decrypted. This seems to be more about the phone access than anything to do with Signal, right?
- keyme 6y agoOf course. All these articles and "criticisms" of Signal started popping up right after the recent WhatsApp mini exodus. What a coincidence.
- TaylorAlexander 6y agoI mean it makes sense. People are concerned about data privacy on WhatsApp so they move to signal. Then the people who have always said “signal isn’t perfectly secure” must reiterate to the masses what that have said many times before.
- baxtr 6y agoMaybe your assumption that something dubious is going on can be eliminated by Occam's razor? Because: any business that gains in popularity will automatically also see higher press coverage.
- EGreg 6y agoJust like women in tech — or any male dominated industries — have proportionately more unfortunate encounters with men because each woman has more men around her to begin with?
- cyberlurker 6y agoWhere is the data that “women specifically in tech have more unfortunate encounters with men” than other industries?
- filoleg 6y agoIsn't it the case not just in tech, but literally in any field that is male-dominated? I strongly doubt that the problem you describe is any less prevalent in finance or academia, for example. Not a comprehensive list, of course, those were just two off the top of my head.
- EGreg 6y agoYes obviously any male dominated industries was the point
- marricks 6y agoOccam's razor is good in theory but when you have powerful actors that can collude against people's best interest it's very harmful.
- johnisgood 6y agoWhatsApp is even worse, let us not even go there. If anything, I would go with Briar.
- TearsInTheRain 6y agoIf you raise Signal's profile then I think you can expect some half-informed tech journalists to start writing about it without fully understanding it.
- wp381640 6y agoAlternatively - you're only because you're noticing it now because of the WhatsApp drama Thomas Brewster has been on the encrypted messaging apps and law enforcement beat for a very long time and puts these stories out with regularity
- kerng 6y agoYes, nothing special - if someone else has your phone, it's not your phone anymore.
- bigiain 6y agoTo be fair, Apple and Google both put a lot of effort into making exploiting a phone as difficult as they can even in the case of an attacker having physical possession. I’d much rather have potential “evidence” against me on my phone, than on my laptop. The stakes are very high though, and the attackers very motivated and well resourced, and I suspect there’s enough political pressure on them both to do only “a good enough job to make it look like they’re succeeding”. If anybody thinks the NSA isn’t several steps ahead of both Apple/Google and NSO/GreyKey, wtheyre fooling themselves...
- TwoBit 6y agoDoes Signal not encrypt its DBs when not in use and upon shutdown? Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778 https://news.ycombinator.com/item?id=26096778
- pokoleo 6y agoGenerally: If someone has physical access to a device, you can probably assume they control it.
- SailingSperm 6y agoThis should bring into question even more Signal's implementation of using real phone numbers for accounts. It is NOT privacy focused. Even if this 'hackability' is an issue only with the security of the phone/hardware - able to be hacked and thus reach the decrypted signal messages - That also means, that person's Signal contacts also have their real identities exposed. (Where they wouldn't be if the account names/ids could be arbitrary like eg. wickr)
- deleted 6y ago[deleted]
- mr_toad 6y ago> It is NOT privacy focused. It’s not anonymity focused. If I want to have private conversations with friends, family or colleagues signal is fine.
- SailingSperm 6y agoPrivacy encapsulates anonymity. Who you are talking to should be just as private as the contents of the message. Anonymity aids privacy.
- bigiain 6y agoNot sure I agree. We expect heads of state to be able to have “private” discussions while knowing the other heads of state they may be communicating with. I can have “private” conversations with my partner, even though people know who that is. You can also choose to anonymously communicate with no privacy, Reddit or 4chan style... They may not be totally orthogonal, but I don’t think either privacy nor anonymity are encapsulated by each other.
- SailingSperm 6y agoYou're just describing levels of privacy. Head's of state can of course have private discussions, where only the contents of conversation is private - but the fact the conversations took place are not private. Compare that to AnonA talked to AnonB - We're still aware two people communicated, but it's even more private as we can't infer their relationship (And probabilities about what might have been discussed - from other metadata of the conversation time,place,duration,frequency). And finally, perfect privacy nobody knows that a conversation took place in the first place and the contents are unknown too. There is also still privacy in public communications when done anonymously, as you can't tie the information disclosed to the real identity (necessarily). -- Hence why for privacy purposes advertising data is often anonymized. (But again, less private of course, if ie I said I was a 2 fingered man in Poland and there is only 5 people fitting that description) So I'd still say, perfect privacy cannot occur without anonymity.
- elliekelly 6y agoThe iPhone's terrible battery life isn't a bug, it's a privacy feature! I wonder if the FBI's evidence protocol involves immediately plugging in an iPhone to maintain the vulnerable state: > That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that is locked but that has been unlocked once and not turned off. An iPhone in this state is more susceptible to having data inside extracted because encryption keys are stored in memory. I do wish Apple would add "restart" as one of the system actions in the Shortcuts app.
- sneak 6y agoOne thing they did do: if you bring up the power off screen (by holding power, or power+volume up, depending on model) then it disables biometric unlock, even if you don't power it off. Bringing up the power off slider screen is sufficient to force a passcode-only unlock.
- gen3 6y agoYou can also disable biometrics by spamming the lock button.
- polote 6y agoSoon we will have an article about "If you use Signal to talk to your mother, FBI can see your messages if your mother send them to them"
- TwoBit 6y agoSeems like this is partially Signal's fault to me. Why doesn't Signal independently encrypt the message db when not in use? It's well known at this point that iPhone is easily cracked, and thus Signal provides no security for a stolen phone. Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778 https://news.ycombinator.com/item?id=26096778
- nucleardog 6y ago> Why doesn't Signal independently encrypt the message db when not in use? To what end? If there's no additional authentication required to open the app and just view the messages normally, it's useless because they can just open the app and view the messages. If they use their existing PINs as key material then, given an OS-level exploit grants access to the underlying database, it can be cracked offline in... basically no time at all. If they allow you to create a long, secure password for opening the app, basically nobody uses it because nobody wants to type a 30 character password on a phone touchscreen every time they want to check/send a message. Pretty much any solution that doesn't absolutely destroy usability still relies on the OS performing some sort of authentication first. (As in the current solution where the encryption keys are stored in the OS-level key store.) If you're that concerned about your security, just go disable FaceID/TouchID so the iPhone never leaves keys in memory when it's locked.