4 ms·

> Signal is not good if your threat includes the US government. It is good cover agaisnt India, Taiwan, Mexico. Probably not agaisnt UK or Israel, eg. Signal i

by rapsey 3y ago

> Signal is not good if your threat includes the US government. It is good cover agaisnt India, Taiwan, Mexico. Probably not agaisnt UK or Israel, eg. Signal is useless against anyone willing to do a deal with Cellebrite/NSO group and the like. Which is pretty much everyone, especially the countries you mentioned.

gruez 3y ago
Nothing is 100% secure against the mossad or whatever, but what are you going to do, not use any electronics communications? Quit being a journalist? Given the constraints it's still the best choice, and using it raises the cost compared to any other alternative.
- rapsey 3y ago
  > Nothing is 100% secure against the mossad or whatever Signal is 0% secure because it is the main target of their attacks.
  - gruez 3y ago
    >Signal is 0% secure because it is the main target of their attacks. 1. This is a non-sequitur. Just because they're trying hard to break it, doesn't necessarily mean it's broken right now. Moreover, even if we grant that they have 0days stockpiled, it doesn't necessarily mean they're going to burn those on any target. 2. What are you going to use instead of signal? Some off-brand messenger that's not "the main target of their attacks" but is also less well scrutinized? I'd rather not engage in security by obscurity.
    - fragmede 3y ago
      Wickr and Threema come to mind, though they're not without their own problems
  - MattPalmer1086 3y ago
    Apps like signal are not intended to individually protect you from hostile states. They let normal people chat with reasonable assurance that their messages are not being read by other people. It also provides very good assurance against mass surveillance. The cryptography is such that even nation states almost certainly can't crack it either. But then, if you were a specific target, they would just compromise your phone, not attack the crypto.
    - hgomersall 3y ago
      I'm always a little sceptical that the government agencies are anything like as capable as they are claimed to be. I've no doubt they have a load of zero days in their back pocket and various techniques to exploit them, but they also have a strong interest in their capabilities being perceived as both extensive and mysterious. The smoke and mirrors stuff they are excellent at.
      - MattPalmer1086 3y ago
        That the capability exists is well documented. See the Pegasus spyware that many governments have used. To what extent it is used against particular targets I'm sure is quite secret.
- impossiblefork 3y ago
  If your system isn't 100% secure against hacking, you can't really use the system for business. The solution you're forced to use if you can't get genuinely secure equipment is of course to not use electronic communications. Genuinely sensitive meetings should be held outside, with no electronic equipment brought and at an unexpected place and time.
  - gruez 3y ago
    > If your system isn't 100% secure against hacking, you can't really use the system for business. In a perfect world? Yeah sure. But in the real world that's simply untenable. Every major browser has critical CVEs every few months. Clearly they're not "100% secure against hacking". Are you suggesting that we "can't really use [them] for business"? >Genuinely sensitive meetings should be held outside, with no electronic equipment brought and at an unexpected place and time. The physical world is anything but secure, especially when you're up against the local security services with tens of thousands of agents. Parabolic microphones exist. Bugs can be installed. "unexpected place and time" might make those hard/expensive to pull off, but it doesn't make it "100% secure". Moreover, how are you supposed to coordinate all of this cloak and dagger stuff without electronic communications?
    - impossiblefork 3y ago
      You don't coordinate this stuff. If you coordinate it people know where to set up their parabolic microphones. You just go off into the woods randomly during lunch, or some other time that is unlikely to be anticipated. Coordinating it would just destroy the security. Also, isn't it better to be overheard by somebody with a parabolic microphone than to have everything collated and stuffed into an LLM without anybody having to do anything?
      - gruez 3y ago
        >You just go off into the woods randomly during lunch, or some other time that is unlikely to be anticipated. That might work if you're planning to start an "insurrection with the boys", but how are you going to "go off into the woods randomly during lunch" if you're a journalist working with an anonymous tipper?
yaris 3y ago
There is a joke from XKCD about "cryptoanalysis" with a 5$ wrench. In the country where I come from there is a joke about another kind of "cryptoanalysis" - thermorectal one. A non-Superman person cannot withstand either. Should we stop using crypto?

by rapsey 3y ago

gruez 3y ago

Nothing is 100% secure against the mossad or whatever, but what are you going to do, not use any electronics communications? Quit being a journalist? Given the constraints it's still the best choice, and using it raises the cost compared to any other alternative.

rapsey 3y ago
> Nothing is 100% secure against the mossad or whatever Signal is 0% secure because it is the main target of their attacks.
- gruez 3y ago
  >Signal is 0% secure because it is the main target of their attacks. 1. This is a non-sequitur. Just because they're trying hard to break it, doesn't necessarily mean it's broken right now. Moreover, even if we grant that they have 0days stockpiled, it doesn't necessarily mean they're going to burn those on any target. 2. What are you going to use instead of signal? Some off-brand messenger that's not "the main target of their attacks" but is also less well scrutinized? I'd rather not engage in security by obscurity.
  - fragmede 3y ago
    Wickr and Threema come to mind, though they're not without their own problems
- MattPalmer1086 3y ago
  Apps like signal are not intended to individually protect you from hostile states. They let normal people chat with reasonable assurance that their messages are not being read by other people. It also provides very good assurance against mass surveillance. The cryptography is such that even nation states almost certainly can't crack it either. But then, if you were a specific target, they would just compromise your phone, not attack the crypto.
  - hgomersall 3y ago
    I'm always a little sceptical that the government agencies are anything like as capable as they are claimed to be. I've no doubt they have a load of zero days in their back pocket and various techniques to exploit them, but they also have a strong interest in their capabilities being perceived as both extensive and mysterious. The smoke and mirrors stuff they are excellent at.
    - MattPalmer1086 3y ago
      That the capability exists is well documented. See the Pegasus spyware that many governments have used. To what extent it is used against particular targets I'm sure is quite secret.
impossiblefork 3y ago
If your system isn't 100% secure against hacking, you can't really use the system for business. The solution you're forced to use if you can't get genuinely secure equipment is of course to not use electronic communications. Genuinely sensitive meetings should be held outside, with no electronic equipment brought and at an unexpected place and time.
- gruez 3y ago
  > If your system isn't 100% secure against hacking, you can't really use the system for business. In a perfect world? Yeah sure. But in the real world that's simply untenable. Every major browser has critical CVEs every few months. Clearly they're not "100% secure against hacking". Are you suggesting that we "can't really use [them] for business"? >Genuinely sensitive meetings should be held outside, with no electronic equipment brought and at an unexpected place and time. The physical world is anything but secure, especially when you're up against the local security services with tens of thousands of agents. Parabolic microphones exist. Bugs can be installed. "unexpected place and time" might make those hard/expensive to pull off, but it doesn't make it "100% secure". Moreover, how are you supposed to coordinate all of this cloak and dagger stuff without electronic communications?
  - impossiblefork 3y ago
    You don't coordinate this stuff. If you coordinate it people know where to set up their parabolic microphones. You just go off into the woods randomly during lunch, or some other time that is unlikely to be anticipated. Coordinating it would just destroy the security. Also, isn't it better to be overheard by somebody with a parabolic microphone than to have everything collated and stuffed into an LLM without anybody having to do anything?
    - gruez 3y ago
      >You just go off into the woods randomly during lunch, or some other time that is unlikely to be anticipated. That might work if you're planning to start an "insurrection with the boys", but how are you going to "go off into the woods randomly during lunch" if you're a journalist working with an anonymous tipper?

yaris 3y ago

There is a joke from XKCD about "cryptoanalysis" with a 5$ wrench. In the country where I come from there is a joke about another kind of "cryptoanalysis" - thermorectal one. A non-Superman person cannot withstand either. Should we stop using crypto?