Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple Russia-aligned threat actors actively targeting Signal Messenger

cloud.google.com

Post reply on HN
Print view View original

221–230 of 329 posts

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#221

Post by andreygrehov »

WesolyKubeczek wrote: post #213
andreygrehov wrote: post #97

They provided some domains, but not all of them are taken. For example, signal-protect[.]host is available, kropyva[.]site is available, signal-confirm[.]site is registered in Ukraine. Some of them are registered in Russia. Never trust a country at war—any side. Party A blames B, Party B blames A, but both have their own agenda.

I believe you are making a mistake by thinking that since a malicious actor's domain is registered in Ukraine, it automatically must be doing something in the interests of Ukraine, or at least be known to its officials. Lots of Russian state actors have no problems working from within Ukraine, alas. Add to this purely chaotic criminal actors who will go with the highest bidder, territories temporarily controlled by R…

Fair point. Just because a domain is registered in Ukraine doesn't mean it's acting in Ukraine's interests. But that works both ways. If Russian actors can operate from Ukraine, then Ukrainian actors (or others) can also operate from Russia, or at least make it look that way. Cyber attacks originating from Ukraine and targeting Russia aren't uncommon either, which only adds to the complexity of attribution.

The issue isn't just attribution but also affiliation. When similar attacks come from Ukraine targeting Russia, Google stays quiet. I understand that Russia invaded Ukraine, not the other way around, but given the complexity of the conflict, aligning with one side in cyber warfare reporting is a questionable move. At the end of the day, attacks will come from both sides - it's a war, after all.

Edit: when I say 'questionable move', I'm specifically referring to Google. It's unclear what they were trying to achieve with this article, is it a political statement or just a marketing piece showcasing how good GTIG is? Or both?

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#222

Post by root_axis »

DFHippie wrote: post #161
heyloolma wrote: post #77

Earlier quoted context omitted.

It’s not bad. It just IS. the only people that think it is bad are people who have a different opinion and feel attacked for whatever reason. I find it telling when people accuse others of virtue signaling because it is almost always someone who is jealous or insecure attacking said signaler.

"Virtue signaling" in theory means "talking the talk without walking the walk", but it's generally thrown out by people who make no effort to assess whether the person criticized is walking the walk or even in contradiction of such evidence. Driving an economically efficient car -- choosing any sort of car -- has enormous consequences on one's life, for example. Choosing to by a particular car isn't a decision made l…

> "Virtue signaling" in theory means "talking the talk without walking the walk"

Virtue signaling means sending deliberate signals about your virtues, whether you "walk the walk" or not. People are often critiqued for going to uncomfortable lengths to signal their virtues, but something as simple as a "meat is murder" shirt or a MAGA hat is also virtue signaling.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#223

Post by jisnsm »

accrual wrote: post #129
tumsfestival wrote: post #111

Earlier quoted context omitted.

Good luck with that depending on where you live.

And when you live. The 20s-30s year old crowd I interact with seems to avoid, if not mock FB. I recognize it has its uses and benefits, though.

They mock fb whilst they use instagram and WhatsApp.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#224

Post by inor0gu »

parhamn wrote: post #216

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rende…

You will always have to root your trust in something, assuming you cannot control the entire pipeline from the sand that becomes the CPU silicone, through the OS and all the way to how packets are forwarded from you to the person on the other end.

This makes that entire goal moot; eliminating trust thus seems impossible, you're just shifting around the things you're willing to trust, or hide them behind an abstraction.

I think what will become more important is to have enough mechanisms to be able to categorically prove if an entity you trust to a certain extent is acting maliciously, and hold them accountable. If economic incentives are not enough to trust a "big guy", what remains is to give all the "little guys" a good enough loudspeaker to point distrust.

A few examples: - certificate transparency logs so your traffic is not MitM'ed - reproducible builds so the binary you get matches the public open source code you expect it does (regardless of its quality) - key transparency, so when you chat with someone on WhatsApp/Signal/iMessage you actually get the public keys you expect and not the NSA's

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#225

Post by SheinhardtWigCo »

parhamn wrote: post #216

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rende…

It’s primarily to guard against insider threats - E2E makes it very hard for one Signal employee to obtain everyone’s chat transcripts.

Anyone whose threat model includes well-resourced actors (like governments) should indeed be building their communications software from source in a trustworthy build environment. But then of course you still have to trust the hardware.

tl;dr: E2E prevents some types of attacks, and makes some others more expensive; but if a government is after you, you’re still toast.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#226

Post by UltraSane »

vetrom wrote: post #155
diputsmonro wrote: post #101

Earlier quoted context omitted.

If I'm reading that right, the attack assumes the attacker has (among other things) a private key (IK) stored only on the user's device, and the user's password. Thus, engaging on this attack would seem to require hardware access to one of the victims' devices (or some other backdoor), in which case you've already lost. Correct me if I'm wrong, but that doesn't seem particularly dangerous to me? As always, security o…

No, it means that if you approve a device to link, and you later have reason to unlink the device, you can't establish absolutely that the unlinked device can no longer access messages, or decrypt messages involving an account, breaking the forward-secrecy guarantees. That leaves you with the only remedy for a signal account that has accepted a link to a 'bad device' being to burn the whole account. (maybe rotating s…

That is really quite bad.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#227

Post by moffkalast »

josh2600 wrote: post #151

There are many voices which try to tell you that signal is compromised. Notice that all of those voices have less open-source-ness than Signal in virtually all cases. Signal is doing its best to be a web scale company and also defend human rights. Individual dignity matters. This is not a simple conversation.

> web scale

I didn't realize anyone still used that term with a straight face.

"MongoDB is web scale, you turn it on and it scales right up."

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#228

Post by parhamn »

SheinhardtWigCo wrote: post #225
parhamn wrote: post #216

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rende…

It’s primarily to guard against insider threats - E2E makes it very hard for one Signal employee to obtain everyone’s chat transcripts. Anyone whose threat model includes well-resourced actors (like governments) should indeed be building their communications software from source in a trustworthy build environment. But then of course you still have to trust the hardware. tl;dr: E2E prevents some types of attacks, and…

> tl;dr: E2E prevents some types of attacks, and makes some others more expensive; but if a government is after you, you’re still toast.

This is sorta my point, lots of DC folks use Signal under the assumption they're protected from government snooping. Sometimes I feel like it could well have the opposite effect (via the selection bias of Signal users).

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#229

Post by parhamn »

inor0gu wrote: post #224
parhamn wrote: post #216

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rende…

You will always have to root your trust in something, assuming you cannot control the entire pipeline from the sand that becomes the CPU silicone, through the OS and all the way to how packets are forwarded from you to the person on the other end. This makes that entire goal moot; eliminating trust thus seems impossible, you're just shifting around the things you're willing to trust, or hide them behind an abstractio…

> This makes that entire goal moot

I agree. Perhaps it's why I find the discussions like nonce-lengths and randomness sources almost insane (in the sense of willfully missing the forrest from the trees). Intelligence agencies have managed to penetrate the most secretive and powerful organizations known to man. Why would one think Signal's supply chain is impervious? I'd assume the opposite.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#230

Post by inetknght »

inor0gu wrote: post #212
jzb wrote: post #112

Earlier quoted context omitted.

I wonder if Signal should expose linked devices directly in the UI at all times. Something like a small icon that indicates "You have 3 linked devices active" or similar.

Would probably lead to notification fatigue. Showing a big snackbar when a new device is added is probably enough, especially if the app can detect there was no "action" on your phone that triggered it. Key transparency, once rolled out, would help to ensure there is no lingering "bad" device around, but phishing will always be a problem.

> Showing a big snackbar when

A big... what?

Can you tell me what this new lingo is for someone who doesn't use the latest and shittiest marketing lingo?

Post reply on HN