cross-posted from : https://lemmy.zip/post/71321898
Netzpoltik details that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance
Interesting they highlight Signal again as though this is a vulnerability.
If someone else has access to a linked device… that’s you fucking up access controls.
I want a version of Signal that doesn’t allow linked devices. Linking devices is a clear vulnerability.
Im going to go out on a limb here and suggest something that should be obvious - you don’t have to link devices
But “Law enforcement” can do it by spoofing sms. I want one account, one device.
Signal does not use SMS.
The vulnerability they call out in the article is a phishing attack. A phishing attack requires the user’s input. There is no defense, no security, no techniques or technology to prevent you from handing the key to your safe to someone else.
It’s a vulnerability precisely because people always swarm to defend Signal in stories like this, as though using Signal means the authorities (or other bad actors) can’t read your messages. Seems like every six months there’s some story involving Signal users getting hacked, and every time there’s a rush of wellacshuallys explaining why it wasn’t really Signal’s fault. (that last one is particularly egregious because I remember people defending it as “it wasn’t Signal, it was their partner who they subcontracted and gave your personal data to”, which is crazy levels of mental gymnastics.)
Security is more than just encryption. If you flag something up as “hey use this if you want to hide from the Government” and have a personal phone number attached to it, that’s like a red rag to a bull.
(edit: LOL, it’s hilarious how many people think they’re making great rebuttals in the replies when all they’re doing is proving my point. One child even flew directly into screaming at me. Signal fanbois are even worse than Apple supporters)
as though using Signal means the authorities can’t read your messages.
Nobody who understands the topic thinks this.
Signal exists to prevent the contents from being read off the wire and from having the capability of compelling Signal’s parent company from turning over stored messages.
It doesn’t exist to hand hold you so you don’t get phished, or prevent you from running it on a vendor phone full of spyware. You’re responsible for making sure your hardware is secure and that you’re not socially engineered.
Nobody who understands the topic thinks this.
Yes, and articles like this are important so people who DON’T understand don’t think this.
You don’t think the tens of millions of people who use signal all understand that just because everyone says it’s super secure, doesn’t mean they can’t be hacked or phished, right?
They even inform you in the app about spying vectors like keyboard apps…
https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard
Yeah most people click through warnings like that lol
IT DOESN’T ADVERTISE ITSELF AS A SECURE PLATFORM!!!
It says PRIVACY. If you are dancing ass naked inside your house but you have your windows open… guess what?
A lot of these types use ‘perfect being the enemy of good’ as their attack vector. If it’s not private and anonymous why bother? If you can’t cut out all big tech companies, if you can’t stop buying any American goods, if you can’t feed all the poor or house all the homeless, etc. It’s an effective way to attack progression by making people believe they should just stop fighting, they’ll never win. You nailed it, Signal is private, it doesn’t claim to be anything else.
You just pointed something out there that I haven’t really considered. But its also the difference between abolitionists and reformists too- namely, abolition should be the goal, but don’t let that stop you from making reforms too.
deleted by creator
A rabid fan of a message application? Just for trying to point out that if the police get your unlocked phone then they have compromised your messages?
Why are you lying about what security guarantees Signal say they offer?
https://support.signal.org/hc/en-us/articles/9932632052378-How-to-protect-yourself-on-Signal
Even your example of the Twilio hack is far less relevant now since they added transparency logs, which means it is much harder to impersonate you without detection even if the hacker can control the telco
https://support.signal.org/hc/en-us/articles/10223569377562-Automatic-Key-Verification
deleted by creator
Signal failed to prevent soneone from accessing my unlocked phone and starting Signal! Everything was right there!
The headline makes people think signal is somehow broken.
It’s not. Just be careful and monitor your account. And don’t let anyone gain physical control of your device.
What’s described in the article is the same method Russia was using to compromise Ukrainian Signal accounts. It’s just phishing.
I think you’re the only person here so far who read the linked article.
I also found the netzpolitik article that was referenced but not linked to in the original article.
This describes police adding a linked device to a person’s WhatsApp account while gathering evidence (translated with Google Translate).
On January 12, 2020, Mr. and Mrs. P. were questioned. During the questioning, they voluntarily handed over the mobile phones they were carrying to the interviewing officers for a brief period so that messages from their daughter contained on the devices could be viewed and, among other things, photographed.
While the photographs were being taken, the computer-based application WhatsApp Web was covertly activated via a website made available online by the Federal Criminal Police Office (BKA), allowing the messages to be read on a BKA computer (sic!). This did not involve any intrusion via a Trojan horse or similar software.
The only link to Signal here is the nation state campaign which used social engineering via a phishing message from ‘Signal Support’.
This nation state campaign was originally reported by a researcher at Citizen Lab.
I did notice some comments that may be from people who did not read and understand the article. These attacks are not sophisticated or hard to defend against, which is probably why the German police want to limit public awareness.
I find their view shortsighted/narrow; the attacks they’re using (including SIM swapping) are also widely used by criminals for fraud and identity theft. Police agencies should not discourage the public from being more cybersecurity-aware.
The burglar broke in by knocking on the door and waiting for someone to come to the door and open it and then asking if they could come in and were let in and asked if they could just take stuff and the person said sure go nuts.
Almost. More like they asked to use the bathroom then unlatched the bathroom window, left, and returned later through that window when the homeowner wasn’t paying attention
To me, this proves that the police can still get the information they need without us handing over our encryption keys and requiring ‘service providers’ to MITM for them.
Except they had to get the keys, at least for Signal, as described in the article. Only you can allow a new device. If you get a notification for a new device and you go “sure, let me flash that code for you”, you’re giving the key. And a moron.
Can’t say about the other services.
Yeah, what I’m saying is that this proves there’s no need for chat control. Law enforcement can already get what they want by being sneaky.
There’s also no need for chat control because there is almost always enough information anyway, but the police doesn’t act on it. Their incompetency and lack of resources won’t be helped by adding even more information to sift through.
Yes, I agree. I’m saying that the article posted here provides actual evidence that they already have the tools they need, therefore…
for signal, that is still required. if you look, they used linked devices to get the messages
That’s not MITM done by the signal foundation.
I meant us handing over our encryption keys. ofc MITM does not work here
Seems like signal could send a notification 24 hours after any new device is added to remind the user that it was done. Make it so it has to be dismissed on each device so dismissing it on one doesn’t make it vanish on the rest.
doesn’t help if you’re in custody and your device is in a lab
Telegram and whatsapp never had encryption. Also - they just give your messages on law enforcement request, always have.
Signal - how does it work with signal again?
They are a bit vague on this but I suspect all of these attack vectors start with LEOs having physical access to the unlocked phone. They then set up a trusted desktop without the phone owners knowing.
Which is clever, to be fair. Whether or not that’s legal is already a court case. The law is so frightfully grey.
Its also a failure of the user’s access control and operating security.
Once a third party has access to the secure environment, that environment is and will always be compromised.
Is the user made aware of this by the operator (signal, telegram, et al)?
If not, it’s a big haul to get to competency. The operator should be educating users on how to limit compromise.
-
It NEVER advertises itself as such.
-
IIRC Signal DOES warn you about this, first when you make an account, and then when you try to save media files, and when you try to start a group chat. The others aren’t remotely secure anyway and I have no interest in attempting to defend them.
-
i just logged into signal on my desktop app about 4 hours ago, and about 90 minutes after that i got a message from signal to my phone to inform me about this.
What exactly did they tell you?
“hey, somebody logged into your signal account on desktop about an hour ago. might want to check that that was actually you”
Telegram has shitty 1-to-1 encryption but no group encryption.
WhatsApp claims to use the same encryption algorithms as Signal, but you can’t audit it.
WhatsApp uses signal protocol
But that does not prevent Meta from accessing your messages.
How?
WhatsApp is owned by meta
Signal protocol is end to end encrypted
Yes. How does that happen? You open the app you type a message you hit send. In that process WhatsApp has access to your clear text message that they get from the keyboard. They can do whatever they want with that. They could encrypt your message with your key and also one of their keys. They could send those together so that they look like one message but at their servers split their copy off.
Damn
Signal in this was clickbait they literally just say oh well if someone can link in their device they can see 45 days of message history
Is everyone here really whining about social engineering? It’s basic comp sec, weakest link are the people.
It goes above that.
or intercepting SMS messages via telephone surveillance.
Read the fucking article before commenting.
The article also mentions using linked device access. Clever. Fuck the police, though.
Heck the state
They reaaally want us to thibk Signal is equal to Whatsapp don’t they
you know what would solve this? simplex.
“Just get everyone in your life to move to ______ and that will solve all your problems”
A suggestion as old as time
it’s one of the most secure message apps available.
messages are signed, encrypted and passed through servers, never left on the server. unless you were the intended recipient you will not decrypt it.
it’s the truecrypt of instant messaging.
Signal does all that already
signal has a closed source server that can’t be audited.
https://github.com/signalapp/Signal-Server
That changed
what does it need a database for?
simplex is literally a message broker. no data remains on the server.
Signal doesn’t keep messages either. Do you know what they can serve FBI every time they ask? Nothing but number at first seen date. They don’t have your metadata.
Because sometimes, people are not online 24/7 and messages still need to reach them when possible.
Oh really? Simplex would block someone from accessing your phone and thus Simplex’ data?
give me a list of messaging apps that stop attacks that leverage physical access.
use a better os that has encryption and kill codes if that’s your concern.
