ISIS Has a Smartphone App • Hacker News Board

Re: ISIS Has a Smartphone App

#21

Post by jacquesm » Sat, Jan 16, 2016, 9:17 PM UTC

wstrange wrote: post #5

Which I am sure the intelligence agencies are having a field day with. Nothing like rolling your own encryption. What are the chances it was created by one of the intelligence agencies?

I don't actually notice anything about them rolling their own encryption in the article (it doesn't even mention encryption other than that they use telegram to spread the link).

What are the chances if it is encrypted that they didn't actually roll their own encryption but used an open source implementation like PGP and made a wrapper around it? No reason to assume they're entirely dumb until the app has been dis-assembled and proven to be buggy (though I'd not make such a proof public, just let them continue to use it).

Re: ISIS Has a Smartphone App

#22

Post by [deleted] » Sat, Jan 16, 2016, 9:18 PM UTC

soheil wrote: post #18

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

I'd doubt users of an encryption app not using a simple checksum to verify its legitimacy before using it.

[deleted]

Re: ISIS Has a Smartphone App

#23

Post by pki » Sat, Jan 16, 2016, 9:19 PM UTC

throaway1853 wrote: post #15

Surely it can't be that hard to create a chat app with end to end encryption these days with all the open source libraries freely available for all kinds of applications...this is why I've always said banning encryption on major platforms like iOS/Android/Windows will get you nowhere when terrorists can just make their own encrypted chat apps if they really want to.

Sure, it's not hard, then you get into side channel, first-use-trust/update, MITM, etc territory.

Re: ISIS Has a Smartphone App

#24

Post by johansch » Sat, Jan 16, 2016, 9:21 PM UTC

I don't think anything good can come from the HN community publicly analyzing this.

Re: ISIS Has a Smartphone App

#25

Post by vonklaus » Sat, Jan 16, 2016, 9:22 PM UTC

golergka wrote: post #19

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

I am not pro survellience but, in my opinion, sort of surveiling terrorists using the official chat.ISIS distro is basically the narrow usecase where moderates find it acceptable.

Obviously, the problem is that it is not being used this narrowly and that the power to do a global sweep is a negatively skewed power imbalance.

That said, I wonder who Is going to fund the A round.

Re: ISIS Has a Smartphone App

#26

Post by krapp » Sat, Jan 16, 2016, 9:22 PM UTC

golergka wrote: post #19

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

I'm pretty sure subverting ISIS' crypto falls under the legitimate purview of state intelligence agencies - mass domestic surveillance and backdooring consumer hardware and software are different.

If these were drug dealers, though, and not terrorists, HN would be in an uproar.

Re: ISIS Has a Smartphone App

#27

Post by gkoberger » Sat, Jan 16, 2016, 9:22 PM UTC

golergka wrote: post #19

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

Nobody is against using technology against known foreign terrorists. We're against mass surveillance against our own people.

Re: ISIS Has a Smartphone App

#28

Post by jacquesgt » Sat, Jan 16, 2016, 9:22 PM UTC

golergka wrote: post #19

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

Not that I’m speaking for everyone on HN, but the problem is generally with wide-ranging surveillance of the entire populace in the hopes that they can data-mine their way to victory. Figuring out techniques like this to surveil actual terrorists and criminals based on probable cause is what the police and intelligence community should be doing.

Re: ISIS Has a Smartphone App

#29

Post by gnodar » Sat, Jan 16, 2016, 9:24 PM UTC

golergka wrote: post #19

AdmiralAsshat wrote: post #9

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of s…

But that's government surveillance, and HN comments are supposed to say that it's always bad and much worse than ISIS, right?

The app is developed, maintained, and used by a terrorist group where the primary purpose is to showcase terrorist activities and propaganda. There is a world of difference between monitoring citizens on tools primarily used for non-illegal purposes (though sometimes those tools are abused), and monitoring people using a tool with the explicit aim of displaying terrorist activities.

Re: ISIS Has a Smartphone App

#30

Post by totalkos » Sat, Jan 16, 2016, 9:26 PM UTC

Did I miss something? The article says the app can be downloaded via existing encrypted apps ... the app itself sounds like an RSS reader ... with the ground breaking feature of being able to adjust font size. Seriously???