7 ms·
Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupi
by NoZebra120vClip 3y ago
Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.
- jstarfish 3y agoIt's the unsuspecting users that are the victim of this.
- extraduder_ire 3y agoTo many normal people the "from" field in an email means that it came from there. I am wondering how they get the data back though, unless they demand it is faxed, or sent to another email address. (Or the person replying doesn't notice the different reply-to address.)
- jaywalk 3y agoIf the email account has been hacked (which it has in this case) then it can just go back to the original hacked email.
- singleshot_ 3y agoGenerally email systems will have rules that support things like “if this account gets any mail from this address at Facebook.com, move it to some obscure folder and forward it to badguy@gmail.com” which is sometimes how this plays out.
- hedora 3y agoInterestingly, gmail trusts the from field, so if I send a message “from” you to your account, it will put it in your sent folder. Urban legend says people have been fired after forged harassment emails were delivered this way. Google claims this is a feature, and the sent “label” isn’t meant to mean that it came from your gmail account. For instance, there could be a corporate service firehosing spam at coworkers on your behalf, and obviously you don’t want to notice that, so it puts it in the sent box.
- extraduder_ire 3y agoI thought gmail enforces SPF for gmail emails. I'd try it myself, but I don't want the few machines I have with port 25 unblocked to get a worse spam rating. Is this documented anywhere?
- deleted 3y ago[deleted]
- vkou 3y agoYou'll be horrified to learn exactly how much business is conducted through unsecured fax machines.
- fullspectrumdev 3y agoFor some absurd reason fax is often seen by bureaucracies in some countries as “more secure” than email.
- wmf 3y agoIn the 1990s the phone network probably was more secure than the Internet but it's not today.
- dahdum 3y agoIsn’t it though? You can attack email systems, network operators, and end users in a myriad of ways remotely from anywhere in the world. How can you compromise a traditional fax? Eavesdropping the PSTN itself? Physical access to one of the machines? Stealing the printed document? Network fax systems are more convenient to use than traditional, but still more secure than email because they’ve been designed to be so.
- omniglottal 3y agoAnalog. Unencrypted. Your intent to misinform appears evident.
- dahdum 3y agoWhere’s the attack surface to exploit this analog and unencrypted data? A government can order their telecoms (and they do), but the same happens with emails providers. Neither is secure from government intrusion, but email is easier to compromise than traditional fax systems because their exposure is so limited.
- MichaelZuo 3y agoHow's that absurd? If you have 0 experienced security folks on staff/consulting, and no one willing to listen to them, then a fax is almost certainly more secure in practice.
- heavyset_go 3y agoTech companies don't give a shit, it's the same reason why they're handing over data when just simply asked.
- wmf 3y agoI don't think most law enforcement agencies have any second factor to authenticate themselves online. And it's not the social media companies that suffer but their users whose privacy is being violated.
- jazzyjackson 3y agoDon't you think it's within the social media companies interest to respond to as few subpeonas as possible i.e. only genuine ones from authorities? but maybe you're right and this problem won't be solved because the person being harmed has no power and the institution in power sees no harm
- wmf 3y agoObviously they're going to try to verify law enforcement requests. It's a tradeoff.
- omniglottal 3y ago"Try" == "it's a .gov email - looks good!"
- MichaelZuo 3y agoWhy do you believe they would?, it's definitely not demonstrated here.
- jazzyjackson 3y agoEmail actually has very well thought out authentication mechanisms such that its not unreasonable to expect a domain is not spoofed, and it came from the server it says it came from but if some baddies have logged into your server and sending messages as you, then DKIM can't save you so say social media companies want a higher standard of proof that emails are coming from a particular institution, what mechanisms are available that doesn't involve onboarding every individual officer to the subtleties of public key crpyotgraphy?
- omniglottal 3y agoNever buillding a back door for LEOs sounds like a reasonable option.
- nitwit005 3y agoThey respond to written letters too (and they have a legal obligation to do so). There is, unfortunately, no way to get every police force on the globe to agree to some authentication scheme.