Live data from Hacker News

Evidence that the FBI can hack into private Signal messages on a locked iPhone

forbes.com

211–220 of 243 posts

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#211
post #190

If you own the phone, the messages are decrypted. This seems to be more about the phone access than anything to do with Signal, right?

Seems like this is partially Signal's fault to me. Why doesn't Signal independently encrypt the message db when not in use? It's well known at this point that iPhone is easily cracked, and thus Signal provides no security for a stolen phone. Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778

> Why doesn't Signal independently encrypt the message db when not in use?

To what end?

If there's no additional authentication required to open the app and just view the messages normally, it's useless because they can just open the app and view the messages.

If they use their existing PINs as key material then, given an OS-level exploit grants access to the underlying database, it can be cracked offline in... basically no time at all.

If they allow you to create a long, secure password for opening the app, basically nobody uses it because nobody wants to type a 30 character password on a phone touchscreen every time they want to check/send a message.

Pretty much any solution that doesn't absolutely destroy usability still relies on the OS performing some sort of authentication first. (As in the current solution where the encryption keys are stored in the OS-level key store.)

If you're that concerned about your security, just go disable FaceID/TouchID so the iPhone never leaves keys in memory when it's locked.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#212

Earlier quoted context omitted.

The iPhone's terrible battery life isn't a bug, it's a privacy feature! I wonder if the FBI's evidence protocol involves immediately plugging in an iPhone to maintain the vulnerable state: > That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that is locked but that has been unlocked once and not turned off. An iPhone in this state is more susceptible to having da…

Do people still think iPhones have bad battery life? Mine lasts for days.

Thet probably have the contact tracing feature enabled - that thing eats through the battery pretty quickly.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#213

Earlier quoted context omitted.

Fun fact for the UK: "UK police have a new tactic to circumvent strong iPhone encryption: steal the unlocked phone out of the criminal’s hand" ( https://9to5mac.com/2016/12/05/uk-police-have-a-new-tactic-f... ) I remember reading this a few years back. The title says it all. Why bother cracking codes etc when you can get a judge to sign THAT for you? :) Going through the PDF of the legal document, on page 10, the scr…

This is pretty much how Scott Albrecht of Silk Road was caught. The police caused a distraction the grabbed his unlocked laptop while he was at a cafe. Of course, maybe bringing an unlocked laptop with details of your drug empire to a cafe wasn’t the best opsec out there.

Ross Ulbricht, it was at a public library, and it was a darknet marketplace not a drug empire but they sure did make an example out of him. Free Ross.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#214

Earlier quoted context omitted.

Is there an audit trail showing that the compiled binary available in the App store is the same one you build from source?

Sadly, no. There’s still some “trust” required in both Whispersystems to not backdoor updates, as well as Apple and Google to not backdoor the distributed apps after Whispersystems submit updates for publication. There is though, some ability for skilled enough people to “trust but verify” by reversing the app bundles after publication. I believe (but not for any good evidence based reason) that there are “enough eye…

You are able to compile from source though...

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#215
post #185

Earlier quoted context omitted.

> hold down the power button and a volume button for a second On android phones, it takes a screenshot.

Just checked + updated my comment. iOS also takes a screenshot when the phone is unlocked if you use power + volume up. Holding power + volume down hard locks the phone even when its unlocked

This puts android on mute. I guess place your non-registered finger on the phone multiple times for Android?

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#216

Earlier quoted context omitted.

> Q communities on Facebook and Twitter made it easy to see where these people were coming from. Cynical view. Those made it easy to see what the manipulated fairly public mass of disenfranchised or disgruntled or actively evil Q/Trump supporters were discussing and planning. I’ll bet people like flexcuff guy and pipebomb guy weren’t discussing _their_ plans in such public forums. And I’ll bet there was a _lot_ of pl…

> I’ll bet people like flexcuff guy and pipebomb guy weren’t discussing _their_ plans in such public forums. I dunno, some of those folks were pretty brazen. Remember they thought all this was, if not "legal" exactly, "sanctioned" by their sitting president. They weren't trying to hide. But even if we grant that the premise (which is clearly true) that serious criminals will always have the ability to hide from surve…

> And mob violence requires a mob

And this is exactly what I mean by

>>> As if you can create a secret communication channel that members of the public can join but the FBI is unable to infiltrate.

A mob needs to radicalize people and recruit. If you are recruiting and not on the FBI's watch-list I'm going to blame the FBI, especially since you are actively radicalizing people. Any insurrection or major plot will require recruitment of people which it is difficult to vet. This (should) makes for a trivial ability to infiltrate. If it doesn't I'm really disappointed in the Three Letter Agencies as they clearly make themselves out to be more than woefully incompetent. We're spending all that money and people can't click a link? I'm pretty confident they can accomplish this.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#217
post #7

How is it possible that the FBI has so much advanced stuff when I’ve never met a skilled developer willing to work for what the government pays? Are their tools developed by high paid contractors?

For some people, gov. agencies provide the following:

1. job security.

2. ideology.

3. attractive retirement plans.

4. interesting domain / things to work on.

If you have a burning passion for catching bad guys, then you go working for the people that are catching bad buys. Pretty simple.

Sure - the tech can (and probably will) be abused against regular folks, but for some people it's worth the price if it means busting another pedophile/human trafficking/terrorist/etc. ring.

It's a bit like asking why some doctors dedicate their professional lives to humanitarian work, when they could make 10x more as a GP in some cushy suburb. For some, ideology and mission counts A LOT.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#218

Earlier quoted context omitted.

You forgot a huge dimension of those jobs: As you get older, you are more valuable. No "silicon valley" syndrome about age: you'd never have to dye your hair, wear a hoodie to fit in, nobody will blink if you have to take a day off to take care of the kids. You can be a real adult - nobody comes into those programs and expects a ball pit or a foosball table, and nobody seriously thinks someone right out of college bu…

As someone who has spent many years working in defense / government contracting, I think you're touching on a really big reason a lot of people work in this world. Many years ago, when my career first started, I was an idealist who thought the way I could give back (as someone who couldn't get into the military for physical reasons) was to work in the defense sector. I also tried very hard to get interviewed by an SV…

Oh same on the interviewing with tech companies remotely. After you've built things that are really badass, it's REALLY hard to be upset about a rejection, and the interviews can be really fun problems, so it's just fun.

It's more about the impression they get from you in five or six 45-minute slots. It's just a numbers game if you're getting that far, so just keep at it right? Take notes, improve, watch some Coursera courses, do some silly coding exercises - basically what we all do for fun anyway.

Glad you could find work on social issues though; I know what you mean about the cynicism, but I think I've gotten around that - I realized it came on with bad programs with lots of waste or highly political teams/programs, so I just avoid those. It was a long road to get there though... :)

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#219

Earlier quoted context omitted.

I know you're bring downvoted into oblivion for reverse ageism, but my experience mirrors your statements. I think the aggrieved HN masses just don't have similar, or much experience.

It's kind of bitterly ironic that on this site that comment is considered more inflammatory than someone like the top level commenter who effectively just says "lol only stupid people work for the government."

Thanks for pointing that out and expressing it well, I appreciate it.

Re: Evidence that the FBI can hack into private Signal messages on a locked iPhone

#220

Earlier quoted context omitted.

This is precisely my experience, and it's why I've been hesitant to leave this sector for so long. I could undoubtedly make more elsewhere, but the "badass" factor of what I'm working on would plummet significantly.

I feel this. There have been many times the temptation of “badassery” has sorely pulled against my own moral/ethical stances. Lots of projects I’d have genuinely enjoyed working on, but which I’d have hated myself knowing all the ways the tech I’d have been building could be misused (and too often in the fullness of time, when developed by other people, was misused in exactly the obvious ways).

There is no way to have zero impact - even the act of doing nothing can be interpreted as acceptance or even support of what's happening around you.

There's no way to only have a positive impact as well - there are always side effects.

In HN terms, life isn't functionally pure.

Post reply on HN