4 ms·

Welcome back to “key signing parties”. PGP never got enough adoption. At least Signal is simple enough that the (ahem) leaders of the US can (mostly) manage to

by fn-mote 20d ago

Welcome back to “key signing parties”. PGP never got enough adoption. At least Signal is simple enough that the (ahem) leaders of the US can (mostly) manage to use it.

chews 20d ago
Leaders of the US use an Israeli backdoored version of Signal (TM-Signal) TeleMessage by Smarsh was used by DOD, CPB, and others for records retention reasons... also hacked to smithereens.
upofadown 20d ago
Unfortunately, in an end to end encrypted messaging system, an identity is denoted by some sort of long number. That is an inescapable fact. Trusting a third party to correctly map, say, a phone number to a cryptographic identity number eventually results in the sort of attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal. The PGP people were doing the right thing when they were doing education in the form of key signing parties. That is something the user needs to know. Anonymous messengers have no real choice and have to use some sort of number for identity. See Briar, Session or Tox for examples. My comments on Signalgate 1.0: https://articles.59.ca/doku.php?id=em:sg https://articles.59.ca/doku.php?id=em:sg
- mmooss 20d ago
  > attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal Could you give an example of an actual attack of this kind on Signal? The 'Signalgate' event was someone mistakenly inviting the wrong person to a chat.
  - upofadown 19d ago
    Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. Then Signal mapped that number to the wrong cryptographic identity. A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers https://www.dropsitenews.com/p/intercept-signal-tip-line-breach-hack https://www.dropsitenews.com/p/intercept-signal-tip-line-bre... Twilio Incident: What Signal Users Need to Know https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know https://support.signal.org/hc/en-us/articles/4850133017242-T... Russian State-Backed Hackers Intensify Attacks on Signal Messenger Accounts https://thecyberexpress.com/signal-attacks-russian-fackers-target/ https://thecyberexpress.com/signal-attacks-russian-fackers-t...
    - mmooss 18d ago
      Thanks for the rundown. > Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. In what system is Apple mapping numbers to names? The address book is maintained by users. An AppleID? How could that happen? And it would seem to result in many errors before the Signal error. I thought it was simply caused by someone adding the wrong person to the chat? > The Intercept Per that article, the cause is unknown. The speculated cause in the article is that The Intercept somehow lost control of the user id, and Signal recycles user ids. That seems like a bad practice generally and with this predictable consequence, and especially bad for an application people trust with security. > Twilio This was Twilio employees caught by a phishing attack. I wonder what more secure, and affordable, options Signal has. Operate their own SMS infrastructure - would that be more secure that Twilio's? Use something besides SMS - would on-boarding become too hard? Stop using phone numbers - they need some spammer and bot filter, so what replaces it? > Russian State-Backed Hackers A phishing attack on Signal users, using a QR or link to make the attacker a linked device. That setup seems risky for non-technical users; I wonder how Signal could better secure it. That and other attacks are described here. The other attacks all require compromising the device on which Signal is installed: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger https://cloud.google.com/blog/topics/threat-intelligence/rus...

by fn-mote 20d ago

Welcome back to “key signing parties”. PGP never got enough adoption. At least Signal is simple enough that the (ahem) leaders of the US can (mostly) manage to use it.

chews 20d ago

Leaders of the US use an Israeli backdoored version of Signal (TM-Signal) TeleMessage by Smarsh was used by DOD, CPB, and others for records retention reasons... also hacked to smithereens.

upofadown 20d ago

Unfortunately, in an end to end encrypted messaging system, an identity is denoted by some sort of long number. That is an inescapable fact. Trusting a third party to correctly map, say, a phone number to a cryptographic identity number eventually results in the sort of attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal. The PGP people were doing the right thing when they were doing education in the form of key signing parties. That is something the user needs to know. Anonymous messengers have no real choice and have to use some sort of number for identity. See Briar, Session or Tox for examples. My comments on Signalgate 1.0: https://articles.59.ca/doku.php?id=em:sg https://articles.59.ca/doku.php?id=em:sg

mmooss 20d ago
> attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal Could you give an example of an actual attack of this kind on Signal? The 'Signalgate' event was someone mistakenly inviting the wrong person to a chat.
- upofadown 19d ago
  Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. Then Signal mapped that number to the wrong cryptographic identity. A Third Party Breached The Intercept’s Signal Tip Line and Has Been Soliciting Whistleblowers https://www.dropsitenews.com/p/intercept-signal-tip-line-breach-hack https://www.dropsitenews.com/p/intercept-signal-tip-line-bre... Twilio Incident: What Signal Users Need to Know https://support.signal.org/hc/en-us/articles/4850133017242-Twilio-Incident-What-Signal-Users-Need-to-Know https://support.signal.org/hc/en-us/articles/4850133017242-T... Russian State-Backed Hackers Intensify Attacks on Signal Messenger Accounts https://thecyberexpress.com/signal-attacks-russian-fackers-target/ https://thecyberexpress.com/signal-attacks-russian-fackers-t...
  - mmooss 18d ago
    Thanks for the rundown. > Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. In what system is Apple mapping numbers to names? The address book is maintained by users. An AppleID? How could that happen? And it would seem to result in many errors before the Signal error. I thought it was simply caused by someone adding the wrong person to the chat? > The Intercept Per that article, the cause is unknown. The speculated cause in the article is that The Intercept somehow lost control of the user id, and Signal recycles user ids. That seems like a bad practice generally and with this predictable consequence, and especially bad for an application people trust with security. > Twilio This was Twilio employees caught by a phishing attack. I wonder what more secure, and affordable, options Signal has. Operate their own SMS infrastructure - would that be more secure that Twilio's? Use something besides SMS - would on-boarding become too hard? Stop using phone numbers - they need some spammer and bot filter, so what replaces it? > Russian State-Backed Hackers A phishing attack on Signal users, using a QR or link to make the attacker a linked device. That setup seems risky for non-technical users; I wonder how Signal could better secure it. That and other attacks are described here. The other attacks all require compromising the device on which Signal is installed: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger https://cloud.google.com/blog/topics/threat-intelligence/rus...