7 ms·
Hackers selling hacked police emails to request user data from TikTok, Facebook
- cameronh90 3y agoThis is a great example of why E2EE is important even if you trust your government.
- TZubiri 3y agoAccording to Meta Whatsapp is E2EE and Data requests by government agencies can only reveal metadata like recipients, durations of calls, frequency of messages, but not content of messages.
- omginternets 3y agoThat's enough to tell you if a given request is being seriously discussed.
- jjoonathan 3y ago> only "We kill people based on metadata." - General Michael Hayden, former director NSA and CIA
- jacquesm 3y agoMeta data is often as valuable or even more valuable than the data itself. Because you might be talking to the mob boss about the weather. But the fact that you are talking to the mob boss is an extremely interesting data point. It pins you to the map in a way that you are immediately a POI and causes a file to be opened on you and your other contacts to further map your place in the network. Who talks to who is very powerful information.
- canadiantim 3y ago[flagged]
- randysalami 3y agoSee The Wire.
- TZubiri 3y agoHaving metadata be accessible to law enforcement is a good compromise between privacy and law enforcement.
- EricMausler 3y ago"Hey Timmy I noticed you talk to Susan 5 times a day sometimes for 5 minutes and sometimes for 2 hours. Always right after you say goodnight to us. Sometimes I see you call her late at night from outside her house for 10 seconds when you were supposed to be in your room and then you don't use your phone again for a couple hours -- No no, im not invading your privacy, it's only metadata"
- TZubiri 3y agoAlso the mail has access to this metadata. The basis of using a service is that you entrust them with the care of your necessity. That they make it unable by policy not to look at the contents of your mail is a nice feature, but nor necessary, as we firstly rely on the good faith we put on the service provdider. To go ahead and request that the security measures be extended to data necessary to route communications, is of a pathological paranoic nature. The mailman needs to know the address. Mailmen who don't require your address to deliver may appear as competitors, but they will always be a shady second choice, because mailmen need to know your address.
- EricMausler 3y agoThe government is not providing my internet. I believe the internet should be treated like the mail, but until the government actually steps in and takes ownership of it, they have no business having access to the metadata necessary to route packets, let alone the logs of those routings, and certainly not any additional Metadata that is not part of the routing function
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- MagaMuffin 3y ago[dead]
- NoZebra120vClip 3y agoOk if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.
- jstarfish 3y agoIt's the unsuspecting users that are the victim of this.
- extraduder_ire 3y agoTo many normal people the "from" field in an email means that it came from there. I am wondering how they get the data back though, unless they demand it is faxed, or sent to another email address. (Or the person replying doesn't notice the different reply-to address.)
- jaywalk 3y agoIf the email account has been hacked (which it has in this case) then it can just go back to the original hacked email.
- singleshot_ 3y agoGenerally email systems will have rules that support things like “if this account gets any mail from this address at Facebook.com, move it to some obscure folder and forward it to badguy@gmail.com” which is sometimes how this plays out.
- hedora 3y agoInterestingly, gmail trusts the from field, so if I send a message “from” you to your account, it will put it in your sent folder. Urban legend says people have been fired after forged harassment emails were delivered this way. Google claims this is a feature, and the sent “label” isn’t meant to mean that it came from your gmail account. For instance, there could be a corporate service firehosing spam at coworkers on your behalf, and obviously you don’t want to notice that, so it puts it in the sent box.
- candiddevmike 3y agoSomeone should create haveibeensubpoenaed.com
- deleted 3y ago[deleted]
- what-no-tests 3y agoThe emails should just be made public anyway. They are public servants, yes? "To serve and to protect."
- dahdum 3y agoIt’s about fraudulent data requests using hacked email accounts from government bodies all around the world. What emails are you referring to that should be made public?
- what-no-tests 3y agoWell if they have nothing to hide then what's the issue, officer?
- dahdum 3y agoI’m not arguing against your point, it just appears completely irrelevant to the article under discussion, so I asked for clarification instead of just assuming you didn’t read the article.
- singleshot_ 3y agoCastle Rock v. Gonzales, 545 U.S. 748 (2005) (Police not required to serve or to protect).
- what-no-tests 3y agoFalse advertising.
- singleshot_ 3y agoLack of a sale or advertisement of any merchandise would be fatal to such a claim, at least in this jurisdiction.
- lisbon44 3y agoWhatever happened to the concept of receiving a legal-order, having your lawyers scrutinize it and complying afterwards? None of these high-stakes data handoffs coordinated over insecure email.
- happytiger 3y agoYou want private courts? You destroy due process? You want pay-to-play legal systems? You pay the price. This is the price. And you better not complain. You can either have one, or the other. But you can’t compromise one and keep the the other.
- coldtea 3y agoI want public no pay-to-play legal systems.