Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TeleMessage, used by Trump officials, can access plaintext chat logs

micahflee.com

Post reply on HN
Print view View original

11–20 of 92 posts

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#11

Post by proactivesvcs »

XorNot wrote: post #9
proactivesvcs wrote: post #5

I'd find it useful if I could access my Signal chat logs in plaintext. The software offers no facility to do this on any platform, and on Desktop the programs that have allowed me to take proper backups are (by necessity) a moving target because of changes to the database, so I am constantly having to get around to updating them and occasionally even that's a pain.

It'd also be useful if backups on Android actually streamed somewhere off the phone so they could be meaningfully appended to, kept. Or handled per channel (i.e. my baby pictures channel with family).

...and if the restore process wasn't so fragile. The only time I needed to backup and restore it just crashed part-way through, so the backup process wasn't even doing any validation.

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#13

Post by hedora »

proactivesvcs wrote: post #11
XorNot wrote: post #9

Earlier quoted context omitted.

It'd also be useful if backups on Android actually streamed somewhere off the phone so they could be meaningfully appended to, kept. Or handled per channel (i.e. my baby pictures channel with family).

...and if the restore process wasn't so fragile. The only time I needed to backup and restore it just crashed part-way through, so the backup process wasn't even doing any validation.

The lack of encrypted (and cross platform) backups is the biggest security hole I know of in Signal.

People inevitably end up working around it, which can mean using SMS, copying the threads / screenshots / attachments to arbitrary other storage, or switching to things like TeleMessage because of record keeping requirements.

I wish Signal were less hostile towards forks. I'd happily switch to a client that uses their network, but that's compatible with iCloud backup.

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#14

Post by Aurornis »

tptacek wrote: post #10

Isn't that the point?

No, the point is for the government to have access the plaintext after it is securely delivered to an approved archive location, not TeleMessage having access on AWS-hosted servers exposed to the public internet.

TeleMessage pitched their service as using end-to-end encryption of the message into the corporate archive.

> End-to-End encryption from the mobile phone through to the corporate archive

Apparently the plaintext messages were going to a TeleMessage server on AWS (not an approved government archive location) that was publicly accessible. Naturally it was hacked.

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#16

Post by hedora »

tptacek wrote: post #10

Isn't that the point?

Presumably, in the spectrum of secure network protocols, something exists between "delete the message before it can leave this machine" and "send this message to a cloud provider and have them email it in plain text to another cloud provider".

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#17

Post by [deleted] »

proactivesvcs wrote: post #5

I'd find it useful if I could access my Signal chat logs in plaintext. The software offers no facility to do this on any platform, and on Desktop the programs that have allowed me to take proper backups are (by necessity) a moving target because of changes to the database, so I am constantly having to get around to updating them and occasionally even that's a pain.

[deleted]

Re: TeleMessage, used by Trump officials, can access plaintext chat logs

#19

Post by pvg »

hedora wrote: post #16
tptacek wrote: post #10

Isn't that the point?

Presumably, in the spectrum of secure network protocols, something exists between "delete the message before it can leave this machine" and "send this message to a cloud provider and have them email it in plain text to another cloud provider".

If you're sending plaintext out of an ostensible e2ee system, it's not an e2ee system. You have an 'end' that's not, you know, end-to-end.
Post reply on HN