5 ms·
"For decades, the CIA read the encrypted communications of allies and adversaries." Always the past tense for these articles. What, they don't do that anymore?
by sph 3y ago
"For decades, the CIA read the encrypted communications of allies and adversaries."
Always the past tense for these articles. What, they don't do that anymore?
The CIA used to spy on the world, allies and enemies [, install dictators and foment revolts in third world countries]. It still does, but it used to, too.
- bboygravity 3y agoNow they may be using Signal. The utlimate honeypot.
- lima 3y agoThe whole point of Signal is not having to trust them because the protocol is open source and peer-reviewed.
- thx-2718 3y agoYeah but have you viewed it? I haven't. Also what about iPhone blobs or similar? I'm actually curious here as to what we can & can't prove as to being 'secure'.
- lima 3y agoThere have been a number of third party audits and lots of academic research: https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
- bboygravity 3y agoYeah, but the client and/or server are closed source aren't they? AFAIK Signal server source code nor servers themselves are audited. So that means all bets are off: it's entirely possible to implement a perfect peer reviewed protocol in a client and/or server full of backdoors that entirely bypasses the protocol deliberately?
- lima 3y agoClients and server are open source: https://github.com/signalapp https://github.com/signalapp The protocol does not trust the server. Android has reproducible builds, iOS doesn't.
- c00lio 3y agoFor certain things in signal you need to trust the server hardware and suspicious technologies like SGX. SGX is a prime target for a NSA backdoor. That some upper-layer software there is open source (with lots of caveats, e.g. you cannot verify which server version is really running and signal has a history of lagging behind on publishing their "open source" version of the server code) is a distraction at best.
- jruohonen 3y agoDon't forget side-channels in SGX.
- _kbh_ 3y ago> For certain things in signal you need to trust the server hardware and suspicious technologies like SGX. SGX is a prime target for a NSA backdoor. That some upper-layer software there is open source (with lots of caveats, e.g. you cannot verify which server version is really running and signal has a history of lagging behind on publishing their "open source" version of the server code) is a distraction at best. Before you worry about super expensive hard to remove hardware bugs, you should worry far more about the software running on that hardware. It is much more likely that theres bugs in the software than the hardware.
- c00lio 3y agoYes, of course you are right. My comment was meant more along the lines of "even if the software were ultimately trustworthy because of open source, thousand eyes, careful development and fairy dust, those hardware problems would still be a way in".
- 3y ago
- c00lio 3y agoDoesn't matter at all. If your adversary is the CIA, you cannot trust your mobile phone OS, firmware and drivers not to read and report your memory contents.
- matheusmoreira 3y agoI used to think that as well but IOMMU is a thing now. Read strcat's posts, they're really informative. He's the developer of GrapheneOS. https://news.ycombinator.com/threads?id=strcat https://news.ycombinator.com/threads?id=strcat
- c00lio 3y agoYour IOMMU needs to be programmed, just like your MMU. Programming is provided by the OS and driver. Early IOMMU configuration is provided by the firmware. Check mate.
- matheusmoreira 3y agohttps://news.ycombinator.com/item?id=20151431 https://news.ycombinator.com/item?id=20151431 > It can't improve the security of firmware directly, but it can certainly improve the isolation of it by auditing and improving IOMMU configuration
- pgeorgi 3y agoThe IOMMU that is subservient to the cell modem, where the latter runs code of unknown provenance with the ability for ad-hoc, targeted updates over the network?
- matheusmoreira 3y agoIsn't the modem one of the things isolated by the IOMMU? How is it subservient to it?
- fsflover 3y agoWhat if they all are FLOSS or isolated from the OS like on Linux phones?
- msm_ 3y agoThat's why I out-trick them and I only use Signal in my friend group to send each other memes. I even talk with my parents using Signal. I hope the "noise" I generate makes Signal a bit more secure for those who have much stricter security constraints than me.
- ta988 3y agoThis doesn't matter at all and can be filtered in microseconds.
- scrapcode 3y agoI thought the HN crown championed Signal and Marlinspike's products... or was that yesteryear?
- George83728 3y agoSometimes the HN crowd champions something so often and so enthusiastically, it starts to set off alarm bells. Signal, Mullvad, and Tor all seem a little bit too good to be true, and the amount of messaging I see to the contrary makes me suspect these might be honeypots targeted specifically at people who think they're too savvy to fall for honeypots. Not a strong suspicion, but greater than zero. Maybe I'm just being paranoid. I pay for Mullvad anyway, if my worst suspicions are true then it will still be good enough to hide my petty torrenting from MPAA lawyers (which is beneath the concern of the CIA/etc anyway.) There's no way I'd trust it if I were in Snowden's shoes though. For anything that might plausibly interest the CIA/NSA/FBI, I would not trust these tools (or others) to keep me private.
- LewisVerstappen 3y agoAnd get the US into completely insane, destructive wars. You’d think there would be some punitive action for the 2000s intel that Iraq had WMDs. This “intel” got us into a war that cost trillions of dollars and thousands of lives. Nope, instead the CIA just got more money.
- sph 3y agoWhy punitive action? The CIA is the covert tool through which the USA maintains its global hegemony and reach. No US president in their right mind will ever do anything to reduce the powers of its intelligence agency.
- Consultant32452 3y agoThe CIA understands that it doesn't need the approval or even the funding of any member of the US government to carry out whatever deeds it wants. We have military leadership admitting publicly that they falsified reports to a sitting President to maintain wars and there are no repercussions. The idea that the President has any power to combat any of this is a fantasy.
- BSEdlMMldESB 3y agoI think USA congress is also disabled from acting against them, though it probably costs them a bit more to neuter as there are many more people involved
- Consultant32452 3y agoHypothetically the congress could defund them or even outlaw them, but the CIA could operate solely on the funds of its own illegal operations. And only a fool would think they don't have blackmail files on enough key players.
- jjtheblunt 3y agoMeanwhile it seems that the US economy has historically been the overt tool through which the USA maintains its global hegemony and reach. I mention that because the politicians seem determined to break that trend.
- stelonix 3y ago[flagged]
- woodruffw 3y agoWho is “them”? WaPo?
- stelonix 3y agoIf it were only the WaPo the ones saying things such as the comment I was replying to, then "them" would mean the WaPo. But since every corporate news outlet uses the same wording to make it seem like the CIA was "evil back in the day but it's fine now", in this context, "them" means pretty much every corporate outlet out there. Each one of them who pretends Julian Assange is not a political prisoner by orders of Washington. Each and every one of them who publish stories whose source is "unnamed officials" (aka "trust me bro") and are usually just copying verbatim the government narrative without batting an eye. Since that's all of the big ones, NYT, WaPo, Guardian, even Reuters nowadays; might as well consider "them" all of them who do this kind of propaganda.
- woodruffw 3y agoThis comes off as a screed. There’s a significant difference between media biases and state control: major news outlets in the US tend to have pro-corporate and pro-government views, but this doesn’t make them state affiliated. Proper consumption of biased news sources requires a finer-toothed comb than “pro-government is bad, and therefore is compromised by the government.”
- numair 3y agoThis exchange is pretty funny to anyone who knows the background on the extremely cozy relationship between Katherine Graham and the CIA. It seems that, in our post-truth world, facts have become conspiracies and conspiracies have become facts. Alas.
- cmeacham98 3y agoUnlike HN posters, news organizations are generally expected not to promote unproven allegations as fact. Even if you personally believe the CIA is still engaging in these types of behaviors, the news isn't going to claim that without evidence.
- sennight 3y ago> ..the news isn't going to claim that without evidence. You are joking, right? Or maybe your definition for "evidence" includes circular references, because that is what you get when "the news" is functionally captured but the government/uniparty.
- noman-land 3y agoI always read these like the Mitch Hedburg joke. "I used to do drugs. I still do, but I used to, too."
- WhereIsTheTruth 3y agoIndeed, same with the creation of hypertext, google, facebook and now bitcoin,they did, they still do and they will continue to do, that's part of their defense/offense strategy Funny enough, the countries that spend a lot of effort into building their own stack are the ones designated as enemy, Russia/China for example, did they become immune to that strategy?
- rib3ye 3y agoThat’s the point. These stories are recruiting for ongoing and future programs.