Decrypting the Signal App
cellebrite.com
Decrypting the Signal App
1–10 of 24 posts
Re: Decrypting the Signal App
#2They talk about Android, what about iOS?
Re: Decrypting the Signal App
#3It looks like they implemented a read only version of the App with worse UI, and scary used-by-criminals framing.
This is not newsworthy, there are normal tools that do similar things: https://github.com/xeals/signal-back
Ugh.
Re: Decrypting the Signal App
#4first sentence "Gang members and drug dealers have been quick to adopt ways to screen their communications. " .. im sure this article wont be biased by any means....
Re: Decrypting the Signal App
#5How do they get the key?
This sounded like just the process you’d use once you have the key, but getting the key is presumably the hardest part.
So, is Signal Secure?
Re: Decrypting the Signal App
#6If I'm reading this right (and I am only on my second coffee so it's possible I'm not) the whole decryption process relies on getting an initial decryption key out of the Android Keystore. They kind of gloss over they do that in the first place. Presumably the phone has already been compromised to enable access to the Keystore.
Re: Decrypting the Signal App
#7This immediately smells of marketing bullshit:
> Decrypting messages and attachments sent with Signal has been all but impossible…until now.
> We found that acquiring the key requires reading a value from the shared preferences file and decrypting it using a key called “AndroidSecretKey”, which is saved by an android feature called “Keystore”.
Yeah, if you have all the keys you can decrypt stuff..
This is dumb, pleas please do not upvote
Re: Decrypting the Signal App
#8[deleted]
Re: Decrypting the Signal App
#9What an odd article. The code showing how the database is encrypted on the device is obviously open source so it's not really a very interesting feat of detective work to... read the code and find out how it works. They could even have just copied the code.
The much more interesting question is how they might extract keys from the Android Keystore (where key material is very often stored in a Secure Element or similar), but they don't even mention that this might be quite challenging - the article just ignores the question.
Re: Decrypting the Signal App
#10How do they get the key? This sounded like just the process you’d use once you have the key, but getting the key is presumably the hardest part. So, is Signal Secure?
Secure vs what? Or whom? Or in what scenarios? Nothing on earth "is secure" =)