Slashdot Mirror
Encryption App Signal Wins Fight Against FBI Subpoena and Gag Order (dailydot.com)
An anonymous reader quotes a report from The Daily Dot: Signal, widely considered the gold standard of encrypted messaging apps, was put to the test earlier this year when a FBI subpoena and gag order that demanded a wide range of information on two users resulted in a federal grand jury investigation in Virginia. The makers of Signal, Open Whisper Systems, profoundly disappointed law enforcement. The app collects as little data as possible and therefore was unable to hand anything useful over to agents. "That's not because Signal chose not to provide logs of information," ACLU lawyer Brett Kaufman told the Associated Press. "It's just that it couldn't." "The Signal service was designed to minimize the data we retain," Moxie Marlinspike, the founder of Open Whisper Systems, told the New York Times. The subpoena came with a yearlong gag order that was successfully challenged by the American Civil Liberties Union. Signal's creators challenged the gag order as unconstitutional, "because it is not narrowly tailored to a compelling government interest." The challenge was successful. In addition to being popularly considered the best consumer encrypted messaging app available, Signal's technology is used by Facebook for Secret Conversations, WhatsApp for encrypted messages, and Google's Allo. Confronted with the subpoena, Marlinspike went to the ACLU for legal counsel. The ACLU responded with a letter saying that even though Signal did not have data the FBI sought, it still strenuously objected (PDF) to the fact the FBI wanted so much information.
Those Feds sure have a kinky power trip going on... I wonder if they wear zipper masks...
Has anyone tested Tor Project's Tor Messenger ?
I bet their business will pick up with a sterling endorsement from the ACLU.
People should be compelled to speak loudly enough that their communications can be recorded by law enforcement.
If you have nothing to hide you have no reason to whisper.
the phone number is for two factor authentication/verification.
moxie is legit, man.
That is something that Signal does know. And with the key they can man-in-the-middle the site.
I wonder what happens if the key is put inside a Hardware Security Module (HSM). They are carefully designed never to release the key, each request needs to be process by the HSM itself. I would be suprised if Signal or anyone else in this space uses one though.
And of course, the Feds will have their own CA and so could just forge the cert.
Doing SRP on a HSM though, that would slow them down. SRP also kills phishing. Which is why no security company will want to support it.
So when is Apple and Google going to stop keeping logs?
This code has been audited thoroughly... The requirement for sms distinguishes it from alternatives using the same codebase: WhatsApp secret etc.
Fyi the Infosec community at large uses signal... Your paranoia is not unwarranted and perhaps you are willing to avoid it, but your sms/phone number isn't private nor should you treat it as such.
I mean by that are the public keys the same over time (long time!) without key revoke and update mechanisms. Or is it just a session key you're talking about?
One of the things I think are the trojan horse of crypto is "oooo we must revoke the public key if its stolen", by which they add a backdoor mechanism that lets them silently change the public key, or enable the start of a man-in-the-middle attack.
Certificates take this process further by *expiring* the cert, typically annually. Making a clear start point for the MITM attack to begin. TLS is a joke now.
I think *time* is the best check, and if you can ensure the key is not change by any 'revoke' or 'expire', then the key must be the same, and you can ensure its the same contact point from day-one. If the key is stolen, then the key change is a BIG DEAL, IS public and the fact it changes IS noticed. The other party is no longer the trusted entity you've been dealing with over the years. Your trust was built up in the public key, not the email address or message address it was attached to (which is usually trivial to fake).
Makes for a really good false sense of security. Adds confidence to encourage users to speak more freely. Overall effective article for all intents and purposes.
Weak spot via the shared Google libraries it's compiled with when you download it from the play store.
MITM attacks.(they occur)
Several of Moxie's postings raised the hairs on the back of my neck, which means nothing but I trust my intuition.
I doubt signal comms will ever make it to a courtroom but I'd wager they are very accessible to those who have the interest and resources.
Those who care more about intelligence(hooray) rather than simply law enforcement.
All your comms are owned, if they want to own you, you are owned. Give me that kind of budget, those resources, and that authority and I'll own anyone.
[blah blah blah ...] Moxie Marlinspike
I've been playing with ejabberd and Conversations on Android with OMEMO.
Look it up.
It says it needs access to:
Device & App History
Identity
Calendar
Contacts
Location
SMS
Phone
Photos/Media/Files
I have a hard time feeling private with all those permissions. I'm surprised it didn't ask for my blood type.
I know pretty much everything "requires" access to everything these days. When your printer wants access to your contact list, something is wrong. This is a privacy app, why is it so intrusive?
On their page, it even says "Using Signal, you can communicate instantly while avoiding SMS fees". So why does it want access to SMS?
> being popularly considered the best consumer encrypted messaging app available
The NSA wants you think that. It is a Potemkin village with a kabuki theatre. Since secret services and agencies operate outside of the law, it is moot what wig-wearing, priestly robed judges proclaim about them.
American people have been indoctrinated to falsely think that words have powers. No, words like those written on the rawhide of constitution, declaration of independence, scotus verdicts, etc. have no power. They are just babble. What counts is the power to conduct action.
....Oh..... wait.
Are people finally getting this is not a partisan thing?
article says they use signal - and trust being what it is these days in regard to our privacy - are facebook and google also respecting our privacy or do they grab other data - INCLUDING compiling metadata which is being treated as public property these days by the sheer amount stupid a the NSA?
All governments repress conversations between citizens. It does not relate to a need to do so. It is not because a nation has enemies or the danger of some potential emergency. It is almost as expected as the fact that a banana will ripen and turn black. It can have to do with corruption and a seeking of ways to make money, a desire to maintain power, or a desire to squash people not liked by an administration. And frankly it is next to impossible to stop. If a spy agency wants to steer certain people to use a particular encryption system there would be one heck of a motive to get refused to break an encrypted product as a lure and announce in a subtle way that the government is frustrated at not being able to penetrate the product. We never know if it is not a spy agency actually creating the encryption programs. This went as far as a very superior cell phone being sold in Miami that was designed to lure drug dealers to use that phone and every conversation went right to the FBI and probably other agencies as well.
Really interesting quote from ZDNet article:
+1
...that the combined resources of the US government can't defeat Apple or Signal. Yet, the US gov even pushed other businesses to the wall. Even Snowden is pushing Signal and Tor...when Tor has a hand-picked intel asset board and the whole platform is mainly routed through NATO providing a global view.
I call bullshit on this and state that any surviving US tech giant is backdoored in some fashion and part of the 'apparatus'.
"Oh. Well, if you /strenuously/ object then I should take some time to reconsider."
How about Telegram?
What a completely incoherent article! The title says they won a fight. What fight was that? Was there a court ruling? If so, what issue did it decide and what did it say? Or does it have something to do with the grand jury investigation mentioned vaguely and confusingly in the summary? Who or what was that grand jury investigating? Did they just make a decision about something? I really can't tell what the story is here.
"I'm too busy to research this and form an educated opinion, but I do have time to tell everyone my uninformed opinion."
The Tor Project has a testing release of "Tor Messenger". See blog.torproject.org
But you see, it's not popular or cool enough to post about Tor here.
ONLY if it's BAD news about Tor, then that gets front page treatment!
You seem to have some thorough and strong opinions. Please explain to me why a 50cal is OK, but grenades, fully automatics, silencers, and tactical nukes are not?