5 ms·

i don't understand. i thought TLS or some other form of end-to-end encryption would prevent this sort of thing from happening. it seems like someone has access

i don't understand. i thought TLS or some other form of end-to-end encryption would prevent this sort of thing from happening. it seems like someone has access to the plaintext message other than the participants of the conversation. how does this happen? (i am not a snapchat user) not even to begin talking about the political ramifications...

__m 3y ago
Snapchat texts are not end to end encrypted. I think we know exactly how that happens since Snowden. There won’t be political ramifications. Though this might be more tangible to the average users that don’t care about privacy.
- spuz 3y ago
  But is there any claim that Snapchat automatically filters messages and alerts the UK security services?
  - lukeschlather 3y ago
    Snapchat messages being surreptitiously downloaded and monitored by the NSA at some point where they are unencrypted (possibly only within Snapchat's datacenters) is consistent with what was revealed in Prism. I know that most companies have updated their standards to treat any network traffic as insecure since Prism but it's possible Snapchat doesn't. Also as I understand it the NSA also has no legal issues with sharing any messages intercepted with the UK so long as one of the parties to the conversation is not a US national or on US soil.
gtvwill 3y ago
Errr phones aren't safe. They are backdoored up the wazoo. Same with all your messaging companies. Any that are decent in size have had a visit from authorities and aren't allowed to disclose to you they have. Iphones, android it doesn't matter. Your phones about the least safe tech device you own. It literally hacks itself if sent the right messages. Edit: OK so it seems a fair few folks don't understand how spying across borders and things like the 5 eyes mean your tracked without a warrant legally. So here's how it works. All 5 eyes countries are not allowed to spy on their own citizens in their countries without a warrant. All 5 eyes countries are allowed to surveil info about foreign individuals without a warrant. 5 eyes intel agencies basically just have to pipe a copy of local data say fb or in this case snapchat out via a friend in a another country then back to themselves and they don't need a warrant. As the data has now come from Intel sharing from your 5 eyes peers. The 5 eyes intel agencies between them all have deals and flex with just about every other intel agency in the world except the obvious few. Intel sharing these days is as much as a treasure hunt for legal loopholes to get the data as it is hunting the data itself.
- gjvc 3y ago
  It literally hacks itself if sent the right messages. can you think of any CCC presentations which explain this?
  - gtvwill 3y ago
    Its stuff like this. Phone recieves message, runs code embedded in msg for nfi reason why literally starting off the chain of events/exploits to hack yo device. https://eugene.kaspersky.com/2023/06/01/a-matter-of-triangulation/ https://eugene.kaspersky.com/2023/06/01/a-matter-of-triangul... We've had a few of these types of entry points in phones now over the years. Enough that if its still happening its probably by design as a favor to a 3 letter agency.
    - ithkuil 3y ago
      > as a favor to a 3 letter agency. BBC ?
ghaff 3y ago
For that matter, you send something to someone as a joke. Maybe they think you're serious. Maybe they tell a friend. Maybe you sent it to the wrong person. Etc. Who knows what happens here.
timkam 3y ago
The article somewhat suggests that the guy used the airport's wifi. In this case and assuming that the wifi network supports government surveillance by design, end-to-end encryption does not help.
- laingc 3y ago
  That is simply not correct. With properly implemented E2EE, you can communicate confidently over a completely insecure channel. You could post the entire data stream publicly on the internet with no loss of privacy.
  - timkam 3y ago
    Sorry, to refine my comment: what typical B2C messengers and social media apps sell as end-to-end encryption does not help. Is this correct?
    - pests 3y ago
      No? What do you dislike about current E2EE?
      - timkam 3y ago
        I would still assume that with apps like Snapchat, there are inherent problems on meta-level (from an E2EE view) because for the users, Snapchat is essentially a trusted third party, providing governance/management features. But it can well be that Snapchat does not provide E2EE; I cannot see any remarks about it on their webpage. However, on the WhatsApp webpage, you can find the E2EE hand-waving that I was alluding to: https://faq.whatsapp.com/820124435853543 https://faq.whatsapp.com/820124435853543 "WhatsApp _considers_ chats with businesses that use the WhatsApp Business app or manage and store customer messages themselves to be end-to-end encrypted." And later, they write that in many cases, Meta can actually read the messages.
- klmr 3y ago
  The entire point of TLS (let alone E2EE!) is to make something like this particular scenario safe.
jareklupinski 3y ago
> it seems like someone has access to the plaintext message other than the participants of the conversation yea, everyone looking over your shoulder :)

__m 3y ago

Snapchat texts are not end to end encrypted. I think we know exactly how that happens since Snowden. There won’t be political ramifications. Though this might be more tangible to the average users that don’t care about privacy.

spuz 3y ago
But is there any claim that Snapchat automatically filters messages and alerts the UK security services?
- lukeschlather 3y ago
  Snapchat messages being surreptitiously downloaded and monitored by the NSA at some point where they are unencrypted (possibly only within Snapchat's datacenters) is consistent with what was revealed in Prism. I know that most companies have updated their standards to treat any network traffic as insecure since Prism but it's possible Snapchat doesn't. Also as I understand it the NSA also has no legal issues with sharing any messages intercepted with the UK so long as one of the parties to the conversation is not a US national or on US soil.

gtvwill 3y ago

Errr phones aren't safe. They are backdoored up the wazoo. Same with all your messaging companies. Any that are decent in size have had a visit from authorities and aren't allowed to disclose to you they have. Iphones, android it doesn't matter. Your phones about the least safe tech device you own. It literally hacks itself if sent the right messages. Edit: OK so it seems a fair few folks don't understand how spying across borders and things like the 5 eyes mean your tracked without a warrant legally. So here's how it works. All 5 eyes countries are not allowed to spy on their own citizens in their countries without a warrant. All 5 eyes countries are allowed to surveil info about foreign individuals without a warrant. 5 eyes intel agencies basically just have to pipe a copy of local data say fb or in this case snapchat out via a friend in a another country then back to themselves and they don't need a warrant. As the data has now come from Intel sharing from your 5 eyes peers. The 5 eyes intel agencies between them all have deals and flex with just about every other intel agency in the world except the obvious few. Intel sharing these days is as much as a treasure hunt for legal loopholes to get the data as it is hunting the data itself.

gjvc 3y ago
It literally hacks itself if sent the right messages. can you think of any CCC presentations which explain this?
- gtvwill 3y ago
  Its stuff like this. Phone recieves message, runs code embedded in msg for nfi reason why literally starting off the chain of events/exploits to hack yo device. https://eugene.kaspersky.com/2023/06/01/a-matter-of-triangulation/ https://eugene.kaspersky.com/2023/06/01/a-matter-of-triangul... We've had a few of these types of entry points in phones now over the years. Enough that if its still happening its probably by design as a favor to a 3 letter agency.
  - ithkuil 3y ago
    > as a favor to a 3 letter agency. BBC ?

ghaff 3y ago

For that matter, you send something to someone as a joke. Maybe they think you're serious. Maybe they tell a friend. Maybe you sent it to the wrong person. Etc. Who knows what happens here.

timkam 3y ago

The article somewhat suggests that the guy used the airport's wifi. In this case and assuming that the wifi network supports government surveillance by design, end-to-end encryption does not help.

laingc 3y ago
That is simply not correct. With properly implemented E2EE, you can communicate confidently over a completely insecure channel. You could post the entire data stream publicly on the internet with no loss of privacy.
- timkam 3y ago
  Sorry, to refine my comment: what typical B2C messengers and social media apps sell as end-to-end encryption does not help. Is this correct?
  - pests 3y ago
    No? What do you dislike about current E2EE?
    - timkam 3y ago
      I would still assume that with apps like Snapchat, there are inherent problems on meta-level (from an E2EE view) because for the users, Snapchat is essentially a trusted third party, providing governance/management features. But it can well be that Snapchat does not provide E2EE; I cannot see any remarks about it on their webpage. However, on the WhatsApp webpage, you can find the E2EE hand-waving that I was alluding to: https://faq.whatsapp.com/820124435853543 https://faq.whatsapp.com/820124435853543 "WhatsApp _considers_ chats with businesses that use the WhatsApp Business app or manage and store customer messages themselves to be end-to-end encrypted." And later, they write that in many cases, Meta can actually read the messages.
klmr 3y ago
The entire point of TLS (let alone E2EE!) is to make something like this particular scenario safe.

jareklupinski 3y ago

> it seems like someone has access to the plaintext message other than the participants of the conversation yea, everyone looking over your shoulder :)