Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former Twitter employee convicted of charges related to spying for Saudis

politpost.com

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Former Twitter employee convicted of charges related to spying for Saudis

#31

Post by sneak »

zip1234 wrote: post #23
sneak wrote: post #17

Earlier quoted context omitted.

Apple has access to the plaintext of pretty much every iMessage and the vast, vast majority of iOS users' photo libraries. They are required to turn over data to the US federal authorities without a warrant (under FAA702), and they do this over 30,000 times per year per their own transparency report. The mind reels. Can you imagine how much this is used for blackmail, extortion, coercion, parallel construction, etc?

Is iMessage not end to end encrypted? Facebook Messenger has end to end encryption. How does Apple not?

iMessage's "end to end encryption" has a key escrow backdoor which sends your endpoint keys to Apple and is maintained for the FBI. It's more like "end-to-end-and-Apple encrypted".

It's "end to end encrypted" but then the device's private iMessage syncing keys ("Messages in iCloud") are included in an iCloud Backup, which is not end-to-end encrypted, backdooring the crypto. This means that Apple can decrypt the iMessages as they transit Apple's servers in realtime, using the device private keys you backed up (without e2e) the previous evening.

Even if you turn off the non-e2e iCloud Backup backdoor, your iMessages will still get compromised because it's on by default and all of the other people you iMessage with haven't turned it off.

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

iCloud Photos isn't end to end encrypted at all. It syncs every photo you take to Apple servers effectively unencrypted. Apple can see all of them, and so can the US government (without a warrant). Turning off iCloud is indeed an effective mitigation for this, which keeps your photos on-device.

Re: Former Twitter employee convicted of charges related to spying for Saudis

#32

Post by mrtksn »

323 wrote: post #30
mrtksn wrote: post #29

Earlier quoted context omitted.

Will the cops really come and arrest people on the spot for breaching internal company data access protocols? I’m curious about it if the authorities act on it as an urgent situation.

By cops I meant FBI/... And the way this is done is you notify the cops first and then coordinate with them if needed. It's not like Twitter learned about this 5 minutes before.

Okay, so does it really happen?

To me it sounds like it’s a civil case where domain specialists need to prove the wrongdoing in court.

Re: Former Twitter employee convicted of charges related to spying for Saudis

#33

Post by TaylorAlexander »

nradov wrote: post #27
TaylorAlexander wrote: post #3

Someone I know had been working for twitter and they said they were blown away at the lack of internal protections built in to the system. I guess it could be a goldmine of data for spies.

Not to defend the incompetent jerks who run Twitter or anything, but only a complete idiot would have ever trusted them with private or damaging information (including metadata such as locations). Twitter never made any reliable, verifiable guarantees about security or internal controls.

What I have found, as a technical person, is that things like metadata which are obvious to me may be unknown to most regular people. A person can be very smart and yet not know about how computers work, or how silicon valley works.

Re: Former Twitter employee convicted of charges related to spying for Saudis

#34

Post by octoberfranklin »

TaylorAlexander wrote: post #3

Someone I know had been working for twitter and they said they were blown away at the lack of internal protections built in to the system. I guess it could be a goldmine of data for spies.

> it could be a goldmine of data for spies.

Wait until you hear about cell site location data...

Re: Former Twitter employee convicted of charges related to spying for Saudis

#35

Post by twoodfin »

mrtksn wrote: post #32
323 wrote: post #30

Earlier quoted context omitted.

By cops I meant FBI/... And the way this is done is you notify the cops first and then coordinate with them if needed. It's not like Twitter learned about this 5 minutes before.

Okay, so does it really happen? To me it sounds like it’s a civil case where domain specialists need to prove the wrongdoing in court.

It is absolutely the case that employers can and do involve Federal law enforcement when they believe an employee has committed a Federal crime.

Re: Former Twitter employee convicted of charges related to spying for Saudis

#36

Post by shakil »

mrtksn wrote: post #29
323 wrote: post #16

2020: How Saudi Arabia Infiltrated Twitter > When the conversation concluded, management seized Alzabarah’s laptop, put him on administrative leave, and escorted him out of the building. > At 5:17 p.m. he called a handler, identified as Associate-1 in the FBI complaint, who arrived in a white SUV two hours later. Driving around Alzabarah’s neighborhood, the two men called “Foreign Official-l” — al-Asaker, according t…

Will the cops really come and arrest people on the spot for breaching internal company data access protocols? I’m curious about it if the authorities act on it as an urgent situation.

Depends on who is doing the complaining, but yes there is precedent to arresting an employee for "theft of trade secrets" [1]

1. https://en.wikipedia.org/wiki/Sergey_Aleynikov

Re: Former Twitter employee convicted of charges related to spying for Saudis

#37

Post by m00x »

nradov wrote: post #27
TaylorAlexander wrote: post #3

Someone I know had been working for twitter and they said they were blown away at the lack of internal protections built in to the system. I guess it could be a goldmine of data for spies.

Not to defend the incompetent jerks who run Twitter or anything, but only a complete idiot would have ever trusted them with private or damaging information (including metadata such as locations). Twitter never made any reliable, verifiable guarantees about security or internal controls.

It's not a matter of Twitter giving guarantees about optional data. This is PII, which has to be protected legally.

Internal controls at a company of the size of Twitter is no longer optional. You don't have to intend malice to be guilty of negligence.

Equifax never gave guarantees of security and data safety either, but it's understood that they should be responsible.

Re: Former Twitter employee convicted of charges related to spying for Saudis

#38

Post by techdragon »

ChrisMarshallNY wrote: post #20
josh2600 wrote: post #12

Earlier quoted context omitted.

For a long time many social networks were just any employee god mode. Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact.

> Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact. That's why the app that I'm writing now, started off as seriously tinfoil. In fact, I've had to [reluctantly] loosen some of the armor, in order to add a few features. I won't say that it's Fort Knox, but it ain't gonna be easy to crack. The demographics of its target user base are pretty paranoid, so I h…

Is there somewhere we can learn more about the app?

Re: Former Twitter employee convicted of charges related to spying for Saudis

#39

Post by ChrisMarshallNY »

techdragon wrote: post #38
ChrisMarshallNY wrote: post #20

Earlier quoted context omitted.

> Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact. That's why the app that I'm writing now, started off as seriously tinfoil. In fact, I've had to [reluctantly] loosen some of the armor, in order to add a few features. I won't say that it's Fort Knox, but it ain't gonna be easy to crack. The demographics of its target user base are pretty paranoid, so I h…

Is there somewhere we can learn more about the app?

I am not at liberty to disclose the app, itself, but it uses many of my open-source contributions.

The backend is a modified version of my BAOBAB server[0], which was actually a "learning" project, for me, but it works quite nicely.

This is the Security document[1] for the generic BAOBAB server. The customization was to add support for a specific workflow that is designed for the app, itself, and the customization is proprietary, as is the source for the iOS app.

This is the dependency manifest of the iOS app:

    // MARK: -
    // MARK: - DO NOT TRANSLATE BELOW THIS LINE -
    // MARK: -
    "SLUG-VERSION-BMLT"                             =   "BMLTiOSLib: 1.5.3";
    "SLUG-VERSION-KEYCHAINSWIFT"                    =   "KeychainSwift: 20.0.0";
    "SLUG-VERSION-LGVCLEANTIME"                     =   "LGV_Cleantime: 1.3.5";
    "SLUG-VERSION-UICLEANTIME"                      =   "LGV_UICleantime: 1.1.1";
    "SLUG-VERSION-AUTOFILL"                         =   "RVS_AutofillTextField: 1.3.0";
    "SLUG-VERSION-GCD"                              =   "RVS_BasicGCDTimer: 1.5.0";
    "SLUG-VERSION-CHECKBOX"                         =   "RVS_Checkbox: 1.2.1";
    "SLUG-VERSION-OBSERVER"                         =   "RVS_GeneralObserver 1.1.0";
    "SLUG-VERSION-GST"                              =   "RVS_Generic_Swift_Toolbox: 1.10.1";
    "SLUG-VERSION-MB"                               =   "RVS_MaskButton: 1.2.0";
    "SLUG-VERSION-PP"                               =   "RVS_Persistent_Prefs: 1.3.2";
    "SLUG-VERSION-UKT"                              =   "RVS_UIKit_Toolbox: 1.3.2";
    "SLUG-VERSION-WHITEDRAGON"                      =   "White Dragon SDK: 3.2.2";
It's from my Settings bundle localization file, so the syntax is strange. These are all open-source. I did not write KeychainSwift, but I wrote everything else (I have control issues. I don't like using code that other people wrote, unless it's really good, absolutely necessary, and is something I completely trust). They should be easy to find on GitHub. They are all SPM modules.

The app, itself, is fairly large, at over 30 screens (it was a lot more, but I'm doing the "Thoreau" treatment -Simplify, simplify, simplify- to it). I have been working on it for over a year and a half.

[0] https://riftvalleysoftware.com/work/open-source-projects/#ba...

[1] https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf (Downloads a PDF).

Re: Former Twitter employee convicted of charges related to spying for Saudis

#40

Post by cmeacham98 »

shakil wrote: post #36
mrtksn wrote: post #29

Earlier quoted context omitted.

Will the cops really come and arrest people on the spot for breaching internal company data access protocols? I’m curious about it if the authorities act on it as an urgent situation.

Depends on who is doing the complaining, but yes there is precedent to arresting an employee for "theft of trade secrets" [1] 1. https://en.wikipedia.org/wiki/Sergey_Aleynikov

Was this page written by his lawyer? It seems like he downloaded source code from his employer and gave it to some other company.

It seems like he largely got off on what is effectively a technicality, but I doubt anyone would seriously argue what he did _should_ be legal.

Post reply on HN