3 ms·
What’s your point? Just because you don’t know how to analyze an iOS application doesn’t mean it’s not possible. I understand that some people want to fully c
by cpach 3y ago
What’s your point?
Just because you don’t know how to analyze an iOS application doesn’t mean it’s not possible.
I understand that some people want to fully control their smartphone. But lack of root isn’t something that prevents E2EE communication.
And if you don’t trust neither Google nor Apple, fine. You can still run Signal on Linux. (Or Matrix, OMEMO, etc.)
- kortilla 3y agoThe point is that both Apple and Google can just read your messages out of memory. It’s no different than having a private conversation in a room with a microphone.
- bborud 3y agoThe you owe us homework: show that other hardware is meaningfully more secure. If you can't or won't, your point crumbles to nothing.
- fragmede 3y agoI don't see that as the case. There doesn't need to be a provably secure device for another device to be shown to be fundamentally insecure. What is secure, is leaving all phones, hell, all electronics, out of the windowless room to have the sensitive conversation in. It's a lot of friction but if your thread model includes APTs, you have to give up a lot of convenience.
- cpach 3y agoIf Five Eyes are targeting you, then you will need to think very hard about OPSEC indeed. Luckily, most of us are not targeted by the Five Eyes. And when it comes to dragnet surveillance, applications like Signal has raised the bar significantly.
- fragmede 3y agoYou're right but there are APTs other than Five Eyes if you're elsewhere in the world though. Like say the Middle East.
- rainsford 3y agoYes, ultimately you have to trust your endpoint device when relying on e2ee. Having root access to that device does not significantly change that requirement. If you're worried about Apple and Google subverting your device to read your e2ee messages, them giving you root access does not actually solve the problem.
- TeMPOraL 3y agoEven if you trust Apple and Google not abusing their capabilities (which is somewhat reasonable in this context), both are still US companies - I imagine they could be ordered by the US government to pull your E2EE messages from device memory.
- cpach 3y agoFeel free to describe the steps you believe the company would take after receiving such a request.
- ben_w 3y agoI share TeMPOraL's opinion. I'd assume Apple and Google would seriously consider relocating if they were so ordered, even if they ultimately decided not to; but let's say for the sake of argument that they decide they have to supply the unencrypted content of messages of apps they didn't write running on operating systems they did write. If I was an engineer tasked with doing that, I would refuse, even if it meant leaving. But if I wasn't that kind of person, I'd have the OS take screenshots whenever a certain app was in the foreground.
- throw0101a 3y ago> I imagine they could be ordered by the US government to pull your E2EE messages from device memory. Under what law/statute?
- TeMPOraL 3y agoWhichever one is that lets them do it today. That's the reason US and the EU can't agree to a new privacy treaty.