
Political World Embraces Encrypted-Messaging App Signal Amid Fears of Hacking - bcaulfield
http://www.wsj.com/articles/political-world-embraces-encrypted-messaging-app-amid-fears-of-hacking-1485492485
======
joshpadnick
So, government argues it needs broad spying powers for the "security" of the
people, but many individuals in the government personally use tools they
believe to be beyond the government's reach.

Since I don't anticipate the USA ever outlawing unbreakable crypto for use by
private citizens or companies, does that mean eventually government can only
spy on those citizens not savvy enough to use secured tech to communicate?

I guess the flipside here is: how many of those officials using Signal have an
Amazon Echo in their homes that's recording all their conversations?

~~~
abofh
Sigh. I was with you right until the end.

Of _course_ those in power believe themselves smart enough to avoid the rules
they wrote - they want to be secure, and know the presence of very real
threats both within and outside of the US. I'm not defending it - but you'd
have to be extremely foolish to commit a crime from your @whitehouse.gov email
address. You'd have to be equally foolish to commit any crime over email or
unencrypted IM if you'd talked to a lawyer with half a braincell to rub
against a rock.

And the US /has/ banned unbreakable crypto - those 56 bit ciphers in old
browsers? That was export law banning the export of 'weapons' to unfriendly
states. While the law has been recinded, nothing has made it hard for congress
(or even the executive) to change that.

And lastly - Echo does NOT transmit to amazon when the light is off (perhaps
unless compelled to by court order - but I leave paranoia to your
imagination). Don't believe me? Disconnect your internet and ask for the time
- it knows how to do a few very minimal things without the network -- No AWS
transmission needed if your clock's in sync.

~~~
bitexploder
This view of the amazon Echo threat model is very narrow and credits a great
deal of trust into Amazon and or how things "should" work. I won't go into the
likelihood that what I am about to explain is an actual reality, but in
practical terms a nation state actor like the NSA can backdoor the Echo.

Just because a simple test (disconnecting) the network shows you one behavior
means and tells you absolutely nothing about how it could be backdoored. It
could be as exotic as a payload deep in the NIC firmware that merely requires
the right packet to cross through it completely altering the behavior so it
can silently listen. Anyone that can accomplish this much can make the device
behave normally until they want it not to. And even then, it will APPEAR
normal. It could also be as simple as code Amazon knows about and is compelled
by a NSL to never reveal.

So, paranoia or likelihood aside, using some cursory behavioral conclusion as
an argument is weak at best. We can also talk about phones, laptops and so
many other things and why the meme of the echo being /the/ spy device has
gained mind share. Anyhow, for the truly paranoid even something like a modern
mobile device is a bit of a non-starter.

~~~
Pyxl101
Is there any special reason to worry about your Echo being backdoored rather
than your PC or laptops with their frequently built-in microphones? Heck even
my _computer monitors_ seem to have microphones today.

I'm sure my PC is a lot easier to break into than the Echo. Depending on how
the Echo works, it might not be so easy to back door. It's not likely to be
running any system services that can be connected to remotely. It's a pretty
simple device without a lot going on internally (compared to a phone or PC).
I'd be far more worried about complex electronics like a television or PC
being backdoored than an Echo. Furthermore, because these other devices are an
order of magnitude more popular, and actually store people's data there's far
more incentive for malicious actors of all kinds to develop back doors for
them.

The Echo is actually a pretty uninteresting target. It doesn't store any data.
_Maybe_ you can break into it remotely and use it to listen, but that's _it_.
That's all. You cannot, just by breaking in, sift over a vast trove of
preexisting information, like you can with a PC. You'll never steal someone's
documents, or read their email, or steal their passwords. Plus if you get into
someone's PC or phone you can probably turn on a mic and record them too! I
think the Echo honestly has pretty limited value _on average_ as an attack
target. It will be low in the priority list for attackers to target.

Regardless, if any of these devices are backdoored and recording me, then it
will be trivially easy to detect that unexpected network activity. I am far
less worried about my Echo than my PC, because I expect my Echo to have zero
network activity except when I'm using it. Since it does one thing, it has no
excuse for unexpected network activity. It's very easy for me to monitor that
network activity - built right into my wireless router. With my PC, who knows
what the hell it's doing because some software decided to download an update.
PCs and phones are not simple enough that you can expect them to have no
network activity when idle. The Echo is simple enough to have no network
activity when idle.

Because the Echo would be _so_ easy to detect if it were improperly recording
you, I do not think a state actor would risk trying to observe anyone
security-conscious in that way.

~~~
redial
> Is there any special reason to worry about your Echo being backdoored rather
> than your PC or laptops with their frequently built-in microphones?

None at all. There is also no reason to exclude the Echo from the list of
_backdoorable_ devices.

------
dcposch
Good.

I'd rather have an infosec-competent government than one that's an open book
to foreign adversaries. The last few months have been embarrassing. We had one
top official run their own email server out of a private basement in suburban
New York, unsecured and unmonitored. We had John Podesta, seventy years old,
fall for a Russian phishing scheme that involved downloading an executable
email attachment, presumably clicking thru the warning and running it anyway.

In the wake of that, political officials may have been scared into caring
about infosec. We may be winning the fight against apathy and incompetence --
but we are still losing the fight against hypocrisy.

\--

Both the current and previous administrations are full of powerful people who
want privacy and security for themselves, while denying the same to the
citizens they serve.

The previous administration promised, in 2008, to be the most transparent
ever. It proceeded to have an abysmal record with respect to whistleblower
prosecution, government transparency, and FOIA obstruction. The new
administration looks likely to be even worse.

Laws like the Snoopers Charter, recently passed in the UK, cast an ominous
shadow over the whole American security profession. Thoroughly nontechnical
old men run our government. We must convince them and the public that strong
encryption with no backdoors is critical both for national security and for
the preservation of our First Amendment rights.

Call your senators and call your representative. Demand better.

~~~
ComputerGuru
> We had John Podesta, seventy years old, fall for a Russian phishing scheme
> that involved downloading an executable email attachment, presumably
> clicking thru the warning and running it anyway

What does Podesta's age have to do with _anything_ at all??

~~~
dcposch
Like it or not, computer illiteracy has had a major effect on recent political
events.

~~~
acdha
Talking to teachers is eye-opening: younger kids are more comfortable with a
few specific tasks but on average they're no better than their parents,
especially when it comes to things like security[1]. We need a combination of
country-wide education and the equivalent of UL/Consumer Reports for buying
advice.

1\. my wife did have a student protest the no phones in class ban so he could
login with Google Authenticator, so it's not like there aren't exceptions.

------
jcfrei
I wonder how long Signal will stay up before they get a knock on the door -
just like lavabit did:
[https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...](https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order)

~~~
x1798DE
IIRC Signal _did_ get a "knock at the door" and, rightly, had almost nothing
to give the government - mostly because of how they designed their
architecture, but admittedly partially because of the metadata they chose not
to store.

Lavabit's situation was different because they were a "choose not to look"
solution, not a "can't look" solution.

That said, Signal is centralized, so it's not like they are particularly
robust against that sort of thing, just that other than getting Signal shut
down, any strong-arm tactics are unlikely to result in very useful information
from OWS.

~~~
xux
"mostly because of how they designed their architecture"

Doesn't matter how you design the architecture. Someone can just force them to
"update" their app via the app store, and all of your privacy is gone.

~~~
tw04
It's open source, and you can build it yourself if you're worried about the
app store being compromised.

~~~
eeZah7Ux
No you cannot.

~~~
tw04
Yes, you absolutely can.

[https://github.com/WhisperSystems/Signal-
Android/blob/master...](https://github.com/WhisperSystems/Signal-
Android/blob/master/BUILDING.md)

------
hendzen
really awesome that cutting edge crypto is being used by our elected officials
& their aides to avoid public records laws!

~~~
Esau
Worse, they are using it while trying to place back doors in it.

~~~
jabl
I'm sure they can manage to insert a back door in the legislation, giving
themselves a way out.

~~~
graedus
All legislation is already backdoored by money and the right connections.

------
georgecmu
Heh, there was this business insider piece from Aug 2016:

 _A month before the hacking revelations, Bilton reported, DNC staffers were
told they should use this "Snowden-approved" app whenever they were mentioning
Donald Trump, especially if their message was disparaging.

Signal is an incredibly easy-to-use app for iPhone and Android that allows
both encrypted text and voice communications. Founded by Moxie Marlinspike in
2014, it requires no sign-up, registration, or exchange of information between
parties. You just download the app, install it on your phone, and call whoever
you want to talk to, using regular phone number._

[http://www.businessinsider.com/clinton-dnc-snowden-
signal-20...](http://www.businessinsider.com/clinton-dnc-snowden-
signal-2016-8)

------
1_2__3
I like how "our duly-represented governments ignore the will of the people and
their own laws and constitutions to effect illegal searches of citizens who've
done nothing wrong" as "hacking".

------
Gaelan
Paywall-proof AMP link:
[https://www.google.com/amp/www.wsj.com/amp/articles/politica...](https://www.google.com/amp/www.wsj.com/amp/articles/political-
world-embraces-encrypted-messaging-app-amid-fears-of-hacking-1485492485).
You'll need to set your user agent to a smartphone.

~~~
slaviotheslav
Bro im on a smartphone pay wall prompt still pops up thanks though.

------
johnhenry
Does anyone know if signal is can be infiltrated via SS7 vulnerabilities
because of it's reliance on telephone numbers?

~~~
willstrafach
Worst case would mean the other user will at least get a key change
notification. If they care to verify that out of band, then there is no issue.

------
anondon
The way Signal handles key changes is a not very user friendly for non-tech
users. When the user's key changes, Signal does not automatically resend
dropped messages like Whatsapp does. Curious whether the Signal users in the
Government are aware of this.

------
Dan_JiuJitsu
I love signal, and it's heartening to me that the userbase is increasing.

------
zeveb
So, there are a few things that OWS can do with its privileged position: it
can, for example, lie about what your public key is and then receive all
messages intended for you. I wonder if any of the folks over there would be
tempted to do that, if they disagreed strongly enough with one politician or
another.

I'd hope not, and I rather think they _they_ all hope not. But I wonder what
happens when push comes to shove.

~~~
tonyztan
Signal does allow users to manually compare key fingerprints ("safety
numbers"), and it does ask for confirmation when the numbers change. Whether
users actually verify is a different story.

------
aphextron
Good. Maybe it has finally sunk into mainstream consciousness that e-mail is
completely insecure.

------
TheSageMage
How does the use of this technology fit in with the FOIA, etc?

~~~
tonyztan
Signal has a built in 'export' function that produces a plaintext file with
chat logs. However that might defeat the point of end-to-end encrypted
messages.

~~~
amboar
Another approach is to use Signal's "Linked Devices" capability. Designate a
central "device" (server) for FOIA purposes, and mandate all relevant public
servants/elected officials using Signal add that as a linked device.

Then there's no need to retrieve a device and dump its message store, which
obviously depends on the device being in a functional state. Instead there's a
one-time setup when Signal is first installed.

------
jakeogh
on closed baseband with DMA access.

------
ufmace
Could be an interesting article, anybody know how to read it? WSJ has been
hiding the article text behind a paywall, and even Google doesn't seem to
cache the full text.

~~~
ctrl_freak
Yes, I just found out yesterday that setting your referrer to
facebook.com/l.php allows you to reliably bypass the paywall.

E.g.
[http://facebook.com/l.php?u=http://www.wsj.com/articles/poli...](http://facebook.com/l.php?u=http://www.wsj.com/articles/political-
world-embraces-encrypted-messaging-app-amid-fears-of-hacking-1485492485)

~~~
abofh
Wow, I don't even have a facebook account and that works. That feels like some
XSS waiting to happen :/

~~~
Buge
It's an open redirect, not XSS. It's a matter of debate whether an open
redirect is a vulnerability or not.

------
Neliquat
What happened to the ban on paywalled stuff?

~~~
krapp
> What happened to the ban on paywalled stuff?

It never existed, it doesn't exist now, and it is unlikely to exist in the
future.

