4 ms·

Only if you take Signal’s word for it. As impressive as the hack looks, we are putting trust in Signal that it’s real since they didn’t disclose the vulnerabil

Only if you take Signal’s word for it. As impressive as the hack looks, we are putting trust in Signal that it’s real since they didn’t disclose the vulnerability and no one else has reproduced it. It could just be a clever attempt at socially engineering the public opinion of Cellebrite. I posted a more detailed analysis on the original story: https://news.ycombinator.com/item?id=26898638 https://news.ycombinator.com/item?id=26898638

ryukafalz 6y ago
Even if they published the vulnerability, none of us could attempt to reproduce it anyway because the software isn't available. (I mean, unless another one falls off a truck. ;) Public opinion of Cellebrite was already extremely low.
cronix 6y ago
> It could just be a clever attempt at socially engineering the public opinion of Cellebrite. If so, that sounds potentially libelous (IANAL).
- tediousdemise 6y ago
  Indeed. This whole effort was done out of retaliation and spite, so I wouldn’t put libel beneath them either.
- Y_Y 6y ago
  It's not libel if you can prove it's true.
  - tediousdemise 6y ago
    If Signal cannot prove the vulnerability is real, which they contemptuously refuse to do in blog post, then it stands as libel.
    - deleted 6y ago
      [deleted]
- anonAndOn 6y ago
  Even if that were true, those trade secrets will never be defended in open court. The best Cellebrite can do here is a PR campaign to downplay the veracity of this. "There's nothing to see here, folks!"
bawolff 6y ago
If signal was lying, it would probably be easy to prove (at the very least the version of ffmpeg included is easy to prove/disorove. Ditto on the apple libraries). Honestly, i would be very surprised if cellebrite didn't have massive vulns. Its the type of software that always does.
- tediousdemise 6y ago
  From Signal’s blog post: > As just one example (unrelated to what follows), their software bundles FFmpeg DLLs that were built in 2012 and have not been updated since then. This purported vulnerability is not related to FFmpeg in any way, hence the disclaimer.

ryukafalz 6y ago

Even if they published the vulnerability, none of us could attempt to reproduce it anyway because the software isn't available. (I mean, unless another one falls off a truck. ;) Public opinion of Cellebrite was already extremely low.

cronix 6y ago

> It could just be a clever attempt at socially engineering the public opinion of Cellebrite. If so, that sounds potentially libelous (IANAL).

tediousdemise 6y ago
Indeed. This whole effort was done out of retaliation and spite, so I wouldn’t put libel beneath them either.
Y_Y 6y ago
It's not libel if you can prove it's true.
- tediousdemise 6y ago
  If Signal cannot prove the vulnerability is real, which they contemptuously refuse to do in blog post, then it stands as libel.
  - deleted 6y ago
    [deleted]
anonAndOn 6y ago
Even if that were true, those trade secrets will never be defended in open court. The best Cellebrite can do here is a PR campaign to downplay the veracity of this. "There's nothing to see here, folks!"

bawolff 6y ago

If signal was lying, it would probably be easy to prove (at the very least the version of ffmpeg included is easy to prove/disorove. Ditto on the apple libraries). Honestly, i would be very surprised if cellebrite didn't have massive vulns. Its the type of software that always does.

tediousdemise 6y ago
From Signal’s blog post: > As just one example (unrelated to what follows), their software bundles FFmpeg DLLs that were built in 2012 and have not been updated since then. This purported vulnerability is not related to FFmpeg in any way, hence the disclaimer.