5 ms·

Many people are already familiar with Moxie Marlinspike's WhisperSystems because of their Android apps: RedPhone for encrypted calls, and TextSecure for SMS mes

Many people are already familiar with Moxie Marlinspike's WhisperSystems because of their Android apps: RedPhone for encrypted calls, and TextSecure for SMS messages. The release of Signal is a pretty big deal for iOS users; previously, we had to consider a paid option like Silent Circle, or a larger corporate option like FaceTime Audio (which isn't really the same). Although I haven't actually used the app yet (it's registering now), the screenshots appear to be a fairly direct port of RedPhone to iOS. Edit: Yep! And it looks like Signal users can make secure calls to contacts with RedPhone installed, too. Very nice.

deleted 12y ago
[deleted]
- nnnnni 12y ago
  We're going to need verifiable sources for claims like that.
  - deleted 12y ago
    [deleted]
    - ChrisAntaki 12y ago
      Subtle marketing.
    - deleted 12y ago
      [deleted]
    - deleted 12y ago
      [deleted]
    - deleted 12y ago
      [deleted]
    - deleted 12y ago
      [deleted]
    - superuser2 12y ago
      >sitting on a bunch of exploits This is an important point. We waste a lot of breath accusing people of having deliberately planted backdoors, and moving to alternatives that we think are too trustworthy to have backdoors in them. Whether or not the programmers behave ethically, they're still going to make mistakes and write vulnerable code like everyone else, and you'd better believe the security services (and their contractors) are looking for them.
    - Bud 12y ago
      Apparently they're not that secretive, since you know about their internal tech, and you didn't work there and didn't even have an interview. Pardon me for saying so, but your original comment and your responses to various requests for substantiation don't pass the bullshit test. I'm not saying you are wrong, but I am saying you haven't remotely proven your claims to this audience.
      - mikevm 12y ago
        Ok, then don't believe me. I'm just going to move on now.
        deleted 12y ago
        [deleted]
        deleted 12y ago
        [deleted]
  - rsync 12y ago
    "We're going to need verifiable sources for claims like that." This entire parent+thread argument back and forth is completely absurd. It doesn't matter whether he has sources. It doesn't matter whether that firm does or does not exist. It doesn't matter what you think of their tech or his explanation or who is who or what is what. Your phone has two[1] completely independent, full-featured computers inside of it, totally distinct from the actual computer that is your phone (that you use) that are completely out of your control, and depending on the model, have up to DMA control over your device. Whisper systems does not solve this. SecurePhoneBlahBlah does not solve this. Moxie Marlinspike does not solve this. If you have a smartphone, you are owned at a deeper level than you've ever been owned before and there is nothing you can do about it other than removing your SIM card. Game over. [1] The baseband processor and the SIM chip itself.
    - foobarqux 12y ago
      Hardening the device itself is necessary but encrypted comms are just as important and arguably more pressing and easier to do. One thing at a time.
    - scintill76 12y ago
      Keep in mind that even without a SIM, the GSM radio is still active[1]. From my GSM-layman perspective, it sounds safer than being in a "trusted" pairing with the network, yet since it's all closed source, you have to wonder if there are magic packets that can own your device just as badly as if you have a SIM in. [1] https://security.stackexchange.com/questions/30876/can-android-phone-running-without-sim-card-be-tracked-localized-by-police https://security.stackexchange.com/questions/30876/can-andro...
    - rdtsc 12y ago
      Great point -- that is 101 of any serious security equipment validation. It is not that this software package/app or that card and so on are certified. The whole package from ground up (hardware components down to analog bits, EM emission... up to top level application get certified as secure) has to be. I can't buy some mathematically proven secure software, install it on a Chinese tablet and claim it is secure and expect it to get approved. This is a funny market as some domestic analog components are hard to find today. Micron, I think, makes some but heck most are sourced from China. This makes 'secure' hardware ridiculously expensive. As in $50k+ for switches and routers and there is a whole market specializing in it. Now, one can look at it another way -- some security is better than no security. I can see the argument on both sides. At least if NSA can record my phone calls maybe the local cops can't and so on...
- gecko 12y ago
  Is there any way you can substantiate any of this? I wouldn't be shocked, but it seems borderline implausible that we'd be getting all this interest in various ways to hack into iPhones physically if you could just dial a number--and I think it also goes without saying that, whether Apple provides official backdoors or no, it has a high interest in ensuring that there aren't any unofficial backdoors for many other reasons (preserving DRM for one example, if you need them to have a selfish motivation).
  - deleted 12y ago
    [deleted]
    - johnm1019 12y ago
      No one hides from google http://www.haaretz.com/business/economy-finance/1.574805 http://www.haaretz.com/business/economy-finance/1.574805
      - Finster 12y ago
        Except, of course, everybody on the deep web.
        lifeisstillgood 12y ago
        I'm fascinated by this idea of a deep web only accessible by the cognoscenti. Presumably if a link slips out then the deep web becomes a lot shallower?
        alcari 12y ago
        Not necessarily, because things like robots.txt will still prevent it from ending up in search engine results.
        feld 12y ago
        I forgot about the part where it's mandatory for search engines to comply with a robots.txt
- deleted 12y ago
  [deleted]
- chmars 12y ago
  That will always remain an issue: Even if someone manages to create a secure app, the software and hardware platform will never be secure. Hijacking a smartphone by only knowing its number on the other hand does not seem realistic too me. So a source for this claim would be great …
  - mikevm 12y ago
    https://news.ycombinator.com/item?id=8103873 https://news.ycombinator.com/item?id=8103873
    - chmars 12y ago
      I don't doubt the existence of the company, I doubt the hijacking capabilities …
  - mrb 12y ago
    It seems realistic to me. Just send a phishing SMS ("Your bill of $103.54 is due TODAY: http://payments-comcast.net/83954583" http://payments-comcast.net/83954583"), hope the user clicks it, have the webpage exploit one of the numerous iOS Safari vulnerabilities, and you are done. There are tons of vulnerabilities in smartphone browsers: iOS 7.1.2 alone fixed 28 UNIQUE VULNERABILITIES in Webkit (http://support.apple.com/kb/HT6297 http://support.apple.com/kb/HT6297) 7.1.2 was released merely 2 months after 7.1.1, so at least 3 vulnerabilities are discovered and fixed every week.
- rdl 12y ago
  It's possible to do this in a staged way -- basically, give me 100k phone numbers, I'll do automated attacks and catch 25-50k of them (old unpatched OSes for which if I had a $5-10mm budget I'd have 0-days ready, phishing, etc.). Then, use the early victims to catch the rest -- hopefully they're admin assistants, HR people, etc. Targeted attacks on the rest. Black bag jobs on the remainder, using legal or extralegal means, based on value of the target. It's not worth bothering to black bag someone who you only want to get the big boss if the big boss is otherwise exploitable. The key is you don't need to have a single exploit which works on 100% of your targets; you can do multiple things.
  - foobarqux 12y ago
    The cost increases dramatically compared to unencrypted comms. Moreover you risk wasting valuable 0-days on targets that may not be worth it.
    - rdl 12y ago
      Plus, risk of alerting the target (which is why targeting hackers is unwise...) I wasn't arguing against encryption tools, just that serious attackers are plausible threats.
- humannature 12y ago
  You didn't even work at said company let alone interview there, so what makes you claim they can "hijack an iPhone remotely by only knowing a person's phone number"?
- opendais 12y ago
  To be fair, the stuff you are talking about is targeted malware. The odds of people being actively targeted rather than passively surveilled is orders of magnitude in difference. Everyone is being passively watched at some level, even if it is just for billing purposes. Defense is always about defense in depth. Always.
- foobarqux 12y ago
  Signal makes it much harder to tap your phone and makes mass surveillance extremely difficult, both of which are still important. But you're right that people need to be informed of the risks they still face.
- chrismsnz 12y ago
  Does this involve collusion with the telco? IIRC There's a fair amount of baseband-layer stuff that can be done with SMS from a trusted party.
sarciszewski 12y ago
Definitely a huge win for Apple consumers. :)
stevengg 12y ago
Moxie also made a sailing documentary that is good called hold fast http://vimeo.com/15351476 http://vimeo.com/15351476
- frandroid 12y ago
  OMG I knew the name sounded familiar. This doc is SO GOOD.
  - scintill76 12y ago
    Funny that a HN member would know his name from that rather than his security work. I guess we're pretty diverse. :) I enjoyed that doc too.

deleted 12y ago

[deleted]

nnnnni 12y ago
We're going to need verifiable sources for claims like that.
- deleted 12y ago
  [deleted]
  - ChrisAntaki 12y ago
    Subtle marketing.
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - superuser2 12y ago
    >sitting on a bunch of exploits This is an important point. We waste a lot of breath accusing people of having deliberately planted backdoors, and moving to alternatives that we think are too trustworthy to have backdoors in them. Whether or not the programmers behave ethically, they're still going to make mistakes and write vulnerable code like everyone else, and you'd better believe the security services (and their contractors) are looking for them.
  - Bud 12y ago
    Apparently they're not that secretive, since you know about their internal tech, and you didn't work there and didn't even have an interview. Pardon me for saying so, but your original comment and your responses to various requests for substantiation don't pass the bullshit test. I'm not saying you are wrong, but I am saying you haven't remotely proven your claims to this audience.
    - mikevm 12y ago
      Ok, then don't believe me. I'm just going to move on now.
      - deleted 12y ago
        [deleted]
        deleted 12y ago
        [deleted]
- rsync 12y ago
  "We're going to need verifiable sources for claims like that." This entire parent+thread argument back and forth is completely absurd. It doesn't matter whether he has sources. It doesn't matter whether that firm does or does not exist. It doesn't matter what you think of their tech or his explanation or who is who or what is what. Your phone has two[1] completely independent, full-featured computers inside of it, totally distinct from the actual computer that is your phone (that you use) that are completely out of your control, and depending on the model, have up to DMA control over your device. Whisper systems does not solve this. SecurePhoneBlahBlah does not solve this. Moxie Marlinspike does not solve this. If you have a smartphone, you are owned at a deeper level than you've ever been owned before and there is nothing you can do about it other than removing your SIM card. Game over. [1] The baseband processor and the SIM chip itself.
  - foobarqux 12y ago
    Hardening the device itself is necessary but encrypted comms are just as important and arguably more pressing and easier to do. One thing at a time.
  - scintill76 12y ago
    Keep in mind that even without a SIM, the GSM radio is still active[1]. From my GSM-layman perspective, it sounds safer than being in a "trusted" pairing with the network, yet since it's all closed source, you have to wonder if there are magic packets that can own your device just as badly as if you have a SIM in. [1] https://security.stackexchange.com/questions/30876/can-android-phone-running-without-sim-card-be-tracked-localized-by-police https://security.stackexchange.com/questions/30876/can-andro...
  - rdtsc 12y ago
    Great point -- that is 101 of any serious security equipment validation. It is not that this software package/app or that card and so on are certified. The whole package from ground up (hardware components down to analog bits, EM emission... up to top level application get certified as secure) has to be. I can't buy some mathematically proven secure software, install it on a Chinese tablet and claim it is secure and expect it to get approved. This is a funny market as some domestic analog components are hard to find today. Micron, I think, makes some but heck most are sourced from China. This makes 'secure' hardware ridiculously expensive. As in $50k+ for switches and routers and there is a whole market specializing in it. Now, one can look at it another way -- some security is better than no security. I can see the argument on both sides. At least if NSA can record my phone calls maybe the local cops can't and so on...
gecko 12y ago
Is there any way you can substantiate any of this? I wouldn't be shocked, but it seems borderline implausible that we'd be getting all this interest in various ways to hack into iPhones physically if you could just dial a number--and I think it also goes without saying that, whether Apple provides official backdoors or no, it has a high interest in ensuring that there aren't any unofficial backdoors for many other reasons (preserving DRM for one example, if you need them to have a selfish motivation).
- deleted 12y ago
  [deleted]
  - johnm1019 12y ago
    No one hides from google http://www.haaretz.com/business/economy-finance/1.574805 http://www.haaretz.com/business/economy-finance/1.574805
    - Finster 12y ago
      Except, of course, everybody on the deep web.
      - lifeisstillgood 12y ago
        I'm fascinated by this idea of a deep web only accessible by the cognoscenti. Presumably if a link slips out then the deep web becomes a lot shallower?
        alcari 12y ago
        Not necessarily, because things like robots.txt will still prevent it from ending up in search engine results.
        feld 12y ago
        I forgot about the part where it's mandatory for search engines to comply with a robots.txt
deleted 12y ago
[deleted]
chmars 12y ago
That will always remain an issue: Even if someone manages to create a secure app, the software and hardware platform will never be secure. Hijacking a smartphone by only knowing its number on the other hand does not seem realistic too me. So a source for this claim would be great …
- mikevm 12y ago
  https://news.ycombinator.com/item?id=8103873 https://news.ycombinator.com/item?id=8103873
  - chmars 12y ago
    I don't doubt the existence of the company, I doubt the hijacking capabilities …
- mrb 12y ago
  It seems realistic to me. Just send a phishing SMS ("Your bill of $103.54 is due TODAY: http://payments-comcast.net/83954583" http://payments-comcast.net/83954583"), hope the user clicks it, have the webpage exploit one of the numerous iOS Safari vulnerabilities, and you are done. There are tons of vulnerabilities in smartphone browsers: iOS 7.1.2 alone fixed 28 UNIQUE VULNERABILITIES in Webkit (http://support.apple.com/kb/HT6297 http://support.apple.com/kb/HT6297) 7.1.2 was released merely 2 months after 7.1.1, so at least 3 vulnerabilities are discovered and fixed every week.
rdl 12y ago
It's possible to do this in a staged way -- basically, give me 100k phone numbers, I'll do automated attacks and catch 25-50k of them (old unpatched OSes for which if I had a $5-10mm budget I'd have 0-days ready, phishing, etc.). Then, use the early victims to catch the rest -- hopefully they're admin assistants, HR people, etc. Targeted attacks on the rest. Black bag jobs on the remainder, using legal or extralegal means, based on value of the target. It's not worth bothering to black bag someone who you only want to get the big boss if the big boss is otherwise exploitable. The key is you don't need to have a single exploit which works on 100% of your targets; you can do multiple things.
- foobarqux 12y ago
  The cost increases dramatically compared to unencrypted comms. Moreover you risk wasting valuable 0-days on targets that may not be worth it.
  - rdl 12y ago
    Plus, risk of alerting the target (which is why targeting hackers is unwise...) I wasn't arguing against encryption tools, just that serious attackers are plausible threats.
humannature 12y ago
You didn't even work at said company let alone interview there, so what makes you claim they can "hijack an iPhone remotely by only knowing a person's phone number"?
opendais 12y ago
To be fair, the stuff you are talking about is targeted malware. The odds of people being actively targeted rather than passively surveilled is orders of magnitude in difference. Everyone is being passively watched at some level, even if it is just for billing purposes. Defense is always about defense in depth. Always.
foobarqux 12y ago
Signal makes it much harder to tap your phone and makes mass surveillance extremely difficult, both of which are still important. But you're right that people need to be informed of the risks they still face.
chrismsnz 12y ago
Does this involve collusion with the telco? IIRC There's a fair amount of baseband-layer stuff that can be done with SMS from a trusted party.

sarciszewski 12y ago

Definitely a huge win for Apple consumers. :)

stevengg 12y ago

Moxie also made a sailing documentary that is good called hold fast http://vimeo.com/15351476 http://vimeo.com/15351476

frandroid 12y ago
OMG I knew the name sounded familiar. This doc is SO GOOD.
- scintill76 12y ago
  Funny that a HN member would know his name from that rather than his security work. I guess we're pretty diverse. :) I enjoyed that doc too.