Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple Russia-aligned threat actors actively targeting Signal Messenger

cloud.google.com

Post reply on HN
Print view View original

181–190 of 329 posts

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#181

Post by tremon »

noAnswer wrote: post #100
subjectsigma wrote: post #71

Earlier quoted context omitted.

My Signal experience: ex gf in college asks what app I’m using to text. Tell her it’s Signal, E2EE, messages are only stored on her phone and nobody else can read them. She says cool and downloads the app. Four months later her phone breaks. “Hey subjectsigma I got my new phone today. Where are all my messages?” “… Do you have your old phone? That’s the only place they are.” “No? Last time I got a new phone WhatsApp…

It only works for WhatsApp if you have Backup to Google activated[1]. I once tried to work with backuped files from my old phone and it didn't work. (Older tutorials indicated that it once worked, though.) [1] There was a time WhatsApp had a nag-screen if you hadn't Backup to Google activated. So I guess most people would have eventually caved.

That nag-screen is still there, it pops up roughly every three months for me (though not on my primary phone, Whatsapp won't get anywhere near that one).

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#182

Post by h4ck_th3_pl4n3t »

autoexec wrote: post #172
h4ck_th3_pl4n3t wrote: post #106

Earlier quoted context omitted.

I wanted to add that there is the cease and desist case against Signal-FOSS fork that tried to implement an open server, too. In my opinion Briar is where it's at, but because there's no data collection it's pain to do a handshake or manage contacts.

Signal-FOSS is still around right? Got a link to some of the drama? I'm curious to see what their grounds were. Did they just object to the use of their name?

There is still Molly as a fork, but no idea how hardened it actually is.

After Moxie's statement at the time I kind of ditched everything regarding Signal's ecosystem. I understand the business perspective of it, but it's kind of pointless trying to say this is open source when it's illegal to press the Fork button on GitHub, you know.

https://github.com/mollyim/mollyim-android

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#185

Post by warkdarrior »

burningChrome wrote: post #177
chinathrow wrote: post #141

Earlier quoted context omitted.

Trump and his voters.

[dead]

Nobody labeled Trump voters as "redneck, white nationalists" in this thread. The claim was that Trump and his voters are "Russia-aligned", which is obvious at least for Trump and his immediate admin appointees.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#186

Post by orblivion »

nightpool wrote: post #164
orblivion wrote: post #135

Earlier quoted context omitted.

Maybe via metadata? The size of the information, etc. Do you mean that they should have a caveat about that? Or if you want to be literal, you have to say that they're storing sensitive information even if it's encrypted. But by connotation that phrase implies that someone other than the user could conceivably have access to it. So for all any user could care, they just as well are not storing it. Do you mean that th…

Yes, I think they should rephrase it so that it's literally correct. Personally, I have a very high trust in the safety of Signal's encryption and security practices. But privacy policies aren't for the Signals of the world, they're for the ad networks and sketchy providers. For example, many ad networks collect "Safely Encrypted" email addresses—but still are able to use that information to connect your Google searc…

Okay that's fair. But as I said to autoexec, if your point includes that you don't rely on the encryption to be safe, you should probably include that in your point. A lot of people probably don't share that as a prior. (I suspect that's why autoexec was downvoted and flagged).

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#187

Post by paganel »

Alphabet is working in tandem with the Ukrainian SBU? Interesting choice, just as the US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago). I wonder how long the Alphabet higher-ups will allow this thing to unfold, or maybe they're not so good at reading the geopolitical tea leaves.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#188

Post by inor0gu »

vlovich123 wrote: post #174
diputsmonro wrote: post #101

Earlier quoted context omitted.

If I'm reading that right, the attack assumes the attacker has (among other things) a private key (IK) stored only on the user's device, and the user's password. Thus, engaging on this attack would seem to require hardware access to one of the victims' devices (or some other backdoor), in which case you've already lost. Correct me if I'm wrong, but that doesn't seem particularly dangerous to me? As always, security o…

It sounds like all that's needed is a device that had been linked in the past. Unlinking doesn't have the security requirements you'd think it would and there's a phishing attack to make scanning a QR code trigger a device link (which seems really really bad if the user doesn't even have to take much action)

Your phone (primary device) and the linked ones have to share the IK since that is the "root of trust" for you account: with that you generate new device keys, renew them and so on.

Those keys are backed by Keystore on Android, and some similar system on Windows/Linux, i'd assume the same for MacOS/iOS (but I don't know the details) so it's not as simple as just having access to your laptop, they'd need at least root.

Phishing is always tricky, probably impossible to counter sadly - each one of us would be susceptible at the wrong moment.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#190

Post by [deleted] »

diputsmonro wrote: post #101
vetrom wrote: post #40

Signal (and basically any app) with a linked devices workflow has been risky for awhile now. I touched on this last year ( https://news.ycombinator.com/context?id=40303736 ) when Telegram was trash talking Signal -- and its implementation of linked devices has been problematic for a long time: https://eprint.iacr.org/2021/626.pdf . I'm only surprised it took this long for an in-the-wild attack to appear in open liter…

If I'm reading that right, the attack assumes the attacker has (among other things) a private key (IK) stored only on the user's device, and the user's password. Thus, engaging on this attack would seem to require hardware access to one of the victims' devices (or some other backdoor), in which case you've already lost. Correct me if I'm wrong, but that doesn't seem particularly dangerous to me? As always, security o…

[deleted]
Post reply on HN