Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grand jury subpoena for Signal user data, Central District of California

signal.org

Post reply on HN
Print view View original

31–40 of 618 posts

Re: Grand jury subpoena for Signal user data, Central District of California

#31

Post by sdcooke »

akouri wrote: post #22

What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...

I don't know how Signal works but it is possible to send a silent encrypted push notification that the app can decrypt and show as a local notification.

Re: Grand jury subpoena for Signal user data, Central District of California

#32

Post by 14 »

Last I checked signal still required a phone number to use so it is an instant deal breaker for a lot of people. I have 3 kids I communicate with but they don’t have a cell number just use wifi when they can. If I could use signal with them I would. Instead I use Wire since it seems secure and doesn’t require a phone number. I can only imagine there are lots of other people with kids in my situation.

Re: Grand jury subpoena for Signal user data, Central District of California

#33

Post by the8472 »

toomuchtodo wrote: post #5
colemannugent wrote: post #2

The latest installment in the "Government doesn't understand math" series

I think that’s uncharitable. Everyone is going through the motions required of them, and this is the public demonstration of those mechanizations (although Signal is a bit cheeky, which is fun). The next step would be government requiring, through legislation, more invasive logging and data collection (Australia and parts of Europe have already seen the beginnings of this discussion) of messaging apps (“we’ve asked f…

> When encryption and secure messaging is outlawed, only outlaws will have and use it.

They don't necessarily need to outlaw it. They may just throw up enough hurdles that it doesn't become a major success. Developing a communication system that is secure, featureful and convenient to use for the general population is not a trivial task. A large effort that can be undermined.

E.g. if they only require logging from communication service providers but not from application developers then this would force a decentralized solution. If they lean on payment providers it might get difficult to charge for phone apps or get donations.

The software could continue to legally exist but see little adoption. Which is enough to enable surveillance.

Re: Grand jury subpoena for Signal user data, Central District of California

#34

Post by sulam »

akouri wrote: post #22

What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...

Are you sure they use APNS? They could simply use app notifications.

Re: Grand jury subpoena for Signal user data, Central District of California

#35

Post by NdMAND »

akouri wrote: post #22

What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...

I believe they are encrypted (and decrypted on device by the Signal app). They recently had to do some rewriting of the code for iOS15 - they share some comments about that here: https://community.signalusers.org/t/beta-feedback-for-the-up... Hope it helps

Edit: wow people were fast to reply…

Re: Grand jury subpoena for Signal user data, Central District of California

#36

Post by MrKristopher »

akouri wrote: post #30
camhart wrote: post #25

Earlier quoted context omitted.

I'm guessing here, but wouldn't they just push the e2ee message through APNS? Then decrypt client side. Or does Apple require plaintext messages for push notifications (that seems bad if they do)?

When you craft a push notification server-side, it contains the payload in plaintext. Now, that is probably encrypted in Apple-land, but my point is that the gov't probably has sunk its teeth into Apple already. So, yea signal's encryption may be open source and proven, but I doubt Apple's doesn't have a backdoor.

Not sure if Signal is doing this, but they could send a notification with title "New message" and encrypted payload. The payload can be processed by a client-side notification extension which decrypts the payload and chooses what notification text the user will see.

Re: Grand jury subpoena for Signal user data, Central District of California

#37

Post by flipbrad »

otterley wrote: post #29
upofadown wrote: post #13

>Because everything in Signal is end-to-end encrypted by default, the broad set of personal information that is typically easy to retrieve in other apps simply doesn’t exist on Signal’s servers. The E2EE in Signal only protects the actual content of messages. In the case where Signal takes an assertive action, and the users are not paying any attention to their "safety numbers" (probably the most common case) they co…

A judge can sign an order commanding a witness or party to preserve documentation and evidence, under penalty of contempt of court. However, there is still a great deal of uncertainty as to what actions the subject of the subpoena must take in order to preserve that evidence. It's pretty clear that you have to disable automated destruction mechanisms, you can't disable any recording functions you may already have, an…

Sadly, not an open question in the UK.

Re: Grand jury subpoena for Signal user data, Central District of California

#38

Post by drifkin »

akouri wrote: post #22

What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...

You can send an invisible push notification that tells an iOS app to wake up in the background and check for updates: https://developer.apple.com/documentation/usernotifications/...

Re: Grand jury subpoena for Signal user data, Central District of California

#39

Post by ylk »

akouri wrote: post #30
camhart wrote: post #25

Earlier quoted context omitted.

I'm guessing here, but wouldn't they just push the e2ee message through APNS? Then decrypt client side. Or does Apple require plaintext messages for push notifications (that seems bad if they do)?

When you craft a push notification server-side, it contains the payload in plaintext. Now, that is probably encrypted in Apple-land, but my point is that the gov't probably has sunk its teeth into Apple already. So, yea signal's encryption may be open source and proven, but I doubt Apple's doesn't have a backdoor.

I mean Apple themselves is telling devs to not send sensitive data in the actual notification

> [...] never include sensitive data or data that can be retrieved by other means in your payload. Instead, use notifications to alert the user to new information or as a signal that your app has data waiting for it.

https://developer.apple.com/library/archive/documentation/Ne...

Re: Grand jury subpoena for Signal user data, Central District of California

#40

Post by jerryluc »

akouri wrote: post #22

What I don't understand about the whole Signal E2EE model is that while your messages themselves may be encrypted, they are still sending push notifications over Apple's servers, which have to go through APNS. Often the entire message contents can be contained in the push notification. Does anybody know if Apple's notifications are E2EE? I doubt that gov't doesn't have access to the push notifications...

I was wondering about the same thing. I think that signal just sends a message to APNS (and Google’s equivalent) that you have something to look at like a new message or whatever. That makes the app wake up and goes to signals servers for the actual content and the app creates the actual notifications on your device.
Post reply on HN