Conversation

Notices

1. Embed this notice
   Micah Lee (micahflee@infosec.exchange)'s status on Tuesday, 31-Dec-2024 03:51:19 JST Micah Lee

   https://hassignalbeenhacked.info

   • Embed this notice
     feld (feld@friedcheese.us)'s status on Tuesday, 31-Dec-2024 04:38:00 JST feld

     in reply to
     @micahflee conveniently excludes how Signal Desktop left the database encryption key just sitting there in plaintext and all attachments were unencrypted for about 10 years so anyone who could get access to your Signal Desktop, which likely was installed on an OS without full disk encryption, could read all your messages. Likely how many legal investigations acquired access to Signal chats.
   • Embed this notice
     feld (feld@friedcheese.us)'s status on Tuesday, 31-Dec-2024 04:59:05 JST feld

     in reply to

     • Andrew Bartlett
     @abartlet @micahflee it shouldn't have existed, period. Require an HSM / Secure Enclave like the phones have as a prerequisite. They knowingly reduced the security posture of their users and didn't tell anyone.
   • Embed this notice
     Andrew Bartlett (abartlet@mastodon.nzoss.nz)'s status on Tuesday, 31-Dec-2024 04:59:09 JST Andrew Bartlett

     in reply to

     • feld

     @feld @micahflee For an OS of an era before full disk encryption what should it have been encrypted with?

   • Embed this notice
     Andy Mouse (andymouse@todon.eu)'s status on Tuesday, 31-Dec-2024 05:46:28 JST Andy Mouse

     in reply to

     @micahflee I think the title should be "Is Signal a data mining platform, just like other end to end encrypted chat programs like Meta's WhatsApp?"

     Or perhaps

     "If you and your activist friends use Signal, will the cops group you together?"

     The answers would then be "Yes" and "Yes".

     Anything else is cute, but inspires little but fiction.

     feld likes this.