5 ms·

...or Hamas just used modern encryption, which does work when implemented and used correctly. Merely using Signal consistently and correctly could very well be

...or Hamas just used modern encryption, which does work when implemented and used correctly. Merely using Signal consistently and correctly could very well be enough. There isn't an unlimited supply of over-the-air zero-day exploits.

jacquesm 3y ago
That would still give a lot of meta data to analyze.
BannedByKikes 3y ago
[flagged]
OfSanguineFire 3y ago
Signal’s devs recommend that it be installed from the Play Store, and that is what the vast majority of people do. There has been heavy speculation that certain state actors are able to push a compromised Play Store update to users of interest. Moreover, the Signal board has been overhauled recently, Moxie left, and at least one new member has a US government background. It’s possible that the organization itself has been somehow compromised. (While Signal still offers an .apk for download from its website, the organization does not recommend it. Moreover, that APK comes with its own update functionality where the same risks may exist as with the Play Store.)
- logicchains 3y ago
  Tucker Carlson claims he was contacted by US intelligence asking him to call off a planned interview with Putin that he had only discussed over Signal, although that could presumably have been achieved by a keylogger or spyware without compromising Signal itself.
  - philistine 3y ago
    It's far more likely the US government has spies inside Carlson's production looking over his shoulder while doing his makeup.
    - maxerickson 3y ago
      Spies, or even just sources, in the Russian government are probably somewhat more likely.
- petertodd 3y ago
  > There has been heavy speculation that certain state actors are able to push a compromised Play Store update to users of interest. I'm sure Hamas could figure out how to install Signal from clean APKs, or use something else entirely. They may be barbarians. But they're not stupid. People forget that Gaza isn't a particularly poor country. It's GDP per capita is on par with neighboring Egypt, and only a little less than Ukraine. The supermajority of Gazan's have internet access too.
  - OfSanguineFire 3y ago
    > I'm sure Hamas could figure out how to install Signal from clean APKs I think you are overestimating how technically savvy guerrilla fighters – or armies in general – typically are. Even if a handful of elites were savvy, the vast majority are going to have less knowledge and show terrible opsec. And considering that even many security researchers complain how difficult it is to ensure a secure setup for Signal or any other smartphone-based system, I wouldn’t expect Hamas to be any better. Of course Gaza wasn’t a particularly poor country. It even has its own dev community attracting outsourcing work. But that doesn’t make opsec in this area any easier or them any more qualified than the average.
arp242 3y ago
"When implemented and used correctly" is key though. The thing with these things is that all it takes is one short lapse and you can be 100% compromised (not just that one message). People get sleepy, are in a hurry, misunderstand something, can be fooled, or are just plain idiots. And you're never quite sure what the capabilities of your enemy are. Person-to-person on the other hand is simple, easy to understand, and while not entirely foolproof (or idiot-proof), it's a lot harder to screw up and when you do, the damage capabilities are more likely to be more limited. I'm also going to guess that Israel has a rather hard time recruiting supergrasses among Hamas/Gaza population after the last 15 years (which is different from the IRA, which was thoroughly infiltrated).
jowea 3y ago
When we're talking about a state-level actor (and one supposed to be quite good at this), I think you'd have to to worry about more than that. 0-days in the operating system, supply chain attacks, and even one party in the conversation being compromised.

jacquesm 3y ago

That would still give a lot of meta data to analyze.

BannedByKikes 3y ago

[flagged]

OfSanguineFire 3y ago

Signal’s devs recommend that it be installed from the Play Store, and that is what the vast majority of people do. There has been heavy speculation that certain state actors are able to push a compromised Play Store update to users of interest. Moreover, the Signal board has been overhauled recently, Moxie left, and at least one new member has a US government background. It’s possible that the organization itself has been somehow compromised. (While Signal still offers an .apk for download from its website, the organization does not recommend it. Moreover, that APK comes with its own update functionality where the same risks may exist as with the Play Store.)

logicchains 3y ago
Tucker Carlson claims he was contacted by US intelligence asking him to call off a planned interview with Putin that he had only discussed over Signal, although that could presumably have been achieved by a keylogger or spyware without compromising Signal itself.
- philistine 3y ago
  It's far more likely the US government has spies inside Carlson's production looking over his shoulder while doing his makeup.
  - maxerickson 3y ago
    Spies, or even just sources, in the Russian government are probably somewhat more likely.
petertodd 3y ago
> There has been heavy speculation that certain state actors are able to push a compromised Play Store update to users of interest. I'm sure Hamas could figure out how to install Signal from clean APKs, or use something else entirely. They may be barbarians. But they're not stupid. People forget that Gaza isn't a particularly poor country. It's GDP per capita is on par with neighboring Egypt, and only a little less than Ukraine. The supermajority of Gazan's have internet access too.
- OfSanguineFire 3y ago
  > I'm sure Hamas could figure out how to install Signal from clean APKs I think you are overestimating how technically savvy guerrilla fighters – or armies in general – typically are. Even if a handful of elites were savvy, the vast majority are going to have less knowledge and show terrible opsec. And considering that even many security researchers complain how difficult it is to ensure a secure setup for Signal or any other smartphone-based system, I wouldn’t expect Hamas to be any better. Of course Gaza wasn’t a particularly poor country. It even has its own dev community attracting outsourcing work. But that doesn’t make opsec in this area any easier or them any more qualified than the average.

arp242 3y ago

"When implemented and used correctly" is key though. The thing with these things is that all it takes is one short lapse and you can be 100% compromised (not just that one message). People get sleepy, are in a hurry, misunderstand something, can be fooled, or are just plain idiots. And you're never quite sure what the capabilities of your enemy are. Person-to-person on the other hand is simple, easy to understand, and while not entirely foolproof (or idiot-proof), it's a lot harder to screw up and when you do, the damage capabilities are more likely to be more limited. I'm also going to guess that Israel has a rather hard time recruiting supergrasses among Hamas/Gaza population after the last 15 years (which is different from the IRA, which was thoroughly infiltrated).

jowea 3y ago

When we're talking about a state-level actor (and one supposed to be quite good at this), I think you'd have to to worry about more than that. 0-days in the operating system, supply chain attacks, and even one party in the conversation being compromised.