5 ms·

Yes, although the way around this for law enforcement is to pressure Apple and Google to remove Signal from the App Store/Play respectively (to protect children

Yes, although the way around this for law enforcement is to pressure Apple and Google to remove Signal from the App Store/Play respectively (to protect children!) and work on operating system level bypasses of Signal. I am fearing this scenario.

tyingq 5y ago
I wonder how far they could go in compelling Signal to push a change that let more info leak for a specific user. I know there have been somewhat similar cases where companies were compelled to add new functionality, logs, etc, to capture info for a specific user.
- BrandoElFollito 5y ago
  Every time I see similar questions, I just wonder why companies such as Signal do not put in place a mechanism to veto changes across countrie. If they had developers in, say, France, who would need to accept changes made somewhere else then a single country could not force such secret modifications. Of course an app is actually a binary, so there must be a way to verify that code + compilation = the published binary.
- JTbane 5y ago
  Might go full idiotic like the Australian government and mandate backdoors
- Thorentis 5y ago
  I'm surprised the FBI has tried to get a custom keyboard into the Play Store yet, or asked Google to add a key logger to the stock one. Sure, the legality is blury at the moment, but it's just a matter of changing some laws and then that becomes legal.
  - monocasa 5y ago
    I assume Google's reports back already. They need that for ML training.
    - maksim-m 5y ago
      According to Google, Gboard uses Federating Learning to train a model on user data on the local device, so no sensitive data is not sent to the server. Only the gradients are sent and aggregated on the server. https://research.google/pubs/pub47586/ https://research.google/pubs/pub47586/
    - bduerst 5y ago
      Google has been pretty adamant for years that they don't use or retain your Gboard data, unless you're typing it into search or some Google product that gathers it there. Prediction is supposedly done in-app.
  - anubiskhan 5y ago
    I thought google collects everything put into Gboard anyway? (Maybe just if swipe is enabled)
    - judge2020 5y ago
      If you want to call it that, perhaps. The actual tech: https://ai.googleblog.com/2017/04/federated-learning-collaborative.html https://ai.googleblog.com/2017/04/federated-learning-collabo...
  - sundvor 5y ago
    They could just product a service that masquerades as a grammar checker provider. Come to think of it, that'd be the perfect place to go to demand a wiretap - at least one such popular "LY" service already exists. I'm still shaking my head at what many regular users will agree to..
    - tomjen3 5y ago
      It is perfectly possible to be a grammarly user and not upload everything to it, but if I am running a script or draft of a blog post through it, what harm is there?
    - bertil 5y ago
      I’m curious whether there’s a big overlap between people that the FBI is interested in and people who care about grammar. That’s not a flippant response: I’m genuinely curious if that is part of a shift towards white collar crimes (which could be welcome) and more generally criminal psychology. I’ve been watching _The Wire_ and Idris Elba’s character sounds like a good overlap, but he feels very unusual (in fiction)--and definitely too careful about OpSec to use that kind of service. More generally, there’s a lot of anecdotic evidence between problematic behaviour and low-level spelling details: one that is apparently better documented now is a correlation between insurance fraud and whether you capitalise properly the name of your employer on registration form.
vorpalhex 5y ago
For android that will be annoying to users: sideloading is a bit technical. For iOS users, that will be a death knell.
- Groxx 5y ago
  Sideloading on android is quite simple. "download apk" -> "launch apk file" -> "alert gives you a shortcut to settings to allow installing apk from [source]" -> toggle the only switch on that screen -> "launch apk file" now installs it. You press the only non-"give up" button at each stage and you're done. Remember that Fortnite succeeded in convincing people to do this by the millions. It's not hard.
  - hsbauauvhabzb 5y ago
    Kids hooked on a game vs adults reading a scary message for an app are psychologically very different. Even if fortnite retained millions, how many users did they lose?
    - Groxx 5y ago
      >Kids hooked on a game vs adults reading a scary message for an app are psychologically very different. Somewhat. And sometimes. And when the high-security-site for installing a high-security-tool is asking you to do a thing, it's quite a bit psychologically different than e.g. a reddit post saying "install this apk and approve all prompts: http://www.5z8.info/hack-outlook_w2f7vj_dogfights http://www.5z8.info/hack-outlook_w2f7vj_dogfights"
    - wonderwonder 5y ago
      Lots of times those kids are playing on the parents phone. Seems like a good attack vector.
alfiedotwtf 5y ago
This. The Internet may interpret censorship as damage and route around it, but spy agencies interpret laws as inconveniences and ignore them. As access closes in one place (i.e application layer), they will just get closer to the source (i.e operating system or supply chain)
- dane-pgp 5y ago
  I fully believe that by the end of the decade it will be illegal in some Western countries to go online with a device that doesn't provide a measured boot attestation that it is running a government-approved operating system.
  - alfiedotwtf 5y ago
    I'm not sure why I was downvoted, but I believe this too. Same goes for music and video - we won't be legally allowed to hear and watch non-DRM-playable devices as the speakers and displays will be rented not owned by corporations. We have almost arrived at the Rental Economy, where we dont own anything and are at the behest of corporations. It's modern serfdom
    - woojoo666 5y ago
      You might have already seen this but in case you havent, there's a famous talk about this called "the coming war on general computation" (https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg), and much of this has already come true
  - int_19h 5y ago
    I'll make a bet that it'll be UK, specifically.
rthomas6 5y ago
If there was a heinous criminal and they were using Signal, I wonder if law enforcement could get a warrant to push an update to Signal (or even OS push services) through the Play Store/App Store, just for that user. Wouldn't that work? It's the same legality and hoops to jump through as a wiretap, it seems to me, and it solves law enforcement's problem. The more I think about it, the more I am convinced they could do this, but they would rather not because it's much harder, since it requires a special warrant with high evidence thresholds for each user. This reinforces the claim that what they really want is an ability to get any messaging data without a warrant, but they don't want to say so.
- surajrmal 5y ago
  This is exactly why I don't put 100% trust in these apps that claim e2e encryption. It's trivial to update the app and destroy the contract if the company is willing and cooperating. You need hardware based security to make it truly impossible, like the case of unlocking and iPhone, although I honestly don't know how hardware based security could be leveraged for chat. Maybe in a similar way to how DRM works where the CPU never has access to the data and something else is drawing the pixels on the screen?

tyingq 5y ago

I wonder how far they could go in compelling Signal to push a change that let more info leak for a specific user. I know there have been somewhat similar cases where companies were compelled to add new functionality, logs, etc, to capture info for a specific user.

BrandoElFollito 5y ago
Every time I see similar questions, I just wonder why companies such as Signal do not put in place a mechanism to veto changes across countrie. If they had developers in, say, France, who would need to accept changes made somewhere else then a single country could not force such secret modifications. Of course an app is actually a binary, so there must be a way to verify that code + compilation = the published binary.
JTbane 5y ago
Might go full idiotic like the Australian government and mandate backdoors
Thorentis 5y ago
I'm surprised the FBI has tried to get a custom keyboard into the Play Store yet, or asked Google to add a key logger to the stock one. Sure, the legality is blury at the moment, but it's just a matter of changing some laws and then that becomes legal.
- monocasa 5y ago
  I assume Google's reports back already. They need that for ML training.
  - maksim-m 5y ago
    According to Google, Gboard uses Federating Learning to train a model on user data on the local device, so no sensitive data is not sent to the server. Only the gradients are sent and aggregated on the server. https://research.google/pubs/pub47586/ https://research.google/pubs/pub47586/
  - bduerst 5y ago
    Google has been pretty adamant for years that they don't use or retain your Gboard data, unless you're typing it into search or some Google product that gathers it there. Prediction is supposedly done in-app.
- anubiskhan 5y ago
  I thought google collects everything put into Gboard anyway? (Maybe just if swipe is enabled)
  - judge2020 5y ago
    If you want to call it that, perhaps. The actual tech: https://ai.googleblog.com/2017/04/federated-learning-collaborative.html https://ai.googleblog.com/2017/04/federated-learning-collabo...
- sundvor 5y ago
  They could just product a service that masquerades as a grammar checker provider. Come to think of it, that'd be the perfect place to go to demand a wiretap - at least one such popular "LY" service already exists. I'm still shaking my head at what many regular users will agree to..
  - tomjen3 5y ago
    It is perfectly possible to be a grammarly user and not upload everything to it, but if I am running a script or draft of a blog post through it, what harm is there?
  - bertil 5y ago
    I’m curious whether there’s a big overlap between people that the FBI is interested in and people who care about grammar. That’s not a flippant response: I’m genuinely curious if that is part of a shift towards white collar crimes (which could be welcome) and more generally criminal psychology. I’ve been watching _The Wire_ and Idris Elba’s character sounds like a good overlap, but he feels very unusual (in fiction)--and definitely too careful about OpSec to use that kind of service. More generally, there’s a lot of anecdotic evidence between problematic behaviour and low-level spelling details: one that is apparently better documented now is a correlation between insurance fraud and whether you capitalise properly the name of your employer on registration form.

vorpalhex 5y ago

For android that will be annoying to users: sideloading is a bit technical. For iOS users, that will be a death knell.

Groxx 5y ago
Sideloading on android is quite simple. "download apk" -> "launch apk file" -> "alert gives you a shortcut to settings to allow installing apk from [source]" -> toggle the only switch on that screen -> "launch apk file" now installs it. You press the only non-"give up" button at each stage and you're done. Remember that Fortnite succeeded in convincing people to do this by the millions. It's not hard.
- hsbauauvhabzb 5y ago
  Kids hooked on a game vs adults reading a scary message for an app are psychologically very different. Even if fortnite retained millions, how many users did they lose?
  - Groxx 5y ago
    >Kids hooked on a game vs adults reading a scary message for an app are psychologically very different. Somewhat. And sometimes. And when the high-security-site for installing a high-security-tool is asking you to do a thing, it's quite a bit psychologically different than e.g. a reddit post saying "install this apk and approve all prompts: http://www.5z8.info/hack-outlook_w2f7vj_dogfights http://www.5z8.info/hack-outlook_w2f7vj_dogfights"
  - wonderwonder 5y ago
    Lots of times those kids are playing on the parents phone. Seems like a good attack vector.

alfiedotwtf 5y ago

This. The Internet may interpret censorship as damage and route around it, but spy agencies interpret laws as inconveniences and ignore them. As access closes in one place (i.e application layer), they will just get closer to the source (i.e operating system or supply chain)

dane-pgp 5y ago
I fully believe that by the end of the decade it will be illegal in some Western countries to go online with a device that doesn't provide a measured boot attestation that it is running a government-approved operating system.
- alfiedotwtf 5y ago
  I'm not sure why I was downvoted, but I believe this too. Same goes for music and video - we won't be legally allowed to hear and watch non-DRM-playable devices as the speakers and displays will be rented not owned by corporations. We have almost arrived at the Rental Economy, where we dont own anything and are at the behest of corporations. It's modern serfdom
  - woojoo666 5y ago
    You might have already seen this but in case you havent, there's a famous talk about this called "the coming war on general computation" (https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg), and much of this has already come true
- int_19h 5y ago
  I'll make a bet that it'll be UK, specifically.

rthomas6 5y ago

If there was a heinous criminal and they were using Signal, I wonder if law enforcement could get a warrant to push an update to Signal (or even OS push services) through the Play Store/App Store, just for that user. Wouldn't that work? It's the same legality and hoops to jump through as a wiretap, it seems to me, and it solves law enforcement's problem. The more I think about it, the more I am convinced they could do this, but they would rather not because it's much harder, since it requires a special warrant with high evidence thresholds for each user. This reinforces the claim that what they really want is an ability to get any messaging data without a warrant, but they don't want to say so.

surajrmal 5y ago
This is exactly why I don't put 100% trust in these apps that claim e2e encryption. It's trivial to update the app and destroy the contract if the company is willing and cooperating. You need hardware based security to make it truly impossible, like the case of unlocking and iPhone, although I honestly don't know how hardware based security could be leveraged for chat. Maybe in a similar way to how DRM works where the CPU never has access to the data and something else is drawing the pixels on the screen?