Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple Russia-aligned threat actors actively targeting Signal Messenger

cloud.google.com

Post reply on HN
Print view View original

271–280 of 329 posts

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#271

Post by vlovich123 »

inor0gu wrote: post #188
vlovich123 wrote: post #174

Earlier quoted context omitted.

It sounds like all that's needed is a device that had been linked in the past. Unlinking doesn't have the security requirements you'd think it would and there's a phishing attack to make scanning a QR code trigger a device link (which seems really really bad if the user doesn't even have to take much action)

Your phone (primary device) and the linked ones have to share the IK since that is the "root of trust" for you account: with that you generate new device keys, renew them and so on. Those keys are backed by Keystore on Android, and some similar system on Windows/Linux, i'd assume the same for MacOS/iOS (but I don't know the details) so it's not as simple as just having access to your laptop, they'd need at least root…

I think the point is that as a user you expect revocation of trust to protect you going forward, yet it doesn’t (e.g. the server shouldn’t be forwarding new messages to). That’s a design decision Signal made but clearly it’s one that leaves you open to harm. Moreover, it’s a dangerous decision because after obtaining the IK in some way (e.g. stolen device) you’re able to then essentially surreptitiously take over the account without the user ever knowing (i.e. no phishing needed). As an end user these are surprising design choices and that Signal discounted this as not part of their threat model to me suggest their threat model has an intentional or unintentional hole; second-hand devices that aren’t wiped are common & jail breaks exist.

This isn’t intractable either. You could imagine various protocols where having the IK is insufficient for receiving new messages going forward or impersonating sending messages. A simple one would be that each new device establishes a new key that the server recognizes as pertaining to that device and notifications are encrypted with a per-device key when sending to a device and require outbound messages to be similarly encrypted. There’s probably better schemes than this naive approach.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#272

Post by edgineer »

parhamn wrote: post #216

One thing I'm realizing more and more (I've been building an encrypted AI chat service which is powered by encrypted CRDTs) is that "E2E encryption" really requires the client to be built and verified by the end user. I mean end of the day you can put a one-line fetch/analytics-tracker/etc on the rendering side and everything your protocol claimed to do becomes useless. That even goes further to the OS that the rende…

I'll feel pessimistic like this, but then something like Tinfoil Chat [0] comes along and sparks my interest again. It's still all just theoretical to me, but at least I don't feel so bad about things.

With a little bit of hardware you could get a lot of assurance back: "Optical repeater inside the optocouplers of the data diode enforce direction of data transmission with the fundamental laws of physics."

[0] https://github.com/maqp/tfc

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#273

Post by paganel »

BLKNSLVR wrote: post #266
paganel wrote: post #187

Alphabet is working in tandem with the Ukrainian SBU? Interesting choice, just as the US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago). I wonder how long the Alphabet higher-ups will allow this thing to unfold, or maybe they're not so good at reading the geopolitical tea leaves.

> US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago) You can't be serious that you consider that to be a good enough reasoning. Zelensky's support / approval rating is well over 50% (according to polls). Zelensky defeated Poroshenko, getting 73% of the vote in the 2019 election.

> Zelensky defeated Poroshenko

And yet he still felt the need to start politically repressing Poroshenko with sanctions and branding him a traitor, that's the mark of having a dictator in command of things.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#274

Post by imp0cat »

tremon wrote: post #178
ycombinatrix wrote: post #26

Earlier quoted context omitted.

Not GP - I tolerate Whatsapp but I draw the line at SMS.

For me it's the other way around: I tolerate SMS but I draw the line at Whatsapp.

Sounds like someone who never had to pay for each SMS.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#276

Post by energy123 »

nomat wrote: post #258
FpUser wrote: post #240

Earlier quoted context omitted.

If Europe is what it claims to be: an enlightened democracy with progressive intelligent populace it can not be broken by demented crap messages from twitter. If however it is fucked up and on a brink of collapse then sure. Little nudge can steer it into "right" direction. but then who is guilty in a first place.

the idea that propaganda doesn't work is certainly an interesting one.

That's part of the propaganda. Please ignore the Internet Research Agency's massive army of troll farms and bots. Please ignore that they controlled half of the largest American Facebook groups catering to racial identity or religion. Nothing to see and no impact.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#277

Post by cuu508 »

KennyBlanken wrote: post #251
mmooss wrote: post #171

Earlier quoted context omitted.

> you should have to manually confirm with like "Yes I want to link to this device". And then if you thought you were scanning a group invite code you'd realize you weren't. (Yeah, you'd still have to realize that, but I think it's a meaningful step up over just "you scanned a code to join a group and instead it silently linked a different device".) Remember that Signal is designed for non-technical users. Many/most…

> Maybe Signal's documentation will tell you. Not the person you replied to, but I just tried googling half a dozen different terms and got results that have nothing to do with Signal. > Remember that Signal is designed for non-technical users. That does not prevent them from putting up a warning message that says "You just scanned a code which will allow another device to read all future messages sent to you, and se…

> That does not prevent them from putting up a warning message that says "You just scanned a code which will allow another device to read all future messages sent to you, and send messages from your identity. Are you sure you want to do that? And the button says "link devices", not "yes" or "no."

As an experiment, I just linked a device to my Signal account. After clicking "Link new device" in Signal, and then scanning the QR code, a dialog popped up: "Link this device? This device will be able to see your groups and contacts, access your chats, and send messages in your name. [Cancel] [Link new device]"

If I scan the QR code with Google Lens instead, it reads and displays the sgnl://linkdevice... URL but does not launch (or offer to launch) Signal.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#279

Post by wiseowise »

paganel wrote: post #273
BLKNSLVR wrote: post #266

Earlier quoted context omitted.

> US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago) You can't be serious that you consider that to be a good enough reasoning. Zelensky's support / approval rating is well over 50% (according to polls). Zelensky defeated Poroshenko, getting 73% of the vote in the 2019 election.

> Zelensky defeated Poroshenko And yet he still felt the need to start politically repressing Poroshenko with sanctions and branding him a traitor, that's the mark of having a dictator in command of things.

Maybe because Poroshenko is an oligarch and a piece of shit?
Post reply on HN