Earlier quoted context omitted.
No, that's not how it works. The GCM message is empty, it just wakes up your device which then fetches the actual message from the Signal servers.
You don't think Google could correlate the two? Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5. I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.
Moxie Marlinspike Makes Encryption for Everyone
91–100 of 144 posts
Re: Moxie Marlinspike Makes Encryption for Everyone
#92Moxie's been a huge inspiration for me in tech, i first discovered him through his blog post Career Advice: https://moxie.org/blog/career-advice/
I've read this blog post multiple times over the past few months and I wish I knew about it before I went to college. His career advice has so much clarity that I can't find elsewhere (so far). Thanks for sharing the link. I'm about to do a career switch and reading this again is certainly reassuring. He is right. We are what we do for a living. I find his work very inspirational and I hope I'll be able to personally…
Re: Moxie Marlinspike Makes Encryption for Everyone
#93- If someone from Facebook/Telegram/Signal/etc wants to know what you're writing, they can just instruct their app (via update) to send them your key. For closed-source services, you'd theoretically have to decompile and audit each update to make sure they are not doing that.
- If they want to know what you have written in the past, they can instruct the app to send them the conversation log.
- If Google (or Apple or Microsoft, respectively) want to know what you're writing, they can instruct the OS to send them the data. (Google's "Android Backup Service" for example also backs up "third party settings and data" [1]. I don't know about the details of the backup service, but this shows to me it's quite possible that your key or conversation logs might even land accidentally on some providers' servers without them having any bad intent.)
- If (three letter agency of your choice) wants to get the data, they can just force any of the above companies via NSLs to get it for them.
- If any of the US strategic partners want to get the data, they can likely make a deal with an intelligence agency.
- Lastly, if the messenger company wants to mine or sell user data, they still have a lot of stuff that cannot be encrypted for operational reasons (such as your contact list and the phone numbers of all your contacts).
That leaves to me the only group for which "overlay encryption" brings an actual benefit political activists in a country not at all affiliated with the US - or highly knowledgeable individuals who carefully control which updates they get. Both groups are important to consider but likely had ways to protect their communication before.
To actually protect communication not just from "the government" but also from the private industry, we would at least need some independent party to vet app updates.
Re: Moxie Marlinspike Makes Encryption for Everyone
#94To be honest, I don't understand what substantial benefit end-to-end encryption actually brings in an environment of (almost-)mandatory updates. - If someone from Facebook/Telegram/Signal/etc wants to know what you're writing, they can just instruct their app (via update) to send them your key. For closed-source services, you'd theoretically have to decompile and audit each update to make sure they are not doing that…
Re: Moxie Marlinspike Makes Encryption for Everyone
#95To be honest, I don't understand what substantial benefit end-to-end encryption actually brings in an environment of (almost-)mandatory updates. - If someone from Facebook/Telegram/Signal/etc wants to know what you're writing, they can just instruct their app (via update) to send them your key. For closed-source services, you'd theoretically have to decompile and audit each update to make sure they are not doing that…
This solves dragnet surveillance, where the government could potentially just sniff all communication and use various analytical techniques to sniff out potential criminals or people they dislike.
Re: Moxie Marlinspike Makes Encryption for Everyone
#96The idiom "everyone from X to Y" is supposed to demonstrate breadth of support, where X and Y are very different sources, but Snowden and Poitras are most certainly extremely similar sources.
Re: Moxie Marlinspike Makes Encryption for Everyone
#97Earlier quoted context omitted.
You don't think Google could correlate the two? Google knows device A got messages at times X, Y, and Z, and device B got messages at times X+1, Y+2, and Z+1.5. I'd be willing to bet with some statistical analysis over time, some pretty interesting data could be mined from that raw knowledge.
Why don't they know that anyways from basic traffic analysis?
Speculating that Google may have access to my full network profile is a little off-topic, but yeah, if they did have that data, they could certainly do similar analysis on it.
Did anyone say they couldn't?
Re: Moxie Marlinspike Makes Encryption for Everyone
#98Earlier quoted context omitted.
I think we're missing some information here. The supplied link says that the applications have been renamed due to legal threats. This seems completely reasonable to me. The names of the apps are trademarks and for a security product, who builds it is important to the integrity of the mark. I'm trying to remember how Android works, but I seem to recall that you need to sign the packages differently on Play and Fdroid…
> He decided not to. That's completely his right. He doesn't go into a lot of detail about why he has decided this, but it's completely up to him. He doesn't like how F-Droid uses centralized signing keys which are stored online: https://github.com/WhisperSystems/Signal-Android/issues/127#...
Re: Moxie Marlinspike Makes Encryption for Everyone
#99Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/
Re: Moxie Marlinspike Makes Encryption for Everyone
#100Not for people who don't want Google on their device. He only wants distribution via Google, and even went as far to demand that free/libre Play-alternative F-droid removed their build of TextSecure. See: https://fdroid.eutopia.cz/
This also blocks me from using TextSecure/Signal, because they require Google Play Services at run-time. I'm using a BlackBerry OS 10 device, which can run Android apps, and I even have Google Play running on it, but Google Play Services is stubbed for a large part on BB10, making some apps (such as Google Maps, Google Calendar, and Signal) impossible to use. Why a security/privacy oriented application such as signal…