4 ms·

One nice side effect of Signal's importance for governmental/military use is that it helps keep it free for civilian use. They can't mandate a backdoor for som

One nice side effect of Signal's importance for governmental/military use is that it helps keep it free for civilian use. They can't mandate a backdoor for something other parts of the government rely on to be secure. I once heard a great anecdote to that effect, and to my embarrassment I can't recall the details to repeat here. (And yes, I understand that there are limits on what is appropriate to share with civilian hardware on a civilian network, but the truth stands that part of the reason there's not a push to breach encryption in the US like there is in the UK is because Signal is relied upon even by the government when they need a private channel on civilian hardware.)

deelowe 2y ago
> They can't mandate a backdoor for something other parts of the government rely on to be secure. Why not? It wouldn't be difficult to have a backdoor in the civilian use-case that's disabled for government use.
- deleted 2y ago
  [deleted]
- richardw 2y ago
  Now the task of an adversary is to simply enable the backdoor rather than create it from scratch. The people using Signal for this are doing it on their own devices, so now you have multiple problems. Eg how to get non technical people to know when they’re using the civilian version. Alternative crazy universe: Just use the tech that was created for the government and does all the right things.
  - moshun 2y ago
    But then you’re required to archive the discussions for the public to access. That’s much worse for these people than foreign agents (and journalists apparently) listening in and taking notes.
  - deelowe 2y ago
    I'm not defending the use of signal. That said this strawman is very weak. It's not uncommon to have two versions of the same app on your phone these days. My Google drive instance changes from personal to company based on my identity. This isn't hard to implement securely these days.
- simonh 2y ago
  A major reason for these people using Signal is specifically to avoid government access to records of these chats. In particular access by future administrations, or current or near future judicial or congressional investigations.
leptons 2y ago
Sorry, but no, there is no good thing to come from government using Signal. With its auto-deleting messages, that makes it illegal for government employees to use, and destroys transparency.
- CoastalCoder 2y ago
  I believe that's true for employees of the executive branch. Is it true for the other two?
  - quantified 2y ago
    The president can pardon anyone.
    - JohnFen 2y ago
      Well, that's not strictly true. The president can't pardon people for convictions by state courts, for instance. Nor can the president issue pardons for presidential impeachments. It's not clear that a president can pardon himself, either, but that's not been tested in court so who knows?
      - quantified 2y ago
        Thanks, yes that is right. We may find out whether a president can pardon himself, but since his actions as president are not prosecutable, there's a lot of latitude for never needing a pardon.
- oniony 2y ago
  Illegal has no meaning for people who can pardon themselves and each other.
  - ElevenLathe 2y ago
    If anything having his appointees commit lots of public crimes is great for Trump because his pardon power then gives them a powerful incentive to please him personally.
kelipso 2y ago
> They can't mandate a backdoor for something other parts of the government rely on to be secure. This is a strong assumption.. A government is a collection of people. While there might not exactly be warring factions in the US government, there are certainly numerous agencies and organizations that operate under varying degrees of independence.
- walterbell 2y ago
  News reports would be much clearer if each faction had a medieval crest, logo, or even UUID.
  - Yoric 2y ago
    Give them a NFT.
- _the_inflator 2y ago
  Even more sinister is the false hope bias. The Signal app can be used as a honeypot to plant a pseudo-secure messenger, a sophisticated device around a backdoor, or even a trojan-like capability. The Tor network was deemed the culprit of anonymity and secure connections not long ago. We all know how it went.
  - jerheinze 2y ago
    > The Signal app can be used as a honeypot to plant a pseudo-secure messenger Given its open source nature that would be exceedingly difficult. > The Tor network was deemed the culprit of anonymity and secure connections not long ago. We all know how it went. What are you talking about? Tor is still the uncontested king of low-latency anonymity networks.
    - arccy 2y ago
      is it really open source when you have to use the binary builds from signal through the app stores? it could be like the xz attack: clean source, bad binaries.
Spooky23 2y ago
Lol. No. BlackBerry was in the same position, and it was absolutely backdoored from a crypto perspective. The FBI doesn’t cry about iPhones anymore, so they’ve likely (along with other entities) identified alternate methods to access communications. The use of these sorts of actions are about avoiding accountability, not security. Again, BlackBerry is the exemplar — PIN messaging was tied to a device, not a user. People 20 years ago were doing these signal chats with BlackBerry devices, swapping them around physically to build these groups. Even then, people in these positions of power weren’t as reckless and incompetent. In addition to the reporter, one of the participants was on a civilian phone in Russia. The FSB or whomever does their signals intelligence got a real-time feed of intelligence, military operations, etc. The American pilots were put at risk, and Israeli spies were burned.
- kingkongjaffa 2y ago
  > The FBI doesn’t cry about iPhones Is there any evidence that iPhones have some security exploit that Apple + Three letter agencies can use?
  - walterbell 2y ago
    Have you looked at the list of security issues fixed by Apple? They contain multiple zero-day exploits found in the wild. This week’s releases: 100+ security issues of varying severity fixed in macOS, 50+ issues fixed in iOS. Citizen Lab has some reports on exploits.
  - redeux 2y ago
    > so they’ve likely (along with other entities) identified alternate methods to access communications. > Is there any evidence that iPhones have some security exploit that Apple + Three letter agencies can use? GP never made that claim.
- walterbell 2y ago
  Does anyone remember which US gov entity funded Signal and Open Whisper Systems? Signal chairman is ex-CEO of Wikipedia. Signal CEO estimated annual costs at $50MM.
yongjik 2y ago
Eh.... you think government officers who fat-clicked a journalist into a top secret discussion would care about whether some other three-letter agency has access to a backdoor in Signal? For all we know, whoever US agent who was responsible for handling these potential "backdoors" is already laid off and is available for pickup by foreign governments with the right payment.
- burn000burn 2y ago
  you believe that fat clicker story? consider this: what if they wanted to leak, they wanted to leak to someone that the bombings were going to put in immediate danger, and they added the journalist just in case the leak got exposed?
  - aaronbrethorst 2y ago
    https://en.m.wikipedia.org/wiki/Occam's_razor https://en.m.wikipedia.org/wiki/Occam's_razor
  - bayarearefugee 2y ago
    Doesn't pass the smell test for me. The most obvious answer is probably the correct one and IMO the most obvious situation would be: Jeffrey Goldberg's number was absolutely in Mike Waltz' phone because Mike Waltz was one of his sources. Mike Waltz accidentally added Jeffrey Goldberg to the chat either due to a misclick or (more likely, IMO) being dumb enough to use a conflicting contact id label for multiple people and being careless when forming the list. Not being able to admit to being a Goldberg source for political reasons, he (Waltz) made up some insane story about the number being 'sucked into his phone' and having never talked to Goldberg. Additionally, I'd assume (based on being the most obvious solution) that Trump et al fully realize Waltz was both responsible for this screwup and would like to fire him for it but view firing him as giving "the libs" a win and have stubbornly kept him on despite not really wanting to (less because of his screwup and more because of who he accidentally added).
    - jiggawatts 2y ago
anxoo 2y ago
i mean... you're saying if signal weren't secure, trump's clown cabinet would stop using it? the guy who kept boxes of top secret documents in a bathroom at mar-a-lago? you don't think they'd just use SMS or facebook messenger or anything if using signal was a slight inconvenience?
deleted 2y ago
[deleted]
alp1n3_eth 2y ago
You'd be surprised how much the government would potentially hurt itself in its own confusion. Not all parts of it are aligned to the same beliefs / mission, and there are certainly parts that believe in the saying "Why are you worried if you have nothing to hide".
- aerostable_slug 2y ago
  There was a rather interesting criticism of the recent wide-ranging cuts to USAID that basically said it wasn't unlikely that some of that USAID money was being used in clandestine intelligence operations (supporting the tribe of this warlord or that, paying someone off, rewarding allegiances, whatever) that DOGE and perhaps even most at USAID would never, ever be cleared to know about. With the inability to prevent those aid packages from being cut without also blowing their operations, the intelligence community would just have to sit and watch it happen. I of course have no way of knowing if that's true or not, or if it is what damage may have been done, but it's interesting to consider.
- bsimpson 2y ago
  I don't claim to be an expert, nor to be able to speak credibly on the interactions of the millions of people in government. I just remember hearing an anecdote from a friend with ties to Signal that some part of the government wanted to recommend it and another part slapped their hand because they didn't want to encourage people to use technology that law enforcement can't breach. Even though I just use it for casual conversations with friends, that gave me some extra confidence in using it.
overfeed 2y ago
> They can't mandate a backdoor for something other parts of the government rely on to be secure Has the NSA moved on from the NOBUS ("NObody But US") doctrine? Empirically, they have been more than happy to keep any vulnerability (or backdoor) available if they believe only they can exploit it.

deelowe 2y ago

> They can't mandate a backdoor for something other parts of the government rely on to be secure. Why not? It wouldn't be difficult to have a backdoor in the civilian use-case that's disabled for government use.

deleted 2y ago
[deleted]
richardw 2y ago
Now the task of an adversary is to simply enable the backdoor rather than create it from scratch. The people using Signal for this are doing it on their own devices, so now you have multiple problems. Eg how to get non technical people to know when they’re using the civilian version. Alternative crazy universe: Just use the tech that was created for the government and does all the right things.
- moshun 2y ago
  But then you’re required to archive the discussions for the public to access. That’s much worse for these people than foreign agents (and journalists apparently) listening in and taking notes.
- deelowe 2y ago
  I'm not defending the use of signal. That said this strawman is very weak. It's not uncommon to have two versions of the same app on your phone these days. My Google drive instance changes from personal to company based on my identity. This isn't hard to implement securely these days.
simonh 2y ago
A major reason for these people using Signal is specifically to avoid government access to records of these chats. In particular access by future administrations, or current or near future judicial or congressional investigations.

leptons 2y ago

Sorry, but no, there is no good thing to come from government using Signal. With its auto-deleting messages, that makes it illegal for government employees to use, and destroys transparency.

CoastalCoder 2y ago
I believe that's true for employees of the executive branch. Is it true for the other two?
- quantified 2y ago
  The president can pardon anyone.
  - JohnFen 2y ago
    Well, that's not strictly true. The president can't pardon people for convictions by state courts, for instance. Nor can the president issue pardons for presidential impeachments. It's not clear that a president can pardon himself, either, but that's not been tested in court so who knows?
    - quantified 2y ago
      Thanks, yes that is right. We may find out whether a president can pardon himself, but since his actions as president are not prosecutable, there's a lot of latitude for never needing a pardon.
oniony 2y ago
Illegal has no meaning for people who can pardon themselves and each other.
- ElevenLathe 2y ago
  If anything having his appointees commit lots of public crimes is great for Trump because his pardon power then gives them a powerful incentive to please him personally.

kelipso 2y ago

> They can't mandate a backdoor for something other parts of the government rely on to be secure. This is a strong assumption.. A government is a collection of people. While there might not exactly be warring factions in the US government, there are certainly numerous agencies and organizations that operate under varying degrees of independence.

walterbell 2y ago
News reports would be much clearer if each faction had a medieval crest, logo, or even UUID.
- Yoric 2y ago
  Give them a NFT.
_the_inflator 2y ago
Even more sinister is the false hope bias. The Signal app can be used as a honeypot to plant a pseudo-secure messenger, a sophisticated device around a backdoor, or even a trojan-like capability. The Tor network was deemed the culprit of anonymity and secure connections not long ago. We all know how it went.
- jerheinze 2y ago
  > The Signal app can be used as a honeypot to plant a pseudo-secure messenger Given its open source nature that would be exceedingly difficult. > The Tor network was deemed the culprit of anonymity and secure connections not long ago. We all know how it went. What are you talking about? Tor is still the uncontested king of low-latency anonymity networks.
  - arccy 2y ago
    is it really open source when you have to use the binary builds from signal through the app stores? it could be like the xz attack: clean source, bad binaries.

Spooky23 2y ago

Lol. No. BlackBerry was in the same position, and it was absolutely backdoored from a crypto perspective. The FBI doesn’t cry about iPhones anymore, so they’ve likely (along with other entities) identified alternate methods to access communications. The use of these sorts of actions are about avoiding accountability, not security. Again, BlackBerry is the exemplar — PIN messaging was tied to a device, not a user. People 20 years ago were doing these signal chats with BlackBerry devices, swapping them around physically to build these groups. Even then, people in these positions of power weren’t as reckless and incompetent. In addition to the reporter, one of the participants was on a civilian phone in Russia. The FSB or whomever does their signals intelligence got a real-time feed of intelligence, military operations, etc. The American pilots were put at risk, and Israeli spies were burned.

kingkongjaffa 2y ago
> The FBI doesn’t cry about iPhones Is there any evidence that iPhones have some security exploit that Apple + Three letter agencies can use?
- walterbell 2y ago
  Have you looked at the list of security issues fixed by Apple? They contain multiple zero-day exploits found in the wild. This week’s releases: 100+ security issues of varying severity fixed in macOS, 50+ issues fixed in iOS. Citizen Lab has some reports on exploits.
- redeux 2y ago
  > so they’ve likely (along with other entities) identified alternate methods to access communications. > Is there any evidence that iPhones have some security exploit that Apple + Three letter agencies can use? GP never made that claim.
walterbell 2y ago
Does anyone remember which US gov entity funded Signal and Open Whisper Systems? Signal chairman is ex-CEO of Wikipedia. Signal CEO estimated annual costs at $50MM.

yongjik 2y ago

Eh.... you think government officers who fat-clicked a journalist into a top secret discussion would care about whether some other three-letter agency has access to a backdoor in Signal? For all we know, whoever US agent who was responsible for handling these potential "backdoors" is already laid off and is available for pickup by foreign governments with the right payment.

burn000burn 2y ago
you believe that fat clicker story? consider this: what if they wanted to leak, they wanted to leak to someone that the bombings were going to put in immediate danger, and they added the journalist just in case the leak got exposed?
- aaronbrethorst 2y ago
  https://en.m.wikipedia.org/wiki/Occam's_razor https://en.m.wikipedia.org/wiki/Occam's_razor
- bayarearefugee 2y ago
  Doesn't pass the smell test for me. The most obvious answer is probably the correct one and IMO the most obvious situation would be: Jeffrey Goldberg's number was absolutely in Mike Waltz' phone because Mike Waltz was one of his sources. Mike Waltz accidentally added Jeffrey Goldberg to the chat either due to a misclick or (more likely, IMO) being dumb enough to use a conflicting contact id label for multiple people and being careless when forming the list. Not being able to admit to being a Goldberg source for political reasons, he (Waltz) made up some insane story about the number being 'sucked into his phone' and having never talked to Goldberg. Additionally, I'd assume (based on being the most obvious solution) that Trump et al fully realize Waltz was both responsible for this screwup and would like to fire him for it but view firing him as giving "the libs" a win and have stubbornly kept him on despite not really wanting to (less because of his screwup and more because of who he accidentally added).
  - jiggawatts 2y ago

anxoo 2y ago

i mean... you're saying if signal weren't secure, trump's clown cabinet would stop using it? the guy who kept boxes of top secret documents in a bathroom at mar-a-lago? you don't think they'd just use SMS or facebook messenger or anything if using signal was a slight inconvenience?

deleted 2y ago

[deleted]

alp1n3_eth 2y ago

You'd be surprised how much the government would potentially hurt itself in its own confusion. Not all parts of it are aligned to the same beliefs / mission, and there are certainly parts that believe in the saying "Why are you worried if you have nothing to hide".

aerostable_slug 2y ago
There was a rather interesting criticism of the recent wide-ranging cuts to USAID that basically said it wasn't unlikely that some of that USAID money was being used in clandestine intelligence operations (supporting the tribe of this warlord or that, paying someone off, rewarding allegiances, whatever) that DOGE and perhaps even most at USAID would never, ever be cleared to know about. With the inability to prevent those aid packages from being cut without also blowing their operations, the intelligence community would just have to sit and watch it happen. I of course have no way of knowing if that's true or not, or if it is what damage may have been done, but it's interesting to consider.
bsimpson 2y ago
I don't claim to be an expert, nor to be able to speak credibly on the interactions of the millions of people in government. I just remember hearing an anecdote from a friend with ties to Signal that some part of the government wanted to recommend it and another part slapped their hand because they didn't want to encourage people to use technology that law enforcement can't breach. Even though I just use it for casual conversations with friends, that gave me some extra confidence in using it.

overfeed 2y ago

> They can't mandate a backdoor for something other parts of the government rely on to be secure Has the NSA moved on from the NOBUS ("NObody But US") doctrine? Empirically, they have been more than happy to keep any vulnerability (or backdoor) available if they believe only they can exploit it.