If anyone is actually surprised by this....? You do not own your device. No root = not your phone.
British intelligence able to read and flag private Snapchat messages
111–120 of 125 posts
Re: British intelligence able to read and flag private Snapchat messages
#112Most intelligence orgs from most companies can read messages on any app if they comprimise your phone through existing backdoors
Re: British intelligence able to read and flag private Snapchat messages
#113The MOD encourages their personnel to use Snapchat, and blocks WhatsApp (on their internal networks). What more do you need to know?
Interesting, I'd like to know more. What makes you say that?
Re: British intelligence able to read and flag private Snapchat messages
#114I don't know much about hashing but is it possible five eyes just has a zettabyte-scale rainbow table covering scary words? They could use that to score encrypted messages and act on the scary ones.
A more serious problem with the story is if they had any kind of advanced (or magical) brute force or mathematical path against some standard encryption scheme - they would not waste that major secret on some random 18yo joker.
(Although in the background, fuckups are always possible and they did send a fighter jet initially so there was some pressure to follow through. Still not enough to risk a major secret.)
Re: British intelligence able to read and flag private Snapchat messages
#115This is why even if you aren't doing anything wrong, you should always use E2E encrypted communication.
Not really, no. The real issue here is not that private chats were surveilled. The issue that caused grief is the idiotic reaction to an innocent joke made among friends, and then trying to make the victim pay for that mistake.
Re: British intelligence able to read and flag private Snapchat messages
#116Earlier quoted context omitted.
Nah the best you could do for a long while was just to have n^2 bilateral encryption sessions that behave like a group channel. Only fairly recently was a workable construction for doing many-party encryption sessions actually developed, called TreeKEM, and is now standardized in the IETF MLS standard. This is literally bleeding edge cryptography. It's an extremely flexible design and has relatively few constraints i…
> Nah the best you could do for a long while was just to have n^2 bilateral encryption sessions that behave like a group channel. What? We could do better than that before we had group chats. PGP will let you send encrypted email to multiple recipients, and multiple simultaneous bilateral encryption sessions are not involved. The system is: 1. You encrypt the message using a symmetric encryption key. 2. You encrypt t…
PGP is poorly suited for live conversations with rotating members like this since it doesn't support post-compromise security or perfect forward secrecy (not in-protocol, at least), which most people would expect from an E2EE chat protocol. I was speaking of protocols that did have these properties.
TreeKEM also manages sublinear communication, constant per message (since there's a shared secret already used for the ratchet) and logn for key updates or group membership changes.
Re: British intelligence able to read and flag private Snapchat messages
#117Earlier quoted context omitted.
Nah the best you could do for a long while was just to have n^2 bilateral encryption sessions that behave like a group channel. Only fairly recently was a workable construction for doing many-party encryption sessions actually developed, called TreeKEM, and is now standardized in the IETF MLS standard. This is literally bleeding edge cryptography. It's an extremely flexible design and has relatively few constraints i…
When talking about recent, you're talking about 6 years ago right?
Has it been 6 years already? I must be getting old.
Re: British intelligence able to read and flag private Snapchat messages
#118Earlier quoted context omitted.
> Nah the best you could do for a long while was just to have n^2 bilateral encryption sessions that behave like a group channel. What? We could do better than that before we had group chats. PGP will let you send encrypted email to multiple recipients, and multiple simultaneous bilateral encryption sessions are not involved. The system is: 1. You encrypt the message using a symmetric encryption key. 2. You encrypt t…
PGP is poorly suited for live conversations with rotating members like this since it doesn't support post-compromise security or perfect forward secrecy (not in-protocol, at least), which most people would expect from an E2EE chat protocol. I was speaking of protocols that did have these properties. TreeKEM also manages sublinear communication, constant per message (since there's a shared secret already used for the…
The concept of encryption is poorly suited for live conversations with rotating members. If you don't know who you're talking to, there's no point in encrypting your message.
> I was speaking of protocols that did have these properties.
The method PGP uses to encrypt messages to multiple recipients will still work for whatever protocol you have in mind. Why is your dislike for PGP relevant?
Re: British intelligence able to read and flag private Snapchat messages
#119The guy us lucky he got the sane judge. It could have easily gone very badly for him.
Re: British intelligence able to read and flag private Snapchat messages
#120Earlier quoted context omitted.
PGP is poorly suited for live conversations with rotating members like this since it doesn't support post-compromise security or perfect forward secrecy (not in-protocol, at least), which most people would expect from an E2EE chat protocol. I was speaking of protocols that did have these properties. TreeKEM also manages sublinear communication, constant per message (since there's a shared secret already used for the…
The concept of encryption is poorly suited for live conversations with rotating members. If you don't know who you're talking to, there's no point in encrypting your message. > I was speaking of protocols that did have these properties. The method PGP uses to encrypt messages to multiple recipients will still work for whatever protocol you have in mind. Why is your dislike for PGP relevant?
That's pretty reductive, perhaps you don't have a fully connected graph of relationships in a group but other parties you do know in a group you trust to vouch for others. There's also lots of data privacy/security compliance reasons you'd want to have E2EE with large groups. I believe I heard that some larger companies wanted to investigate using MLS to encrypt internal communications, and having hundreds/thousands of people in a group where most don't know each other but they're all managed by an authority who doesn't want to be able to know what they're discussing.
I don't dislike PGP I'm just saying that it doesn't natively have PFS and PCS, which are generally accepted by security people as being necessary properties for a protocol to be considered full E2EE.