Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evidence that the FBI can hack into private Signal messages on a locked iPhone

forbes.com

Post reply on HN
Print view View original

151–160 of 243 posts

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#151

Post by kgc »

banana_giraffe wrote: post #103
BugsJustFindMe wrote: post #62

Earlier quoted context omitted.

> As if you can create a secret communication channel that members of the public can join but the FBI is unable to infiltrate. Back in the day people used to, hilariously, have MOTD notices on all of their illegal servers saying the internet equivalent of "You have to tell me if you're a cop".

I first saw that on BBS's, and it made it's way onto some forums in the early days of the web. I always found it humorous what laws they'd cite, when they bother to, to say basically "By clicking this button you assert you're not law enforcement officer".

But nothing prevents a law enforcement officer from hiring someone who's already on the inside.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#152

Post by upofadown »

bluesign wrote: post #143
upofadown wrote: post #136

Signal uses a sqlite database with an encryption extension for any long term storage of data. The key to this database is kept in whatever the phone uses for key storage. So if you break the phone you get everything including the old messages. The moral is to not keep the old messages around and delete them after you are done with them and hope they actually end up deleted. This is a hard problem simply because of th…

Actually this is not correct, you can also use key which is destroyed on lock.

For instant messaging you need to be able to receive messages even when the phone is locked. So the key material can't be destroyed and must be left exposed.

You could encrypt old messages separately, but the result would end up being very inconvenient.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#153

Post by bluesign »

pseudo0 wrote: post #148
bluesign wrote: post #142

This seems to be problem with Signal to be honest. AFAIK you can always use more secure data protection classes for your database[0] They are using the default one, which is allowing AFU attack. [0] https://support.apple.com/en-ca/guide/security/secb010e978a/...

Would switching to say, Protected Unless Open have a negative performance impact? Otherwise, it seems like a kind of obvious oversight not to use a more restrictive data protection class. I'd be curious to know the Signal team's rationale for using PUFUA.

Actually i just checked their entitlements on github and it is set to NSFileProtectionComplete.

Seems stranger than I thought

edit: After diving into code, they are using NSFileProtectionCompleteUntilFirstUserAuthentication for their DB file, probably they have some reason

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#154

Post by bigiain »

tptacek wrote: post #94
ddtaylor wrote: post #37

Earlier quoted context omitted.

It's also worth noting that depending on their security clearance they can't go out and network or have public-facing profiles.

There are plenty of prominent people in software security that have IC backgrounds.

I’ll bet their prominence is fairly carefully vetted, and probably part of their job description rather than the more typical tech industry “personal brand building”.

But then that’s evidently true of Google (and FAANG in general) as well.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#155

Post by banana_giraffe »

kgc wrote: post #151
banana_giraffe wrote: post #103

Earlier quoted context omitted.

I first saw that on BBS's, and it made it's way onto some forums in the early days of the web. I always found it humorous what laws they'd cite, when they bother to, to say basically "By clicking this button you assert you're not law enforcement officer".

But nothing prevents a law enforcement officer from hiring someone who's already on the inside.

Some of these user agreements tried to cover that too ("you are not an officer, nor employed by one, nor have you ever been, nor will you ever be"). It was cute.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#156

Post by bigiain »

butwhywhyoh wrote: post #93
analognoise wrote: post #49

Earlier quoted context omitted.

You forgot a huge dimension of those jobs: As you get older, you are more valuable. No "silicon valley" syndrome about age: you'd never have to dye your hair, wear a hoodie to fit in, nobody will blink if you have to take a day off to take care of the kids. You can be a real adult - nobody comes into those programs and expects a ball pit or a foosball table, and nobody seriously thinks someone right out of college bu…

This is precisely my experience, and it's why I've been hesitant to leave this sector for so long. I could undoubtedly make more elsewhere, but the "badass" factor of what I'm working on would plummet significantly.

I feel this.

There have been many times the temptation of “badassery” has sorely pulled against my own moral/ethical stances. Lots of projects I’d have genuinely enjoyed working on, but which I’d have hated myself knowing all the ways the tech I’d have been building could be misused (and too often in the fullness of time, when developed by other people, was misused in exactly the obvious ways).

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#157

Post by banana_giraffe »

taneq wrote: post #146
Panino wrote: post #121

Earlier quoted context omitted.

Yeah it's a commonly held misconception spanning decades that cops must identify themselves if asked. I wonder where it originated. Needs some sunlight like: Badger: "Prove you're not a cop." ... Undercover cop: "If you ask a cop if he's a cop, he's like... obligated to tell you -- it's in the Constitution." - Breaking Bad, Season 2, Episode 8, moments before Badger gets arrested

I don’t think the server notices were based on this assumption. They were trying to use the draconian cyber security laws instituted after Mitnick and others got caught, which stipulated 10 years jail time for “unauthorised access to a computer system.”

The ones I saw, for the most part, predated Mitnick's arrest. Some by many years.

(Blah, I'm old)

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#158

Post by torwayburger »

beervirus wrote: post #33
torwayburger wrote: post #29

"..., stealing users from WhatsApp ..." Genuinely curious about this statement. Is it tantamount to theft if the user migrates by choice?

It's just a figure of speech.

Being a figure of speech has little to do with the statement being factually incorrect.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#159

Post by bigiain »

Jtsummers wrote: post #42
DC1350 wrote: post #40

Earlier quoted context omitted.

I know contractors are common but I don’t know if they’re paid a lot or if they can ignore the government employee pay scale.

Of course they can ignore the gov't employee pay scale. Contractors get paid variable amounts, depending on what they're working on and for whom. Many defense contractors (can't speak to the intel side of things) get paid 25-100% more than their GS counterparts, if they have an actual counterpart. Though that's not universal. Their pay is also not capped, like civilian pay is in the US federal government. EDIT: For f…

I would bet Palintir/NSO/Cellebrite (and many other equally capable but way less publicly known defence contractors) pay their top software engineering talent FAANG comparable rates.

They almost certainly also have just as many shittily paid employees that FAANG like to pretend they do not employ, offloading admin/janitorial/support staff to 3rd party “low caste” status employment.

I’d also guess BD and Sales roles at those companies pay at least as well as FAANG too. Commissions on defence contracts are worth a lot more than selling another bunch of SaaS seats to some promising VC backed startup...

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#160

Post by bigiain »

DC1350 wrote: post #51
jaywalk wrote: post #44

Earlier quoted context omitted.

Contractors are not government employees, so why would the government employee pay scale apply to them?

Everything I know about contractors and government work comes from Edward Snowden’s memoir where he was paid like garbage ($120k as a senior IIRC) to work as a contractor for the NSA. That’s why I thought it might matter. I’m sorry you don’t like my question

While I admire Snowden, I suspect his “senior role” was more like a Big4 consulting “senior” than a distinguished engineer at Microsoft or Amazon. It’s entirely possible he’d never have made it past a phone screen for a FAANG role.

I’m not sure $120k (in 2013) counts as “paid like garbage” for his role. What were SREs getting paid at Google back then? I get the feeling that was a reasonably close match for the role he had?

Post reply on HN