4 ms·

If this isn't merely a joke, and these proposed files are intended to contain Cellebrite exploits of some kind, then please, Moxie, let us have an opt out? As

If this isn't merely a joke, and these proposed files are intended to contain Cellebrite exploits of some kind, then please, Moxie, let us have an opt out? As it stands, if law enforcement for some bizarre reason decide to examine my personal devices, there will be nothing on there of interest to them. If Signal start bundling exploits onto my device, that will no longer be the case. That's a potential risk to me, and Signal should be asking my permission before taking the risk.

spaceribs 6y ago
I probably broke 10 laws/regulations without knowing it just this morning before coffee, what makes you think you know you're "innocent"?
celticninja 6y ago
Dont think of them as cellebrite exploits but as Signal security features. Yes you have nothing to hide, but the police in many cases aren't honest. What if you live in the Middle east and are gay, you use signal, this protects you. Cellebrite are happy to sell their product to oppressive regeimes and if you are black the US police could be considered oppressors.
- ISL 6y ago
  If you're being oppressed by a repressive regime, having a phone that damages the oppressor's infrastructure may not have a positive outcome for you, the individual. "Hey, your phone corrupted our 'lawful' intrusion system. That violates a long list of statutes. We're going to beat you with this wrench now, because you made our day worse, and then charge you with crimes against the state."
  - celticninja 6y ago
    If they will beat you with a wrench for that they will beat you regardless of what is in your phone. If they do find something they dont like you get hit with the wrench, if they don't find anything you must be hiding it so you get beat with the wrench. So now we are saying don't protect yourself because if you do that would imply you have something to hide,and are therefore guilty and deserving of the wrench beating.
    - ISL 6y ago
      My concern is really, "Signal has a beef with Cellebrite, and so some unsuspecting and innocent person gets hit with a wrench." It is a different game if Signal makes the sharding opt-in. If someone vacuums my phone and it turns out that my treatise about Little Bobby Tables [1] breaks the vacuum, that is fine by me. [1] https://xkcd.com/327/ https://xkcd.com/327/
      - celticninja 6y ago
        We should all have beef with cellebrite. Have you seen their customer list? If they make it opt-in then surely that is worse for the user. Then the oppressive regime can say "you deliberately did this thing".
        ISL 6y ago
        The older I get, the more I find myself reticent to impose my 'shoulds' (I have many :) ) upon others. It is a complicated world.
      - 8note 6y ago
        Using signal is opt in, and using it is likely a reason to be hit by a wrench by these regimes anyways.
thecrash 6y ago
In this (somewhat contrived) scenario where authorities are targeting your phone for surveillance solely to access a possible exploit file placed there by Signal, how would an opt-out option help you? Do you imagine that you could explain to the authorities that you opted out, and they would send you on your way? Or do you imagine that they would hold you personally responsible for the exploit, even though Signal has publicly taken credit for doing this?
- gnfargbl 6y ago
  That is not the scenario I'm outlining. I am outlining a hypothetical scenario where the authorities choose to look through my phone for ${UNRELATED_REASON}, and the presence of Signal's hypothetical exploit files would cause their digital forensics software to crash. In this hypothetical scenario, that crash in and of itself could then be taken as a reason to charge me. I don't believe "the app software maker selected my phone at random to have those files on it!" would help me out in that situation; that's the sort of nuance that tends to get completely lost. The opt-out option would help me because, having opted out in advance, the hypothetical exploit files would not be on my phone. I do agree that this is a slightly far-fetched scenario. However, I am very confused how HN can generally be of the opinion that having unwanted malware on your phone is a good thing, even if Signal put it there.
  - ellenhp 6y ago
    I think this is my first-ever comment on HN, and I'm basically just chiming in to say that under no circumstances should you even be talking to police in a situation like this. You can politely ask for a lawyer, politely ask if you're being detained and politely provide your basic information when asked like your name and address, but otherwise do not say anything at all. This fantasy that you can get away from a situation in which you are being interrogated and your phone is being searched by being compliant and proving your innocence to the nice police officers is extremely dangerous. Being compliant and providing information beyond what's legally required is the exact opposite of what you want to do, and preventing yourself from being charged should be the last thing on your mind. You should take it as a given that you will be charged. edit: If you're outside the USA ignore this advice and listen to someone more local who knows their stuff.
deleted 6y ago
[deleted]
Silhouette 6y ago
What's with all the downvotes? The parent is asking a reasonable question and making a reasonable request.
ruined 6y ago
there are plenty of things to fear in police custody and the police don’t need a reason like that for any of them. they will simply do it if they want.
CleaveIt2Beaver 6y ago
Except there's no guarantee your phone will even contain a payload. Just the chance that some devices may have it, and there's no way to know for certain. And if they take in even one phone to scan that carries the exploit, it can make past, current and future evidence rendered untrustworthy. It's herd immunity via the prisoner's dilemma.

spaceribs 6y ago

I probably broke 10 laws/regulations without knowing it just this morning before coffee, what makes you think you know you're "innocent"?

celticninja 6y ago

Dont think of them as cellebrite exploits but as Signal security features. Yes you have nothing to hide, but the police in many cases aren't honest. What if you live in the Middle east and are gay, you use signal, this protects you. Cellebrite are happy to sell their product to oppressive regeimes and if you are black the US police could be considered oppressors.

ISL 6y ago
If you're being oppressed by a repressive regime, having a phone that damages the oppressor's infrastructure may not have a positive outcome for you, the individual. "Hey, your phone corrupted our 'lawful' intrusion system. That violates a long list of statutes. We're going to beat you with this wrench now, because you made our day worse, and then charge you with crimes against the state."
- celticninja 6y ago
  If they will beat you with a wrench for that they will beat you regardless of what is in your phone. If they do find something they dont like you get hit with the wrench, if they don't find anything you must be hiding it so you get beat with the wrench. So now we are saying don't protect yourself because if you do that would imply you have something to hide,and are therefore guilty and deserving of the wrench beating.
  - ISL 6y ago
    My concern is really, "Signal has a beef with Cellebrite, and so some unsuspecting and innocent person gets hit with a wrench." It is a different game if Signal makes the sharding opt-in. If someone vacuums my phone and it turns out that my treatise about Little Bobby Tables [1] breaks the vacuum, that is fine by me. [1] https://xkcd.com/327/ https://xkcd.com/327/
    - celticninja 6y ago
      We should all have beef with cellebrite. Have you seen their customer list? If they make it opt-in then surely that is worse for the user. Then the oppressive regime can say "you deliberately did this thing".
      - ISL 6y ago
        The older I get, the more I find myself reticent to impose my 'shoulds' (I have many :) ) upon others. It is a complicated world.
    - 8note 6y ago
      Using signal is opt in, and using it is likely a reason to be hit by a wrench by these regimes anyways.

thecrash 6y ago

In this (somewhat contrived) scenario where authorities are targeting your phone for surveillance solely to access a possible exploit file placed there by Signal, how would an opt-out option help you? Do you imagine that you could explain to the authorities that you opted out, and they would send you on your way? Or do you imagine that they would hold you personally responsible for the exploit, even though Signal has publicly taken credit for doing this?

gnfargbl 6y ago
That is not the scenario I'm outlining. I am outlining a hypothetical scenario where the authorities choose to look through my phone for ${UNRELATED_REASON}, and the presence of Signal's hypothetical exploit files would cause their digital forensics software to crash. In this hypothetical scenario, that crash in and of itself could then be taken as a reason to charge me. I don't believe "the app software maker selected my phone at random to have those files on it!" would help me out in that situation; that's the sort of nuance that tends to get completely lost. The opt-out option would help me because, having opted out in advance, the hypothetical exploit files would not be on my phone. I do agree that this is a slightly far-fetched scenario. However, I am very confused how HN can generally be of the opinion that having unwanted malware on your phone is a good thing, even if Signal put it there.
- ellenhp 6y ago
  I think this is my first-ever comment on HN, and I'm basically just chiming in to say that under no circumstances should you even be talking to police in a situation like this. You can politely ask for a lawyer, politely ask if you're being detained and politely provide your basic information when asked like your name and address, but otherwise do not say anything at all. This fantasy that you can get away from a situation in which you are being interrogated and your phone is being searched by being compliant and proving your innocence to the nice police officers is extremely dangerous. Being compliant and providing information beyond what's legally required is the exact opposite of what you want to do, and preventing yourself from being charged should be the last thing on your mind. You should take it as a given that you will be charged. edit: If you're outside the USA ignore this advice and listen to someone more local who knows their stuff.

deleted 6y ago

[deleted]

Silhouette 6y ago

What's with all the downvotes? The parent is asking a reasonable question and making a reasonable request.

ruined 6y ago

there are plenty of things to fear in police custody and the police don’t need a reason like that for any of them. they will simply do it if they want.

CleaveIt2Beaver 6y ago

Except there's no guarantee your phone will even contain a payload. Just the chance that some devices may have it, and there's no way to know for certain. And if they take in even one phone to scan that carries the exploit, it can make past, current and future evidence rendered untrustworthy. It's herd immunity via the prisoner's dilemma.