4 ms·
My reading is that the owner of any device the provider previously plugged in to could exfiltrate your mother's data by installing a persistent backdoor. Since
by amscanne 6y ago
My reading is that the owner of any device the provider previously plugged in to could exfiltrate your mother's data by installing a persistent backdoor. Since this is a phone, I assume this includes email, passwords, etc. and they could use this data to e.g. access your mother's financial accounts. This is a fantastic vector for criminals.
Signal is providing a strong, albeit rude (likely in response to Cellebrite's claims), incentive to fix their shit. Would you rather have a temporary period where transfers weren't working, or deal with the scenario above in a year?
- junon 6y ago> weren't working If that were the case, fine. But the post does not specify the effect of the "aesthetically pleasing" files. They could destroy all Signal data or irreversibly harm the machine itself. We just have to "trust" the Signal devs to not do that? This is not how security should work.
- amscanne 6y agoHuh? Don't you trust the Signal devs to not destroy all Signal data every day? You're trusting the Signal devs to your keep messages safe and secure. I don't know if that means wiping all messages when accessed via Cellebrite, but that seems like a reasonable option. My assumption would be that they will just crash or brick the Cellebrite software. Either way and completely independently of the aesthetically pleasing files, if you disagree with the choices Signal makes to keep your messages safe and secure, there are many other messaging options that you can use. Publicly calling out big security problems is exactly how security should work (notwithstanding specifics of disclosure).
- junon 6y agoBecause when my mother has to transfer her phone, she'll then be liable for thousands of dollars of damage to their property, and she'd otherwise have no idea why. That's the problem. The fact nobody sees the effects of this is absolutely surreal and alarming.
- jamespo 6y agoYeah, that's not going to happen
- deleted 6y ago[deleted]
- arepublicadoceu 6y agoI’m not sure how your judicial system works but, in my country you can’t be hold responsible for something that “you have no idea why”. That’s not how liability works.
- junon 6y agoIn the US, you are not exempt from liability just for ignorance. If you don't know how to pay your taxes, you're still required to pay your taxes.
- amscanne 6y agoOn what basis would you sue someone for software crashing when you plug in their device?
- junon 5y agoProperty damage, of course.