7 ms·

I don’t know how you can access Signal without a public Internet connection. It isn’t like Signal is setup on Azure US Government (as far as I am aware) or Amaz

I don’t know how you can access Signal without a public Internet connection. It isn’t like Signal is setup on Azure US Government (as far as I am aware) or Amazon equivalent. Does anyone know? Signal uses HTTPS for contact discovery and account registration. Then, it switches to its own Signal protocol to provide end-to-end encryption. There would have to be some egress rule to allow Signal access from Azure. Signal is a commercial app. Even if access was allowed from Cloud or some other Defense network, it would still be considered “dirty” as the article says because it’s still going over the Public Internet to a commercial software provider. Communications are encrypted barring some MiTM attack. Not a good idea to discuss secret things on an app that isn’t approved for it but is this article reaching a bit? I think the article is pointing out the obvious. The only way to access Signal is over the public Internet with HTTPS and end to end encryption provided by Signal.

Cthulhu_ 2y ago
> is this article reaching a bit? Is it? This circumented the Pentagon's security protocols, presumably disrupting its air gap. This is a national security breach on the highest level, I'd say it's pretty serious and I don't understand why anyone is in the comment section trying to downplay or defend it.
- firesteelrain 2y ago
  How did it disrupt its air gap? Thats presumably still in tact. If the article is true then he has an Internet connection in his office. He also has one on his personal cell, and probably his home. He could use Signal anywhere.
  - kasey_junk 2y ago
    And did!
  - Scarblac 2y ago
    The secretary of defense was talking about military secrets on a device that does not have an air gap with the internet, so it was breached.
    - firesteelrain 2y ago
      That is not a breach. That’s a leak. If true then he spilled secrets. I don’t know what is and isn’t secret in his communications. Everyone is just assuming it was.
      - op00to 2y ago
        We do know what was said in at least one chat. Tactical battle information including timing and sequencing. Highly protected information, and a federal crime to disclose. What’s the difference between a breach, a leak, and a spill? It seems like you’re the one reaching here.
        firesteelrain 2y ago
        Definitions https://csrc.nist.rip/glossary/term/classified_information_spillage https://csrc.nist.rip/glossary/term/classified_information_s... “ An air gap involves physically isolating a computer or network from other networks to prevent unauthorized access and data breaches. This method creates a literal "air gap" between the secured network and any other unsecured networks. Air gaps are an isolation method crucial for data integrity and security and can be deployed across various industries.” https://www.fortinet.com/resources/cyberglossary/what-is-air-gap https://www.fortinet.com/resources/cyberglossary/what-is-air... What part of what he communicated is classified and what is everyone basing that on? What says it is ?
        DonHopkins 2y ago
        [flagged]
        firesteelrain 2y ago
- diego898 2y ago
  Not downplaying or defending - but I don’t understand the failure mode here - presumably hegseth had to ask someone in pentagon IT to set this up? Submit a form etc. sure he asked for something illegal* but someone actually following a set of rules had to enable this, no? (* or against protocols, etc)
  - lukev 2y ago
    The failure mode is that the Secretary of Defense unilaterally bypassed security protocols to use technology that had not been evaluated for that use case in a national security context by the appropriate experts. It doesn't matter if he happened to use something that has a solid security model. The problem isn't Signal, it's that he ignored all the rules. And it does have an impact, as we see in other news, because one failure mode of Signal is that it's super easy to add the wrong people to a group. Which has actually happened. Twice (at least.)
    - diego898 2y ago
      I 100% agree - I’m only saying hegseth didn’t run an unsecured line into his office himself no? Why didn’t some automated system say “installation of unsecured lines in this building is not possible” or similar To be course : I didn’t think something so obviously wrong would have been allowed and enabled by several people who made this possible - removing absolutely no accountability from the person who asked for this to happen
      - lukev 2y ago
        If this happened the way it's being reported, yeah, several people should lose their jobs. I suspect this is a case of being more afraid of saying "no" to the boss than of facing consequences for violating policy. Policies are unfortunately not self-enforcing. Trump's been firing Inspectors General and dismantling mechanisms of internal accountability across the government, so perhaps that's a correct calculus in this case.
    - betaby 2y ago
      > to use technology that had not been evaluated for that use case I'm curious what technology has been evaluated for secure communications. Are there better option? Is MS Teams approved?
afpx 2y ago
Wouldn't MiTM be relatively easy for a state actor or even well-coordinated non-state actors? At least, if I was a state, I'd have backdoors in as many open source projects as I could and agents in the orginzations in the supply chain. It's a crazy world when the person in charge of the US military is more paranoid about their own government than random people they don't even know. If you go back far enough in the Twitter archives, you can see where Jack Dorsey basically tells everyone to switch to Signal to communicate with him. Was that the point when they all started colluding on Signal?
- XorNot 2y ago
  With Signal? Sort of. Signal has countermeasures for this but no one knows how to use them - it's very much a trust on first use system. Fine for regular people, not at all fine when you're target number one for every foreign intelligence service on the planet.
  - victorbjorklund 2y ago
    which countermeasures require active involvement from the user? (honest question because I am curious)
    - firesteelrain 2y ago
      You do need a PIN to secure the communications on either end. I assume it’s used in the salting process
    - XorNot 2y ago
      You need to verify safety codes on someone's device to actually verify they control the device with the Signal account you're communicating too, rather then it just being relayed by a false account somewhere due to a MITM attack.
- klabb3 2y ago
  Or even the infamous and highly sophisticated reporter-in-the-middle attack, where the victim is drunk and rambling, has no idea how to verify public keys in order to actually use the e2ee correctly, then fat-finger adds people by nickname from a contact list that’s full of personal connections.
aqme28 2y ago
I'm not following your logic here. He is not allowed to use Signal for his work. It sounds like there were some measures in place to block lots of "normal internet" (for any number of good reasons), which would include Signal. He then deliberately circumvented those measures so he could use Signal. Deliberately circumventing security and policy protocols is a bad thing in itself.
- firesteelrain 2y ago
  The article premise is that he used dirty Internet connection to access Signal. My argument is that is the only known way to access Signal as far as we are all aware. Because as has already been stated, it’s only approved for unclassified communications only per DoD policy. I don’t know what’s secret in his communications because we don’t know what the government has designated as such. https://dodcio.defense.gov/Portals/0/Documents/Library/Memo-UseOfUnclassMobileApps.pdf https://dodcio.defense.gov/Portals/0/Documents/Library/Memo-...

Cthulhu_ 2y ago

> is this article reaching a bit? Is it? This circumented the Pentagon's security protocols, presumably disrupting its air gap. This is a national security breach on the highest level, I'd say it's pretty serious and I don't understand why anyone is in the comment section trying to downplay or defend it.

firesteelrain 2y ago
How did it disrupt its air gap? Thats presumably still in tact. If the article is true then he has an Internet connection in his office. He also has one on his personal cell, and probably his home. He could use Signal anywhere.
- kasey_junk 2y ago
  And did!
- Scarblac 2y ago
  The secretary of defense was talking about military secrets on a device that does not have an air gap with the internet, so it was breached.
  - firesteelrain 2y ago
    That is not a breach. That’s a leak. If true then he spilled secrets. I don’t know what is and isn’t secret in his communications. Everyone is just assuming it was.
    - op00to 2y ago
      We do know what was said in at least one chat. Tactical battle information including timing and sequencing. Highly protected information, and a federal crime to disclose. What’s the difference between a breach, a leak, and a spill? It seems like you’re the one reaching here.
      - firesteelrain 2y ago
        Definitions https://csrc.nist.rip/glossary/term/classified_information_spillage https://csrc.nist.rip/glossary/term/classified_information_s... “ An air gap involves physically isolating a computer or network from other networks to prevent unauthorized access and data breaches. This method creates a literal "air gap" between the secured network and any other unsecured networks. Air gaps are an isolation method crucial for data integrity and security and can be deployed across various industries.” https://www.fortinet.com/resources/cyberglossary/what-is-air-gap https://www.fortinet.com/resources/cyberglossary/what-is-air... What part of what he communicated is classified and what is everyone basing that on? What says it is ?
        DonHopkins 2y ago
        [flagged]
        firesteelrain 2y ago
diego898 2y ago
Not downplaying or defending - but I don’t understand the failure mode here - presumably hegseth had to ask someone in pentagon IT to set this up? Submit a form etc. sure he asked for something illegal* but someone actually following a set of rules had to enable this, no? (* or against protocols, etc)
- lukev 2y ago
  The failure mode is that the Secretary of Defense unilaterally bypassed security protocols to use technology that had not been evaluated for that use case in a national security context by the appropriate experts. It doesn't matter if he happened to use something that has a solid security model. The problem isn't Signal, it's that he ignored all the rules. And it does have an impact, as we see in other news, because one failure mode of Signal is that it's super easy to add the wrong people to a group. Which has actually happened. Twice (at least.)
  - diego898 2y ago
    I 100% agree - I’m only saying hegseth didn’t run an unsecured line into his office himself no? Why didn’t some automated system say “installation of unsecured lines in this building is not possible” or similar To be course : I didn’t think something so obviously wrong would have been allowed and enabled by several people who made this possible - removing absolutely no accountability from the person who asked for this to happen
    - lukev 2y ago
      If this happened the way it's being reported, yeah, several people should lose their jobs. I suspect this is a case of being more afraid of saying "no" to the boss than of facing consequences for violating policy. Policies are unfortunately not self-enforcing. Trump's been firing Inspectors General and dismantling mechanisms of internal accountability across the government, so perhaps that's a correct calculus in this case.
  - betaby 2y ago
    > to use technology that had not been evaluated for that use case I'm curious what technology has been evaluated for secure communications. Are there better option? Is MS Teams approved?

afpx 2y ago

Wouldn't MiTM be relatively easy for a state actor or even well-coordinated non-state actors? At least, if I was a state, I'd have backdoors in as many open source projects as I could and agents in the orginzations in the supply chain. It's a crazy world when the person in charge of the US military is more paranoid about their own government than random people they don't even know. If you go back far enough in the Twitter archives, you can see where Jack Dorsey basically tells everyone to switch to Signal to communicate with him. Was that the point when they all started colluding on Signal?

XorNot 2y ago
With Signal? Sort of. Signal has countermeasures for this but no one knows how to use them - it's very much a trust on first use system. Fine for regular people, not at all fine when you're target number one for every foreign intelligence service on the planet.
- victorbjorklund 2y ago
  which countermeasures require active involvement from the user? (honest question because I am curious)
  - firesteelrain 2y ago
    You do need a PIN to secure the communications on either end. I assume it’s used in the salting process
  - XorNot 2y ago
    You need to verify safety codes on someone's device to actually verify they control the device with the Signal account you're communicating too, rather then it just being relayed by a false account somewhere due to a MITM attack.
klabb3 2y ago
Or even the infamous and highly sophisticated reporter-in-the-middle attack, where the victim is drunk and rambling, has no idea how to verify public keys in order to actually use the e2ee correctly, then fat-finger adds people by nickname from a contact list that’s full of personal connections.

aqme28 2y ago

I'm not following your logic here. He is not allowed to use Signal for his work. It sounds like there were some measures in place to block lots of "normal internet" (for any number of good reasons), which would include Signal. He then deliberately circumvented those measures so he could use Signal. Deliberately circumventing security and policy protocols is a bad thing in itself.

firesteelrain 2y ago
The article premise is that he used dirty Internet connection to access Signal. My argument is that is the only known way to access Signal as far as we are all aware. Because as has already been stated, it’s only approved for unclassified communications only per DoD policy. I don’t know what’s secret in his communications because we don’t know what the government has designated as such. https://dodcio.defense.gov/Portals/0/Documents/Library/Memo-UseOfUnclassMobileApps.pdf https://dodcio.defense.gov/Portals/0/Documents/Library/Memo-...