25 ms·
FBI's ability to legally access secure messaging app content and metadata [pdf]
- headphoneswater 5y agoIf this is what it takes to keep us safe, I and most americans are ok with it. We live in dangerous times. The US has a balanced criminal justice system -- as long as due process is preserved privacy from the state should not be a major issue
- numlock86 5y agoHow does them reading my messages keep me safe, though?
- headphoneswater 5y agoIn that example it's keeping me safe from you
- numlock86 5y agoOk, let's turn it around and say they would keep me safe from you. Why would they? What's their motivation to keep ME save from YOU? Are you even a threat? Am I a threat? And would a real threat even be caught by this system?
- wizzwizz4 5y ago> if it's not we have bigger problems anyway Really, we shouldn't do anything; we have the bigger problem of the eventual heat death of the universe. Take into account not only the size of the problem, but how easy it is to do something about it.
- benlivengood 5y agoCurrent U.S. "due process" includes national security letters and other secret legal requests and secret courts to approve those requests. So there are still some checks and balances but it's less clear that they are working well enough or as intended. Just look at the transparency reports of major Internet companies; they can report numbers of (certain types of) requests and that's about it. Mass surveillance under seal is not a great trend. When political parties start advocating for jailing political opponents and treating the supreme court as political office for nominations, I find it harder to trust the current due process.
- yownie 5y agolink seems to be broken https://propertyofthepeople.org/document-detail/?doc-id=21114562 https://propertyofthepeople.org/document-detail/?doc-id=2111...
- mmh0000 5y agoNot only is there main link broken, but their silly PDF reader is broken for me. Here's a direct link to the PDF: https://assets.documentcloud.org/documents/21114562/jan-2021-fbi-infographic-re-lawful-access-to-secure-messaging-apps-data.pdf https://assets.documentcloud.org/documents/21114562/jan-2021...
- deleted 5y ago[deleted]
- finite_jest 5y agoDupe of https://news.ycombinator.com/item?id=29394945 https://news.ycombinator.com/item?id=29394945 and https://news.ycombinator.com/item?id=29394945 https://news.ycombinator.com/item?id=29394945.
- t0mas88 5y agoSo if you have something to hide, don't use iCloud backup. And Whatsapp will give them the target's full contactbook (was to be expected), but also everyone that has the target in their contact list. That last one is quite far reaching.
- lupire 5y agoIf you have something to hide, don't give a copy to any third-party. even a second-party is a risk.
- sschueller 5y agoCan you turn that off if you have icloud or do you need to not use icloud all together?
- deleted 5y ago[deleted]
- ceejayoz 5y agoYou can turn it off individually just for Messages, but you're still left not knowing the state of the setting on the other end.
- KennyBlanken 5y agoYes, and you can delete old backups on iCloud - and then switch to local, automatic, fully encrypted backups to a Mac or PC running iTunes. HN tends to get very frothy-at-the-mouth over Apple and privacy but the reality is that iPhones can be easily set up to offer security and privacy that best in class, they play well with self-hosted sync services like Nextcloud....and unlike the Android-based "privacy" distros you're not running an OS made by a bunch of random nameless people, you can use banking apps, etc. The only feature I miss is being able to control background data usage like Android does.
- georgyo 5y agoYou and the person you are communicating with must both not use iCloud backup. And since apple pushes the backup features pretty heavily, you can be reasonable sure that the person you are communicating is using backups. IE, you cannot use iMessage.
- georgyo 5y agoIt says Telegram has no message content. Isn't telegram not E2EE by default, instead required explicit steps to make a conversation encrypted? Either way looks like Signal wins by a lot. The size of it spot is so small, it seems almost squeezed in. But only because they have nothing to share.
- to11mtm 5y agoI don't know whether Telegram is E2EE by default (probably not.) When you do a call on telegram you are given a series of emoji and they are supposed to match what the person on the other side has, and that's supposed to indicate E2EE for that call.
- RL_Quine 5y agoVerification in band seems pretty meaningless, approaching security theatre.
- nitrogen 5y agoFor voice? It's hard to fake the voice of someone you know.
- Muromec 5y agoyou don't have to fake the voice, just mitm and record cleartext
- ajsnigrutin 5y agoBut they have to fake the voice, if I call the other person and say "my emoji sequence is this, this and that" for the other person to verify and vice-versa.
- wizzwizz4 5y agoPerson A calls you. I intercept the call, so person A is calling me, and then I call you (spoofing so I look like Person A). When you pick up, I pick up, then I transmit what you're saying to Person A (and vice versa). How do you know I'm intercepting the transmission? Does the emoji sequence verify the call, perhaps?
- beervirus 5y agoWhat about regular text messages?
- tag2103 5y agoIf I remember correctly standard SMS has no security on it at all and is in the clear during transit. I may be wrong and never scared of being corrected.
- kf6nux 5y agoIIUC, they can get 7 years worth of SMS/MMS (including contents) with very little effort/cost.
- bonestamp2 5y agoThey've been inside the phone companies for a long time so I assume they have full access to SMS.
- markab21 5y agoAssume anything sent over a cellular network carrier via normal SMS can not only be retrieved, but intercepted.
- brink 5y agoThank goodness a lot of companies regularly use it for 2FA.
- stunt 5y agoTelecommunication is highly regulated. They have to keep records for a long time and make them available to law enforcement.
- no_time 5y agoLINE,telegram,threema and WeChat are not even american companies. Can't they just tell the FBI to suck a fat one when they ask for user data?
- colechristensen 5y agoNot if they want to operate in the United States or have access to our banking system. You don’t get to pick your jurisdiction and then operate globally. You’re obligated to follow the laws where you want to operate.
- no_time 5y agoI wonder how this affects nonprofits like Matrix/Element and Signal. What can they do with them? Gangstalk their developers? Coerce big tech to ban them from their appstores?
- ev1 5y agoDoesn't Signal's dev already get bothered every single time they travel?
- smoldesu 5y agoThe design of these decentralized/federated platforms is specifically so they can't easily coerce their owners into disclosing incriminating information. In some sense, it's similar to how Bittorrent implicates it's users.
- viro 5y agoRefusing a valid court issued search warrant/order is a criminal offense. I think 180 days for each refusal of a legal order.
- colechristensen 5y agoWell signal does not have the data, they comply with such orders with the tiny amount of metadata they have (like a timestamp of when your account was created and that’s about it)
- stunt 5y agoWell, who cares when all they need is to use something like Pegasus to obtain full access to your phone simply by sending you a WhatsApp message (without having you even open the message). Knowing how well guarded IOS is against app developers, I wonder what kind of zero-day would suddenly turn a message received in WhatsApp to full system access. I think NSO found a WhatsApp backdoor, not a zero-day bug.
- catlikesshrimp 5y agoWhatsapp is owned by facebook, not by apple. I don't think Apple wants to share a backdoor with facebook. I don't know any detail of the whatsapp vulnerability that NSO exploited.
- JBiserkov 5y agoNSO can't send you an WhatsApp message if you don't have WhatsApp on your iPhone.
- mmazing 5y agoOr compromise the device in some other way. At the risk of being cliche here's a relevant xkcd - https://xkcd.com/538/ https://xkcd.com/538/
- efitz 5y agoThis discussion is not very interesting from a security perspective. I tuned out at “cloud”. If it’s not in your physical possession, it’s not your computer. If it’s not your computer, then whoever administers the computer, or whoever [points a gun at/gives enough money to] the administrator of that system can access whatever you put on that system. If a “cloud” or “service” is involved, then you can trivially use them to move or store data that you encrypted locally on your computer with your key that was generated and stored locally and never left your system. But subject to the limits above, the administrators of the other computers will still be able to see metadata like where the data came from and is going to. And they might be able to see your data too if you ever (even once, ask Ross Ulbrecht) failed to follow the basic encryption guidelines above. You can make metadata access harder via VPNs and Tor, but you CANNOT make it impossible- in the worst case, maybe your adversary is controlling all the Tor nodes and has compromised the software. Which leads me to my last point, if you did not write (or at least read) the code that you’re using to do all of the above, then you’re at the mercy of whoever wrote it. And, if you try to follow perfect operational security, you will have a stressful and unpleasant life, as it’s really really hard.
- judge2020 5y agoIf i'm reading this page correctly, AMD is working on something that would allow you to run trusted code that not even someone with physical access to the hardware could read (without breaking this system). https://www.amd.com/en/processors/epyc-confidential-computing-cloud https://www.amd.com/en/processors/epyc-confidential-computin... And this tech is already implemented by GCP: https://cloud.google.com/confidential-computing https://cloud.google.com/confidential-computing > With the confidential execution environments provided by Confidential VM and AMD SEV, Google Cloud keeps customers' sensitive code and other data encrypted in memory during processing. Google does not have access to the encryption keys. In addition, Confidential VM can help alleviate concerns about risk related to either dependency on Google infrastructure or Google insiders' access to customer data in the clear.
- efitz 5y agoThen you only have to trust that AMD did not accidentally or intentionally introduce a bug in the system. Remember Spectre? Remember all the security bugs in the Intel management code? You also have to trust that AMD generated and have always managed the encryption keys for that system properly and in accordance with their documentation. And are you even sure that you’re actually running on an AMD system? If the system is in the cloud, then it’s hard to be sure what is executing your code. And are you sure that your code didn’t accidentally break the security guarantees of the underlying system? I have worked on all these problems in my day job, working on HSMs. At the end of the day there are still some leaps of faith.
- timbit42 5y agoI'd like to see Tox and Jami.
- wizzwizz4 5y agoI read somewhere that Tox's security was compromised.
- fractal618 5y agoNow I just have to get my friends and family to use Signal.
- catlikesshrimp 5y agoI have been trying to get people to install signal for 2 years. No one has budged. The day facebook went down for some hours I got phone calls.
- anonporridge 5y agoIt's incredibly disheartening how difficult it is to get most people to care about digital privacy.
- basilgohar 5y agoI have had some success. It helps that many of the people I regularly contact were willing to migrate, even after some time. Most already used WhatsApp, so the friction to installing a new app was less than someone not accustomed to using a dedicated app for messaging. But most of my American friends that don't have international contacts still just use SMS because they are not really accustomed to an app such as WhatsApp and so on.
- djanogo 5y agoI switched to signal and got few people to switch too, then they started their shit coin(MOB). IMO Signal Messenger is just a way for that company to reach their shit coin goals. Uninstalled and never recommending that again.
- MatekCopatek 5y agoI remember many people being pissed off when these features were announced some months ago. As far as I can tell, nothing really happened afterwards. I use Signal on a daily basis and haven't noticed any coin-related functionalities. Either they were canceled, haven't been released yet or they're just buried somewhere deep and not advertised. Do you have a different experience?
- fractal618 5y agoNow I just have to get all my friends and family to use Signal.
- tacLog 5y agoMy family has really taken to it. Granted it's mostly just message family app to them, but they are very not technically fluent but yet seemed to have picked it up just fine. I really think this is not discussed when hacker news brings up secure messaging. The user experience is so much more important than the underlying tech. My family doesn't care about end to end encryption. They care about video calling with the press of a button, and easy features that are just there and work like zoom or the many other software products that they have to use work. Thank you Signal team for focusing so hard on the user experience.
- xanaxagoras 5y agoThey left off one very popular messenger, SMS: * Message content: All * Subpoena: can render all message content for the last 1-7 years * 18 U.S.C 2703(d): can render all message content for the last 1-7 years * Search warrant: can render all message content for the last 1-7 years * Vague suspicion plus a small fee to the carrier: can render all message content for the last 1-7 years
- authed 5y agoYou forgot email... and they don't need a warrant for messages older then 180 days if in the cloud (they never delete them, too): https://www.consumerreports.org/consumerist/house-passes-bill-requiring-warrants-for-searching-older-emails-files/ https://www.consumerreports.org/consumerist/house-passes-bil...
- kingcharles 5y agoIIRC the only reason this amendment was made was because the 180 day limit was found unconstitutional anyway by an appellate court. So, technically the amendment did nothing. It doesn't matter where your data is held, locally or cloud, (if you are an American resident and your data is in the USA) as it is _your_ data and it is unconstitutional for them to read it without a warrant. In theory.
- authed 5y ago> It doesn't matter where your data is held, locally or cloud In the US it does
- kingcharles 5y agoCitation? This ruling has been adopted by the US Supreme Court: https://privacylaw.proskauer.com/2007/06/articles/electronic-communications/the-sixth-circuit-affirms-individual-expectation-of-privacy-in-emails/ https://privacylaw.proskauer.com/2007/06/articles/electronic...
- baby 5y agoI'm wondering how this was obtained, and how old this is? For WhatsApp: > if target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message content Probably not true since WhatsApp launched encrypted backups.
- vorpalhex 5y agoReading the document answers this for you: It is a declassified government document originally produced by the FBI and was prepared on Jan 2nd, 2021.
- gnabgib 5y agoI mean the document says the data is accurate "as of November/2020", and the slide was prepared 7-Jan-2021
- cunthorpe 5y agoWhatsApp has its own backups in addition to regular full-phone iCloud backups. If WhatsApp does not encrypt its content at rest locally, then “iCloud backups” still contain everything unencrypted too.
- the_optimist 5y agoIsn’t this simply imaginary, where in practice all the FBI has to do to up the ante is to request military-grade interception from a willing foreign counterpart?
- tata71 5y agoTier of which requires....expense.
- anonporridge 5y agoThe point of promoting and using privacy respecting software is not necessarily to make it impossible for law enforcement to get what they want. It's to make it somewhat expensive and require targeted probes. You simply want it to be cost prohibitive to engage in mass surveillance on everyone, because that is an immensely powerful tool of totalitarian oppression that get really bad if we happen to elect the wrong person once.
- wizzwizz4 5y agoI don't care if they spy on me; they probably have a good reason to! But I do care if they spy on everyone, so I make it hard to spy on me.
- the_optimist 5y agoI agree with you on the level of my person, and naturally flag that this economic argument is extremely poor policy. It’s quite unclear that the marginal cost is non-zero, or even flat by person. One might reasonably conclude we are already each inside a high-resolution springing trap, waiting for the moment we find ourselves athwart the powers that be. Imagine in physical space where the local police could simply call in foreign air strikes upon domestic citizens, with only economics to prevent otherwise. We must have transparent and firm laws, reformed at a fundamental level.
- upofadown 5y agoCan't the FBI do a Pegasus style remote access thing on an appropriate warrant themselves?
- bredren 5y agoThe way these became bullet points on the slide is ~ An active investigation leads an agent to a suspect known to have used one of these applications An administrative subpoena is issued to the company asking for what information is available The company is then ordered by a federal judge to provide information related to a particular account or accounts The company complies. This is why it is important to understand how your messaging service handles data and how you can compromise your own safekeeping of all or part of that data.
- skinkestek 5y agoCheck the difference between Telegram and WhatsApp. Add to this the fact that WhatsApp - uploads messages unencrypted to Google if you or someone you chat with enable backups - and send all your metadata to Facebook. Then remember how many people here have tried to tell us that Telegram is unusable abd WhatsApp is the bees knees. Then think twice before taking security advice from such people again. PS: as usual, if your life depends on it I recommend using Signal, and also being generally careful. For post card messaging use whatever makes you happy (except WhatsApp ;-)
- KennyBlanken 5y agoTelegram defaults to no encryption, does not do encrypted group chats, has a home-rolled encryption protocol which almost guarantees it's weak as nearly every home-rolled encryption system always is (if not also backdoored). Coupled with it being headquartered in Russia means it is completely untrustable. The only reason Telegram comes out on top of Whatsapp in the document in question is because Telegram is a foreign company with little interest in cooperating with a US domestic police agency; the FBI has no leverage over Russian companies. What that list doesn't show is what Telegram does when the FSB knocks. By all means, give your potentially embarassing message content to a hostile nation's intelligence service.
- nicce 5y agoThat is a lot of speculation. If you read the encryption protocol, actual methods being used for encryption are well known. Client is open source and supports reproducible builds. If there is a backdoor, it is in front of our eyes. > What that list doesn't show is what Telegram does when the FSB knocks. By all means, give your potentially embarassing message content to a hostile nation's intelligence service. Telegram is in a lot of trouble in operating in Russia. It was blocked for two years. [1] If they are so co-operative, why pass the opportunity to watch on their own people. Or did they become co-operative after unblock? It seems, that they help on some level [2], but does this threaten to other countries? Hard to say so. [1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia [2] https://www.independent.co.uk/news/world/europe/telegram-russia-ban-lift-messaging-app-encryption-download-a9573181.html https://www.independent.co.uk/news/world/europe/telegram-rus...
- wwww3ww 5y agoI do DIY encryption with enigma reloaded and it works
- wwww3ww 5y agoi use enigma reloaded to manually encrypt my messages
- xster 5y agoThis seems like a good place to say that I strongly recommend Yasha Levine's Surveillance Valley book (https://www.goodreads.com/book/show/34220713-surveillance-valley https://www.goodreads.com/book/show/34220713-surveillance-va...) where he suggests that all of this is working as intended, going all the way back to the military counter-insurgency roots of the arpanet first in places like Vietnam, and then back home in anti-war and leftist movements. The contemporary themes that are relevant are the fact that current privacy movements like Tor, Signal, OTF, BBG are fundamentally military funded and survive on government contracts. It distracts from the needed political discourse into a technology one where "encryption is the great equalizer" and everyone can resist big brother in their own way on the platforms the government has built. Encryption does exist, but it also distracts from other vectors like vulnerabilities (that led to Ulbricht getting caught), what services you would e2e connect to, how you get the clients to connect to those services, what store can push binaries for said clients etc.
- hutzlibu 5y ago"are the fact that current privacy movements like Tor, Signal, OTF, BBG are fundamentally military funded and survive on government contracts." Are those "facts" avaiable for investigating, without having to buy the book? (that Tor is partly US administration funded is known, but Signal? And what is OTF and BGG?)
- xster 5y agohttps://www.opentech.fund/results/supported-projects/open-whisper-systems/ https://www.opentech.fund/results/supported-projects/open-wh... Funded by Open Technology Fund (OTF) https://en.wikipedia.org/wiki/Open_Technology_Fund https://en.wikipedia.org/wiki/Open_Technology_Fund Which is funded by Radio Free Asia (RFA) https://en.wikipedia.org/wiki/Radio_Free_Asia https://en.wikipedia.org/wiki/Radio_Free_Asia. It had a few reboots but was created as a CIA program in 1951 (https://en.wikipedia.org/wiki/Radio_Free_Asia_(Committee_for_a_Free_Asia) https://en.wikipedia.org/wiki/Radio_Free_Asia_(Committee_for...) to blast shortwaves into China from Manilla to try to overthrow the Chinese government. Rebooted more recently since the advent of the great firewall of China.
- goatcode 5y agoIt's kind of funny that WeChat seems pretty locked-down to the FBI, especially for Chinese citizens. Makes sense, really, but still funny.
- sgjohnson 5y agoLike Telegram, they simply don’t care about US warrants.
- jareklupinski 5y agois this only page two of an alphabetical list? or are there no messaging systems with a name before 'i'
- rodmena 5y agoWhatsApp. -> FBI Telegram. -> KGB Signal. -> The rest of us?
- temptemptemp111 5y agoSignal -> Mossad
- anderber 5y agoDidn't Russia(KGB) try to block Telegram in the past and were unsuccessful? I feel like they are fairly safe and trustworthy. Of course, I like Signal best, but Telegram has so many nice features.
- b8 5y agoCan't the FBI get chatlogs from WeChat? https://www.youtube.com/watch?v=N5V7G9IBomQ https://www.youtube.com/watch?v=N5V7G9IBomQ In the short documentary that the FBI made about catching Kevin Mallory they mentioned catching him sending classified stuff via WeChat.
- throw_away_dgs 5y agoSome FBI agents came to my house once and told me that my home Internet had been used to visit Islamic Extremist websites. They brought a local police office with them and a 'threat assessment' coordinator from my workplace. They asked me if my family was Muslim and wanted to know if we had been radicalized. We are not religious (at all). We do not attend church, synagogue or mosque. We are lower middle class white Americans born and raised in the USA and have never traveled outside the country. I have no idea why they thought this about us. Maybe it was an IP mix-up, but it was very disturbing. I feared that I may lose my job. I became very afraid of the FBI that day. I think this could happen to anyone at anytime.
- matheusmoreira 5y agoThat's extremely disturbing. Accessing some random website should never cause police to show up. They should never even know what you did. That's like keeping tabs on what books people read and raiding somebody's house because they looked up how bombs are made.
- wbl 5y agoThe only words you should ever say to the FBI "on advice of counsel I am taking the fifth".
- ChrisKnott 5y agoThis is awful advice for this specific situation. OP apparently managed to clear up the mistake without much bother by speaking to them (although they were understandably shaken up by the experience). This presumably wouldn't have happened if they'd done what you suggest.
- P_I_Staker 5y agoOn the other hand, they could accuse OP of lying (something that's highly subjective), which is a serious federal crime.
- robbedpeter 5y ago
- hexis 5y agoI wonder where Matrix/Element would fit into this chart.
- derbOac 5y agoYeah I was thinking maybe some of the most secure platforms aren't on the list. Briar was another one.
- deleted 5y ago[deleted]
- grouphugs 5y agofuck the police
- dollabills 5y agoSnapchat?
- dollabills 5y agoWhat about Snapchat?
- dotancohen 5y agoDo you want this to stop? Raise awareness, add this to your mail sig: > This electronic communication has been processed by the United > States National Security Agency. If it makes people uncomfortable, GOOD. Pretending that your mail - and their mail - is not being accessed is not the way to resolve this uncomfortable situation. Ending it is the way. And that demands awareness.
- Larrikin 5y agoI use LINE a fairbit, have a number of Japanese friends as well as friends that have traveled to Japan. I had no idea they had implemented much better encryption [1]. I'm convincing all my contacts to turn on the option now. [1]https://engineering.linecorp.com/en/blog/new-generation-of-safe-messaging-letter-sealing/ https://engineering.linecorp.com/en/blog/new-generation-of-s...
- timbit42 5y agoIt's about time they implemented 1970's encryption technology. It should be on by default.
- CookieMon 5y agoThe list doesn't have ANØM
- Molly666 5y agoThe FBI is monitoring users - it's not a secret for a long time. Enough information has already leaked to the network to make it clear that this is not just a conspiracy theory. But, to be honest, I was surprised that each of the supposedly reliable messengers leaks data to the authorities. I was also surprised that I did not see the Utopia P2P https://u.is/en/ https://u.is/en/ in the document. Maybe the only reliable application is one that stands for freedom of speech and anonymity and does not obey the authorities?
- richij 5y agoPSA: This is a year old.
- deleted 5y ago[deleted]
- NmAmDa 5y agoThe funny thing is that sometimes when I search for Arabic words about Islam I get results for some old and usually the extremest books on CIA library (direct links to PDFs) which I wonder why?