5 ms·

How can you be so sure NSO don't have an in into Signal? After all, it still takes an OS to run Signal.

sorry_outta_gas 5y ago
Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots
- _8j50 5y ago
  Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?
artinmg 5y ago
Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.
- Sharlin 5y ago
  Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.
_8j50 5y ago
I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.
- Tagbert 5y ago
  Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
  - alphabettsy 5y ago
    Could it also be that most of their potential targets use iPhones?
fsflover 5y ago
> After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.

Yeah if you can inject into the libraries on the system app isn't to important, just log whatever is sent to uitextfield or whatever and some info about the process; or be lazy and just take screenshots

_8j50 5y ago
Yes. That would be a comparison I am interested in. Are there vulnerable and exploitable system libs and components on iOS? How does that fare compared to android?

artinmg 5y ago

Well you can’t necessarily, because who’s to say what various methods they’ve discovered. However, if we were to use the most famous recent example that relied on an unknown sender transmitting a GIF containing the compromise, Signal does have some additional protection in that it doesn’t receive messages from unknown senders by default. Rather the recipient must accept the message explicitly.

Sharlin 5y ago
Honestly, even after accepting the message there should be another confirmation step before viewing any and all non-textual content.

_8j50 5y ago

I don't but the article was saying iphone is less secure and signal has better restrictions on who can text you than imessage. So use signal on iphone? How does imessage reflect badly on the whole OS especially when compared to a non-default app like signal.

Tagbert 5y ago
Well, the article said that in their sample, fewer Android phones showed evidence of attack but they also said that Android does less event logging and they could not know if there were other attacks that they did not catch. Not really a definitive answer.
- alphabettsy 5y ago
  Could it also be that most of their potential targets use iPhones?

fsflover 5y ago

> After all, it still takes an OS to run Signal. Which is why I find it suspicous that Signal do not provide the client for non-Android and non-iOS systems, both not very secure.