Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code from the FBI’s Anom encrypted messaging app

vice.com

Post reply on HN
Print view View original

11–20 of 107 posts

Re: Code from the FBI’s Anom encrypted messaging app

#11

Post by nr2x »

xoa wrote: post #7
sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

> We already know Apple has preserved a backdoor in the end-to-end cryptography of iMessage at the FBI's behest, as reported by Reuters. WhatsApp has always had the same backdoor (unencrypted backups to cloud services). The largest services are all unsafe for privacy. I don't agree with your characterization of that as a "backdoor" and I think that dilutes the term dangerously. There is no need to use Apple's backup…

As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice, especially since the FBI is the reason that they did this.

Let’s not even talk about Chinese users, as apparently Apple bending over to store all their data in CCP data centers doesn’t count.

Re: Code from the FBI’s Anom encrypted messaging app

#12

Post by jeroenhd »

mavhc wrote: post #6
drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

Matrix treats all chats as chatrooms, even 2 people chats. This is promoted as a simplification, but maybe it's a security problem. If a protocol only allows 2 people to chat, harder to exfiltrate the messages

Encrypted chats need device/key verification/permission before the receiver can see any message contents.

Even if Matrix were to limit chats by protocol, a malicious sysadmin could probably fake a cross-signed device if they had access to the client like this. I don't think this is actually a problem, a chat room is as good a representation as anything.

Re: Code from the FBI’s Anom encrypted messaging app

#13

Post by GranPC »

gavinray wrote: post #8

The decompiler they used to view that code is not very good, that output is garbled. If you're going to take apart JVM bytecode, you're better off using Recafe or Quiltflower. https://github.com/Col-E/Recaf https://github.com/QuiltMC/quiltflower

The reason the output is "garbled" is because it was obfuscated with ProGuard - there's no real way around that except for manually renaming variables and classes.

Any idea whether any of these two decompilers work with Dalvik bytecode?

Re: Code from the FBI’s Anom encrypted messaging app

#14

Post by slickdork »

jeffbee wrote: post #10
sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

> What other services might be run, controlled, or surveilled by the US investigative authorities? Any service that is marketed to you as privacy- or security-as-a-service, or software sold as privacy- or security-enhancing, is virtually guaranteed to be secretly working against the interests of its users. You can't buy security or privacy in the form of software or services, because privacy and security are a set of…

I don't follow your logic here. Why can't a company legitimately focus on a niche sub set of users who value privacy in their products? I'm thinking of products like protonmail, standard notes, and signal.

Re: Code from the FBI’s Anom encrypted messaging app

#15

Post by jliptzin »

So what's the strategy moving forward? The operation clearly hasn't permanently solved crime, the next generation of organized crime bosses won't trust any apps to handle their secrets, so I guess their communication just moves offline again? Or maybe each develops their own methods in house that they know they can trust (such as shooting holes in a wall on call of duty)?

Re: Code from the FBI’s Anom encrypted messaging app

#16

Post by bee_rider »

sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

I'm not super informed on this topic, but I was under the impression that all the chat apps were somewhere between malevolent and incompetent, except possibly Signal.

Re: Code from the FBI’s Anom encrypted messaging app

#17

Post by jeffbee »

slickdork wrote: post #14
jeffbee wrote: post #10

Earlier quoted context omitted.

> What other services might be run, controlled, or surveilled by the US investigative authorities? Any service that is marketed to you as privacy- or security-as-a-service, or software sold as privacy- or security-enhancing, is virtually guaranteed to be secretly working against the interests of its users. You can't buy security or privacy in the form of software or services, because privacy and security are a set of…

I don't follow your logic here. Why can't a company legitimately focus on a niche sub set of users who value privacy in their products? I'm thinking of products like protonmail, standard notes, and signal.

Yeah ... i mean ... everyone who uses protonmail non-ironically is a dupe. It is virtually certain that it is a front for state intelligence agencies.

Re: Code from the FBI’s Anom encrypted messaging app

#18

Post by rasz »

sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

https://www.cryptomuseum.com/crypto/philips/px1000/index.htm

"Initially the device offered strong DES encryption, but this was replaced in 1984 by an NSA-supplied alternative algorithm."

"The NSA bought 12,000 DES-based PX-1000 units, along with 50 PXP-40 printers and 20,000 ROMs that had already been produced, for the total sum of NLG 16.6 million (EUR 7.5 million)."

Re: Code from the FBI’s Anom encrypted messaging app

#19

Post by slickdork »

jeffbee wrote: post #17
slickdork wrote: post #14

Earlier quoted context omitted.

I don't follow your logic here. Why can't a company legitimately focus on a niche sub set of users who value privacy in their products? I'm thinking of products like protonmail, standard notes, and signal.

Yeah ... i mean ... everyone who uses protonmail non-ironically is a dupe. It is virtually certain that it is a front for state intelligence agencies.

I'm not sure why it is 'virtually certain'. It seems very likely to me that a company, which takes payments as a funding model, could exist with end 2 end and be a legitimate business.

Do you have any source at all to back a claim like that?

Post reply on HN