Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple Russia-aligned threat actors actively targeting Signal Messenger

cloud.google.com

Post reply on HN
Print view View original

311–320 of 329 posts

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#311

Post by tsunamifury »

mmooss wrote: post #132
tsunamifury wrote: post #69

Earlier quoted context omitted.

This is the glib over simplification he was complaining about with a haughty poorly informed statement We have never done it with an ally this critical of this size with this level of investment. Yes we have done it with smaller, less critical nations very often and it is of coruse atrocious. In fact Sadam, Bin Ladin, and others were all originally our allies that we betrayed. But we never did it against an aggressiv…

> Sadam, Bin Ladin, and others were all originally our allies that we betrayed. They were not allies, or not at all in the same sense. They were people the US did business with because of a common enemy, and then stopped doing business with when the situation changed. I don't think Saddam or Bin Laden thought for a moment that they were allies of the US, like Denmark and Japan are.

So you … agree? But are so set on disagreeing you frame it that way? Do you even listen to yourself?

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#312

Post by jzb »

inor0gu wrote: post #212
jzb wrote: post #112

Earlier quoted context omitted.

I wonder if Signal should expose linked devices directly in the UI at all times. Something like a small icon that indicates "You have 3 linked devices active" or similar.

Would probably lead to notification fatigue. Showing a big snackbar when a new device is added is probably enough, especially if the app can detect there was no "action" on your phone that triggered it. Key transparency, once rolled out, would help to ensure there is no lingering "bad" device around, but phishing will always be a problem.

"Would probably lead to notification fatigue."

Probably true...

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#313

Post by motorest »

MaxPock wrote: post #300
motorest wrote: post #175

Earlier quoted context omitted.

> I've always wondered if this is why there's far more published footage of Ukranian combat video than Russian. I'm sure Russia's meat wave tactics have more of a role. If you're sending your troops in suicide missions, including guys without weapons and even in crutches, you're not exactly too keen in having them carrying mobile phones to document the experience or even, heavens forbid, survive by surrendering.

This meatwave meme needs to die. Again ,if Ukrainians are being beaten by guy in crutches,it says so much about this NATO armed and trained force

> This meatwave meme needs to die.

Are you sure it's a meme, though? There is plenty of footage out there, documenting meat wave tactics in 4k. Have you been living under a rock?

> Again ,if Ukrainians are being beaten by guy in crutches (...)

What's your definition of "being beaten"? Three years into Russia's 3-day invasion of Ukraine and Ukraine started invading and occupying Russian territory. Is this your definition of being beaten?

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#314

Post by 542354234235 »

parhamn wrote: post #229
inor0gu wrote: post #224

Earlier quoted context omitted.

You will always have to root your trust in something, assuming you cannot control the entire pipeline from the sand that becomes the CPU silicone, through the OS and all the way to how packets are forwarded from you to the person on the other end. This makes that entire goal moot; eliminating trust thus seems impossible, you're just shifting around the things you're willing to trust, or hide them behind an abstractio…

> This makes that entire goal moot I agree. Perhaps it's why I find the discussions like nonce-lengths and randomness sources almost insane (in the sense of willfully missing the forrest from the trees). Intelligence agencies have managed to penetrate the most secretive and powerful organizations known to man. Why would one think Signal's supply chain is impervious? I'd assume the opposite.

But depending on your threat model, it can still be useful. If a state actor has a backdoor into something, would they burn that capability to get you? If you are a dissident in a totalitarian government, you would expect them to throw everything at you and not tell anyone how/why. If you are terrorizing and could be tried in a “classified” setting, you would expect them to throw everything at you. If you are Jane Average passing nudes and talking about doing a little Molly last weekend and would have a lawyer go through discovery, you are probably safe.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#315

Post by def_true_false »

paganel wrote: post #187

Alphabet is working in tandem with the Ukrainian SBU? Interesting choice, just as the US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago). I wonder how long the Alphabet higher-ups will allow this thing to unfold, or maybe they're not so good at reading the geopolitical tea leaves.

Why are you repeating Kremlin's talking points?

Using the exact same reasoning, Churchill would be a dictator, too.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#316

Post by Terr_ »

WesolyKubeczek wrote: post #213
andreygrehov wrote: post #97

They provided some domains, but not all of them are taken. For example, signal-protect[.]host is available, kropyva[.]site is available, signal-confirm[.]site is registered in Ukraine. Some of them are registered in Russia. Never trust a country at war—any side. Party A blames B, Party B blames A, but both have their own agenda.

I believe you are making a mistake by thinking that since a malicious actor's domain is registered in Ukraine, it automatically must be doing something in the interests of Ukraine, or at least be known to its officials. Lots of Russian state actors have no problems working from within Ukraine, alas. Add to this purely chaotic criminal actors who will go with the highest bidder, territories temporarily controlled by R…

> Lots of Russian state actors have no problems working from within Ukraine, alas.

Ex: Viktor Yanukovych, prior to being ousted.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#317

Post by mrtesthah »

8bithero wrote: post #20

So a few days ago Elon Musk blocked all links to Signal from the X platform and now this... Could be a coincidence but the timing sure is sus.

>So a few days ago Elon Musk blocked all links to Signal from the X platform and now this... Could be a coincidence but the timing sure is sus.

Not surprising considering Russian Oligarchs enabled Musk's takeover of Twitter:

https://www.dw.com/en/what-do-xs-alleged-ties-to-russian-oli...

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#318

Post by int_19h »

newsclues wrote: post #61
mmooss wrote: post #44

Earlier quoted context omitted.

Is this serious? It raises questions about smartphones being standard equipment for soldiers, but they do give every soldier an effective, powerful computing and communication platform (that they know without additional training). The question is how to secure them, including against the risk described in the parent. That seems like a high risk to me I would expect someone is working on how to secure them enough that…

Phones aren’t secure but are more secure than the standard radios most have access to. Encrypted milspec comms aren’t the standard in a massive war. It’s weird but discord, signal and some mapping apps on smartphones are how this war is being fought.

> Encrypted milspec comms aren’t the standard in a massive war.

It is standard in any modern military that is actually prepared for war. It's not like encrypted digital radio is some kind of fancy tech, either - it's readily available to civilians.

Ukraine in particular started working on a wholesale switch to encrypted Motorola radios shortly after the war began in 2014, and by now it's standard equipment across their forces. Russia, OTOH, started the war without a good solution, with patchwork of ad hoc solutions originating from enthusiasts in the units - e.g. https://en.wikipedia.org/wiki/Andrey_Morozov was a vocal proponent.

But smartphones are more than communications. You can also use them as artillery computers for firing solutions, for example. And while normally there would be a milspec solution for this purpose, those are usually designed with milspec artillery systems and munitions in mind, while both sides in this war are heavily reliant on stocks that are non-standard (to them) - Ukraine, obviously, with all the Western aid, but Russia also had to dig out a lot of old equipment that was not adequately handled. Apps are much easier to update for this purpose, so they're heavily used in practice (and, again, these are often grassroots developments, not something pushed top-down by brass).

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#319

Post by int_19h »

willy_k wrote: post #247
immibis wrote: post #245

Earlier quoted context omitted.

Musk calls everything he doesn't like "spam", so of course it was.

It’s still a social media platform, not every action taken is some nebulous part of Musks agenda. Odds are there was an influx of posts that qualify as spam from the signal.me domain that were marked by an automatic system as spam, because they were. Suggesting otherwise is baseless speculation.

Given that Musk has deliberately blocked links to whole other domains before for extremely petty reasons, I don't see why we should give him the benefit of the doubt.

Re: Multiple Russia-aligned threat actors actively targeting Signal Messenger

#320

Post by int_19h »

paganel wrote: post #187

Alphabet is working in tandem with the Ukrainian SBU? Interesting choice, just as the US President has called Zelensky a dictator (and for good reason, Poroshenko, the previous Ukrainian president, has basically said the same thing a few days ago). I wonder how long the Alphabet higher-ups will allow this thing to unfold, or maybe they're not so good at reading the geopolitical tea leaves.

They're calling Zelensky a dictator because his term was originally scheduled to end in 2024 unless re-elected, and there were no elections since the beginning of the war.

The problem with this assertion is that Ukraine has "no elections under martial law" written into the law. Zelensky himself actually wanted to do some kind of election to reinforce his mandate while his support was still very high, but there was serious concern from the liberals about those plans on the basis that any election held under martial law, with large numbers of people mobilized to fight, 20% of the country occupied, and many millions of refugees unable to vote, would hardly be free and fair. Their pushback scuttled any plans for the parliament to amend said law.

Post reply on HN