Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical analysis of the Signal clone used by Trump officials

micahflee.com

Post reply on HN
Print view View original

361–370 of 387 posts

Re: Technical analysis of the Signal clone used by Trump officials

#361

Post by gopher_space »

Tabular-Iceberg wrote: post #304
gopher_space wrote: post #258

Earlier quoted context omitted.

Their take on scripture is deliberately anachronistic. We didn’t have the medicine or sanitation 2000 years ago to place their kind of value on a fetus.

The medicine in question comes from the very scientific establishment that grew out of scholasticism, which is why I find the accusation of anti-intellectualism rather strange. My point is that you have to distinguish between arguing against the output of the intellectual activity and arguing against the intellectual activity taking place.

The medicine that I said didn't exist back then? I think you misread my comment.

Re: Technical analysis of the Signal clone used by Trump officials

#362

Post by jay_kyburz »

zelon88 wrote: post #295

Is this feigned incompetence. Perhaps a cry for help, or a calculated disclosure? I can't imagine anyone who would make the mistakes this guy makes, yet here he is; freely using his computer in clear view of a reporter with a camera.

Its just what it appears. Occam's razor

Re: Technical analysis of the Signal clone used by Trump officials

#363

Post by twobitshifter »

taejo wrote: post #358
twobitshifter wrote: post #351

Earlier quoted context omitted.

I can’t read that full article, but are you saying the chats go e2e encrypted into signal and then come out non e2e when transmitting to the archive? That seems like an unlikely design for even an amateur. Why wouldn’t you just add something like an archive bot that sits in signal chats and sees everything e2e?

It seems TM SGNL also works when you're messaging with somebody using the genuine Signal app. They aren't gonna make a group chat with your archive bot to message you, and they might not be pleased when you add them to such a group chat.

Maybe but if that’s their opinion, I don’t think they’d be pleased to know that you are archiving their chats in any case. I guess it would depend on who the user base is.

Re: Technical analysis of the Signal clone used by Trump officials

#364

Post by mmooss »

palata wrote: post #320
mmooss wrote: post #302

Earlier quoted context omitted.

> Your recipient could get out a camera and take a photograph if that's what it comes to. You are making the perfect the enemy of the good. As I said, two comments up: "I suppose I must trust other users - they could always screenshot a conversation. But while I trust them not to intentionally cheat me, I shouldn't have to trust them to accurately evaluate the security implementation of a software application - somet…

> You are making the perfect the enemy of the good. They merely said: "Disappearing messages has never been a security guarantee of Signal". Signal guarantees end-to-end encryption in transit. They don't guarantee anything that happens on the phones , because they can't. They try to help where they can, e.g. with disappearing messages. But that is a convenience tool, not a security guarantee by Signal.

We agree; you just seem to want to argue with a strawperson.

My point is that they could help a lot more by verifying the clients.

> Signal guarantees end-to-end encryption in transit.

They can't guarantee that unofficial clients do E2EE. For example, what if the client sent messages in a way that leaked information, including contact information of the users?

> But that is a convenience tool

It's a security tool, it's just not guaranteed.

Re: Technical analysis of the Signal clone used by Trump officials

#365

Post by mmooss »

goupillon wrote: post #303
mmooss wrote: post #293

Earlier quoted context omitted.

Why not require keys signed with Signal's private key?

If the keys are generated on the device, they can't be trusted by Signal since any clone could generate them too. If the keys are generated by Signal and sent to the device, they can be intercepted and used in any clone

Thanks. Signal could use unique public keys for each valid client. It could be intercepted and used for DoS against the valid client's Signal service, but that's not a confidentiality risk. It could serve as a UID, but maybe there are workarounds to that.

Re: Technical analysis of the Signal clone used by Trump officials

#366

Post by raggi »

dang wrote: post #181
tomhow wrote: post #141

See also: " The Signal Clone the Trump Admin Uses Was Hacked " https://www.404media.co/the-signal-clone-the-trump-admin-use...

See also https://news.ycombinator.com/item?id=43890179 for discussion of whether that article should count as a follow-up or SNI. Normally I wouldn't link to meta discussion but this was such a weird borderline case that I spent over an hour trying to figure it out. Maybe that makes it interesting. Edit: in case anyone's confused about the sequence here, micahflee posted the current thread 2 days ago. The timestamp a…

dang: the two posts are different topics, also isn't this one "show hn"? I'm so confused by the application of rules around self-posts.

Re: Technical analysis of the Signal clone used by Trump officials

#367

Post by dang »

raggi wrote: post #366
dang wrote: post #181

Earlier quoted context omitted.

See also https://news.ycombinator.com/item?id=43890179 for discussion of whether that article should count as a follow-up or SNI. Normally I wouldn't link to meta discussion but this was such a weird borderline case that I spent over an hour trying to figure it out. Maybe that makes it interesting. Edit: in case anyone's confused about the sequence here, micahflee posted the current thread 2 days ago. The timestamp a…

dang: the two posts are different topics, also isn't this one "show hn"? I'm so confused by the application of rules around self-posts.

They are the same topic in the sense that the HN threads about them are going to lead to the exact same discussion. If you read https://news.ycombinator.com/item?id=43896978 and https://news.ycombinator.com/item?id=43901823, that should be clear - but if not, let me know and I'll try to clarify further.

"Show HN" is a separate thing entirely - it's true that the submitter of this article was the author (which is great), but that's not enough to make a post a Show HN (https://news.ycombinator.com/showhn.html).

Re: Technical analysis of the Signal clone used by Trump officials

#368

Post by pcthrowaway »

stackskipton wrote: post #344
namdnay wrote: post #339

Earlier quoted context omitted.

The clean way to do it (which is how Telemessage’s competitors do it) is to use WhatsApp business APIs with dedicated phone numbers.

Most traders I dealt with want to do it on personal cell phone so they can keep contacts as they move around. Most of them are like salespeople, they know exactly how much money they bring in and successful ones refuse to do anything that will impede THEIR method of working. SEC Fines, Regulations? Those are for less successful people. EDIT: There was another post calling them divas, alot of them act that way.

I mean if they're going to use their personal devices for this then a cracked Whatsapp wouldn't help the business anyway.

For devices the company controls they can of course use the API the above poster mentioned though

Re: Technical analysis of the Signal clone used by Trump officials

#369

Post by immibis »

WalterGR wrote: post #54
ryanwhitney wrote: post #24

https://archive.is/2025.05.04-225615/https://www.404media.co... Why are these being instantly marked as dead?

Submissions from some domains aren’t prevented but automatically get deaded. It’s not a campaign. See https://news.ycombinator.com/item?id=43891088 in which a user reports that moderator dang said why that happens for this domain.

Sounds like the definition of a censorship campaign, implemented by HN itself.

Re: Technical analysis of the Signal clone used by Trump officials

#370

Post by immibis »

cesarb wrote: post #191
RiverCrochet wrote: post #164

Earlier quoted context omitted.

There's a difference between data transport and data hosting. Modern expectations of messengers seem to blur this line and it's better if it's not blurred. Incidentally: The reason why they blur it is because of 2 network asymmetries prevalent since the 1990's that enforced a disempowering "all-clients-must-go-through-a-central-server model" of communications. Those 2 asymmetries are A) clients have lower bandwidth t…

> Those 2 asymmetries are A) clients have lower bandwidth than servers and B) IPv4 address exhaustion and the need/insistence on NAT. There's a third asymmetry: C) power-constrained clients which are asleep most of the time. And this applies not only to battery-powered phones/tablets and laptops, but also to modern desktops which are configured by default to suspend on inactivity.

This is the reason IRC, which is a pure message transport, failed.
Post reply on HN