Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

61–70 of 226 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#61
post #17

Earlier quoted context omitted.

Matrix is not ready for non-technical people. Way too much stuff to consider as a user. It's similar to PGP a technology that will probably never go mainstream.

Is there? I'm definitely the kind of person who wants to set up my own server and bridges for it at some point, but when I tried Matrix for the first time last week I just created an account at matrix.org, installed a quite polished client and just started chatting.

Last time I tried matrix, and mind you that was over 3 years ago. Was with riot.im and trying to use the e2e encryption. The major surprise was not being able to suddenly decrypt older chat messages when OpenBSD changed the User-Agent string for Chromium which as I understand was used to establish the device identity. This is not something non-technical people can or want to diagnose.

Re: Grand jury subpoena for Signal user data, Central District of California

#62
post #55

Earlier quoted context omitted.

> Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. The clients are open source, presumably you can compile and install the client from source to avoid a bad update being pushed.

You cannot reproducibly build signal, what you get in the play store is effectively closed.

Source? This page says otherwise: https://github.com/signalapp/Signal-Android/tree/master/repr...

Re: Grand jury subpoena for Signal user data, Central District of California

#63

Earlier quoted context omitted.

Grand Juries are a really weird American thing†. The Grand Jury is entirely dependant on the prosecutor for guidance, so as an outsider it appears to me that their real purpose is to enable politically appointed prosecutors to pretend this anonymous "Grand jury" decided not to prosecute somebody when in reality what happened is that the prosecutor didn't want to. So now it's not the prosecutor's fault an obviously gu…

But trial by jury continues to be used in several countries (maybe in more restricted ways but it still a thing) or is there something special about a "Grand Jury"?

To add to the other comment a Grand Jury is also often made up of jurors called in using the prosecutor's private phone contacts. A few ex-cops and former work buddies. People also go to jail because of misuse of power by grand juries. There's a great documentary on Netflix but I can't remember its name right now. Suffice to say there aren't grand juries in any well working and fair justice system. It's abuse and/or theater 100% of the time.

Re: Grand jury subpoena for Signal user data, Central District of California

#64

Earlier quoted context omitted.

>Smartphones in their current form cannot have secure messaging. What about self-hosted matrix/element, used from the browser?

I think the parent poster wanted to highlight the auto update feature of phones.

it may be worth mentioning that every Sony phone still supported except for this year's models are officially supported by Sony for AOSP.

https://developer.sony.com/develop/open-devices/

furthermore Sony provides blobs to enable full feature sets of the cameras and even the 120Hz refresh options that Sony doesn't enable with stock firmware / Android. This gets you notch free real UHD (but not DCI) 4K 120HZ HDR screens and the same performance as a Galaxy S10 for ~$150 | XZ Premium / the XZ Premium 2 model adds a 12MP monochrome camera and wireless charging for a bit more... up to the first Xperia 1 models are supported including dual SIM SKUs. I'm seriously thinking of going back to either of these from the iPhone 11 Pro Max 512GB I'm typing this on, because the PDF reading experience (even in 2K standard resolution) of the Sony was a unique experience of being able to read full page papers set Euro A4 and 8pt and less text and no problems for my 6th decade eyes.

if you're in the UK, www.aaisp.net is a isp that hasn't reached the statutory customer base numbers to require keeping the extensive and extremely detailed records of communications UK laws require. The company is privately owned by a PhD and Reverend and the people recognise you by voice if you establish a relationship needing the contact. Andrews and Arnold they can fulfil our compliance with encrypted call recordings by email and ability to configure your landline numbering plan over cellular for PBX equivalence. (I dunno if it's helpful but if you do speak with Phil Boddy I think he'll be willing to confirm that John K isn't a commission agent only a impressed customer about to resurface with new business because there's nobody else short of starting your own MVNO..

Incidentally in Europe only Andorra has cellular operators who don't spill location metadata with every SMS.

this story involves Vodafone Greece deleting potentially vital call records evidence of a assassin of a minister : https://en.m.wikipedia.org/wiki/Greek_wiretapping_case_2004%...

I can't find it (on my phone) but the fuller story is that due to high licensing costs of traditional (not vRAN) basestation equipment features, common practice in Europe retains virtually no call records evidence / data and overwrites everything on cycles only long enough for billing.

if anyone is interested in the public spectrum of 5G applications and the acquisition of test sites in London, my lock down research got as far as only needing to be formalised and pursued. I have put much more interesting details in my profile concerning this because I am as serious as I'm probably crazy but at the lowest utility I'm trying to find London interest in getting quality time with some installed, legal, vRAN systems and possess the necessary means and certifiability.

what gets me about the Huawei affair is how much straightforward argument there is to drop this monoclonal monopoly supplier in preference for massively more flexible and capable equipment from a plethora of suppliers who need to be made to do bake offs again like we used to (I remember reading 3Com white papers proudly reporting successful bake offs and recognising that that company was going places..) I mean Joe Public understands the arguments that matter to common sense and national security simply follows with unavoidable obviousness. Microsoft and Huawei were the only phone manufacturers who provided user defeat switches to 2G and hence the stingray intercept vulns. Both also made surprisingly good hardware, or could do. I'm old enough to worry about reds under the bed but I think it is positively the most amazing thing how given today's sensitivity to ecological impact of industry waste that we cannot require the reuse of the tools and process equipment created for closed product lines. Of course I understand the tax write off and the trade secrets concerns. But the incredible cost of manufacturing today surely has to force us to deliver mothballed factories to people who have ability to use them. At the very least I would use my day to be dictator to enforce the auction of all such manufacturing facilities.

I just decided against cutting my diversion into factory and product design recycling because I think far too much of the irresponsible attitude towards security comes out of the assumption that everything is going to be forklift upgraded every 2 years. This is precisely what is happening with cellular networking. The very same thing is opening the door to China to try and drive through standards and protocols that suit China for 6G and next generation Internet. Samsung basically just ignore the existence of every phone after 2 years from launch. Not from the day you purchase your Samsung phone. From the product launch date you have 2 years of maybe possibly a few updates and patches. There is no way that anyone would have tolerated this 40 years ago. Why now? I'm concerned that there's a more serious systematic failure of the human cognitive capability.

Re: Grand jury subpoena for Signal user data, Central District of California

#65

OT and tinfoil hat on; there was a strange event last week with users of Signal on the Telia ISP.[1] For about 24 hours no messages could be sent, resulting in a 401 unauthorized error from the server side. Telia is the former state-owned Swedish ISP that is now only half state-owned I believe. They have a bad rep already for sending out extortion letters to torrent users and are almost assumed to be monitoring all u…

As one of the replies in that thread you linked explains, this is TLS encrypted traffic, so Telia can't really do anything to influence what happens here. They don't get to see what the traffic means, and if they change any of it then the connection aborts, which doesn't result in a 401 error it just hangs up abruptly - that's how TLS is designed to work.

It is entirely possible that somebody at Signal fat-fingered an IP address block, e.g. some kiddie is spewing 10Gb/s of traffic from 10.2/16 to Signal, but a Signal person blocks 10.20/16 [addresses example only] and only a week later when investigating "Why are we still eating 10Gb/s of spew?" do they realise they typo'd the number.

Re: Grand jury subpoena for Signal user data, Central District of California

#67

Earlier quoted context omitted.

The structure of grand juries makes it so that the defense is unable to mount a defense. The fact that grand juries often result in indictment has vanishing little relevance for whether or not it’s a fishing expedition. Further, no one is saying it is a fishing expedition. It’s a request for information that Signal isn’t designed to be able to answer. You’re also just speculating about the nature of the crime, but sa…

Grand Juries are a really weird American thing†. The Grand Jury is entirely dependant on the prosecutor for guidance, so as an outsider it appears to me that their real purpose is to enable politically appointed prosecutors to pretend this anonymous "Grand jury" decided not to prosecute somebody when in reality what happened is that the prosecutor didn't want to. So now it's not the prosecutor's fault an obviously gu…

Yeah, I’m an American and it feels that way to me. A perfect example is all the grand juries attempting to charge police officers who’ve killed someone. They usually don’t work, but when you hear from the jurors recently you find out the prosecutor sandbagged the whole thing.

Re: Grand jury subpoena for Signal user data, Central District of California

#68
post #27

Earlier quoted context omitted.

Even if it's decentralized there's only one client and they can always push updates to male it send keys/messages back for targeted users. Smartphones in their current form cannot have secure messaging.

Signal can stop you from using the service until you update, but they can't force you to update their app.

They could, but they evidently don't (stop you from using the service). I have a phone with a very old version of Android such that newer versions of Signal can't be installed. So it carries this really antiquated version of Signal, and, sure! some of the newer features (groups, some of the image handling) don't work. Still works just fine for the core purpose (voice, texts) though. As far as I'm concerned, kudos to Signal for maintaining full backward compatibility as far as is reasonable.

Re: Grand jury subpoena for Signal user data, Central District of California

#69

Earlier quoted context omitted.

WebRTC (still) requires a centralized server in order to setup the connection (via STUN/TURN), so if so, Signal could be forced to turn over any logging they have of those setup requests.

You can use existing decentralized systems, e.g. bittorrent DHT or IPFS DHT, to handle signaling and not require a centralized server. STUN is only needed to retrieve the public IP, which you may not need to use (and didn't have to be centralized). In some heavily NATd cases, you'd need a TURN proxy, but not often.

Both of those DHTs are using centralized signalling servers to first be able to establish any P2P connections. Maybe there has been some recent invention in DHTs, but AFAIK, 100% P2P discovery is still not "there" (meaning "accessible, fast, not using too much resources and can find other peers")

Re: Grand jury subpoena for Signal user data, Central District of California

#70
post #66

"Upon information and belief, these servers are physically located in Virginia." Such strange and probably necessary legal language...

"AWS told us the servers are in Virginia, but don't quote me on that. Might be Virginia, Queensland, for all I know."
Post reply on HN