5 ms·
My 65 year old mother and I use Signal as we live across the planet from each other. She's due for a new phone soon, and the cell companies use Cellebrite to t
by junon 6y ago
My 65 year old mother and I use Signal as we live across the planet from each other.
She's due for a new phone soon, and the cell companies use Cellebrite to transfer data from one phone to another.
She will almost certainly want them to do it as I'm not there to help her in person.
What happens when Signal shards to her device and uses it as a weapon against the machine and her phone is bricked or she's liable for the machine's costs or our entire history is deleted or something just as destructive?
Please don't force your threat model down our throats. Your hacktivism is not my hacktivism. This shit better be opt-in.
- corndoge 6y agoIt's not Signal's job to work around deficient carrier tools.
- junon 6y agoIt's not Signal's job nor their place to weaponize their users' devices without permission. This is incredibly unethical.
- thecrash 6y agoYou're fabricating complications which don't make any technical sense as a justification to be angry about this basically harmless gesture. If you are that averse to the idea of being even remotely complicit in jamming the surveillance state, just don't use Signal.
- junon 6y agoFirstly, never has it been a requirement to "jam the surveillance state" to be a user of Signal. That's absolutely bananas. Did you read the text at the bottom of the post? They are randomly installing malware on users' devices to break or harm or otherwise self-destruct when Cellebrite machines read them. I'm not speaking for myself. I would opt in personally. I'm speaking for my mother who just wants a secure and reliable line of communication with her son without being pulled into some offensive scheme that could land HER in trouble or cause damages. If something is broken or destroyed without user knowledge or understanding or consent, you better believe Signal will see court cases.
- jamespo 6y agothere are plenty of other options than Signal, vote with your feet
- junon 6y agoName another privacy respecting application that can do calling and video between two phones with e2ee and is simple enough for a 65 year old non-tech-savvy woman to use. I'll switch her over immediately.
- quitethelogic 6y agoThe exploit targets Cellebrite, not Signal's own software. Cellebrite is running on the machine doing the extracting and not the device containing the original data. It's entirely possible that I'm wrong and this will cause your phone to explode, but if you don't trust the Signal developers enough to assume they won't intentionally explode your phone, you probably shouldn't be using their product.
- junon 6y agoI understand this. I'm saying my mother shouldn't be on the hook for her phone bricking a celebrity device used in good faith.
- amscanne 6y agoMy reading is that the owner of any device the provider previously plugged in to could exfiltrate your mother's data by installing a persistent backdoor. Since this is a phone, I assume this includes email, passwords, etc. and they could use this data to e.g. access your mother's financial accounts. This is a fantastic vector for criminals. Signal is providing a strong, albeit rude (likely in response to Cellebrite's claims), incentive to fix their shit. Would you rather have a temporary period where transfers weren't working, or deal with the scenario above in a year?
- junon 6y ago> weren't working If that were the case, fine. But the post does not specify the effect of the "aesthetically pleasing" files. They could destroy all Signal data or irreversibly harm the machine itself. We just have to "trust" the Signal devs to not do that? This is not how security should work.
- amscanne 6y agoHuh? Don't you trust the Signal devs to not destroy all Signal data every day? You're trusting the Signal devs to your keep messages safe and secure. I don't know if that means wiping all messages when accessed via Cellebrite, but that seems like a reasonable option. My assumption would be that they will just crash or brick the Cellebrite software. Either way and completely independently of the aesthetically pleasing files, if you disagree with the choices Signal makes to keep your messages safe and secure, there are many other messaging options that you can use. Publicly calling out big security problems is exactly how security should work (notwithstanding specifics of disclosure).
- junon 6y agoBecause when my mother has to transfer her phone, she'll then be liable for thousands of dollars of damage to their property, and she'd otherwise have no idea why. That's the problem. The fact nobody sees the effects of this is absolutely surreal and alarming.
- edenhyacinth 6y agoI think what you're missing is that Signal does not need to place any files on any phones for their purpose, and likely will not ever do so. Their intention is to render using Cellebrite for court evidence worthless by suggesting that the record could have been tampered with at any point, if any phone the user scanned had Signal on it. Proving that no phones ever had an 'aesthetic' file that could cause damage to Cellebrite is impossible, and they've provided clear reason why it is impossible to prove.
- GuB-42 6y agoMaybe, but an app that does what Moxie suggests is malware in my book. I don't think Signal will do that though, if it does, it will most likely get kicked out of every store and the company will most likely end up in well-deserved legal trouble, as if MOB wasn't shady enough... As someone else said, it is more likely to be a way to discredit evidence extracted by Cellebrite.
- ruined 6y agocellebrite is exactly the kind of threat signal is intended to foil. if you want cellebrite reading your messages, you are not the target userbase of signal. this is like complaining that “rm” deleted your files.
- GuB-42 6y agoEven if I am not the target userbase of Signal, which is partly true, by using it, I benefit those who really need it for its privacy features. The millions of users like me who do nothing sensitive with it add bulk to traffic, making it harder to single out "interesting" data. I mean, for example, if only criminals used Signal, just having the app will get you a lot of attention from the police, as it happened with Encrochat.
- unstatusthequo 6y agoThere are better ways to transfer contacts and photos. You trust the cell company to do it? To not maintain your / her data? To not share with law enforcement? Your threat model may be different than you realize.
- tandr 6y agoAsk her to uninstall it before going for upgrade. Then reinstall it remotely by using Google App store online - you can push installations to specific handset on the account.
- sambull 6y agoCellebrite is a digital intelligence company. Not a single mention of carrier or consumer tools, but lots about analyzing your data. I guess your cell phone company feeds every cell phone they work on to some centralized data repository (out of jurisdiction of your current locale) to be analyzed is what sounds like is going on.
- junon 6y agoYou've not done enough research then. Cellebrite has been around for ages. When I worked at radioshack, we would use them to transfer data from old phones to new ones. They did not connect to the internet at the time. These machines are still used for this purpose. I don't doubt they're also used for surveillance or tracking. But they're not only used for that. You're speculating as to what the phone companies do with the machines, especially given that it would be incredibly illegal to do so and trivial to whistleblow and thus a huge risk to the companies to do this on a widespread basis. Please provide proof instead of contributing to hysteria.
- celticninja 6y agoIt does not brick the device. It merely makes the reports it creates inaccurate. Your dear old mum won't care about that.
- junon 6y agoAnd where does Moxie say that's what the files do? You're speculating.
- viccuad 6y agoAll of this could be avoided if you were part of a different network. One where you can connect with several open source clients to the server, and choose a client that didn't behave like this. One where you could save your history from the client, if you wished to do so. You chose to get into a captive ecosystem; Signal's code-dump "look but don't touch" (well, clientside, serverside was closed source for a year). Signal's "our way or the highway".
- cblconfederate 6y agoif you re so lax about your data security, why do you use signal
- oh_sigh 6y agoSignal isn't going to do that. They just said they could do that. If you look at how they worded it, they could just drop empty files that literally do nothing (even to Cellebrite).