Political World Embraces Encrypted-Messaging App Signal Amid Fears of Hacking
wsj.com
wsj.com
Since I don't anticipate the USA ever outlawing unbreakable crypto for use by private citizens or companies, does that mean eventually government can only spy on those citizens not savvy enough to use secured tech to communicate?
I guess the flipside here is: how many of those officials using Signal have an Amazon Echo in their homes that's recording all their conversations?
None is the correct answer.
Of _course_ those in power believe themselves smart enough to avoid the rules they wrote - they want to be secure, and know the presence of very real threats both within and outside of the US. I'm not defending it - but you'd have to be extremely foolish to commit a crime from your @whitehouse.gov email address. You'd have to be equally foolish to commit any crime over email or unencrypted IM if you'd talked to a lawyer with half a braincell to rub against a rock.
And the US /has/ banned unbreakable crypto - those 56 bit ciphers in old browsers? That was export law banning the export of 'weapons' to unfriendly states. While the law has been recinded, nothing has made it hard for congress (or even the executive) to change that.
And lastly - Echo does NOT transmit to amazon when the light is off (perhaps unless compelled to by court order - but I leave paranoia to your imagination). Don't believe me? Disconnect your internet and ask for the time - it knows how to do a few very minimal things without the network -- No AWS transmission needed if your clock's in sync.
https://www.engadget.com/2016/12/27/amazon-echo-audio-data-m...
Just because a simple test (disconnecting) the network shows you one behavior means and tells you absolutely nothing about how it could be backdoored. It could be as exotic as a payload deep in the NIC firmware that merely requires the right packet to cross through it completely altering the behavior so it can silently listen. Anyone that can accomplish this much can make the device behave normally until they want it not to. And even then, it will APPEAR normal. It could also be as simple as code Amazon knows about and is compelled by a NSL to never reveal.
So, paranoia or likelihood aside, using some cursory behavioral conclusion as an argument is weak at best. We can also talk about phones, laptops and so many other things and why the meme of the echo being /the/ spy device has gained mind share. Anyhow, for the truly paranoid even something like a modern mobile device is a bit of a non-starter.
Or at the design level. A part of me strongly suspects that the Intel IME was dreamed up by the NSA and I'd be very surprised if they don't have a way to own it.
I'm sure my PC is a lot easier to break into than the Echo. Depending on how the Echo works, it might not be so easy to back door. It's not likely to be running any system services that can be connected to remotely. It's a pretty simple device without a lot going on internally (compared to a phone or PC). I'd be far more worried about complex electronics like a television or PC being backdoored than an Echo. Furthermore, because these other devices are an order of magnitude more popular, and actually store people's data there's far more incentive for malicious actors of all kinds to develop back doors for them.
The Echo is actually a pretty uninteresting target. It doesn't store any data. Maybe you can break into it remotely and use it to listen, but that's it. That's all. You cannot, just by breaking in, sift over a vast trove of preexisting information, like you can with a PC. You'll never steal someone's documents, or read their email, or steal their passwords. Plus if you get into someone's PC or phone you can probably turn on a mic and record them too! I think the Echo honestly has pretty limited value on average as an attack target. It will be low in the priority list for attackers to target.
Regardless, if any of these devices are backdoored and recording me, then it will be trivially easy to detect that unexpected network activity. I am far less worried about my Echo than my PC, because I expect my Echo to have zero network activity except when I'm using it. Since it does one thing, it has no excuse for unexpected network activity. It's very easy for me to monitor that network activity - built right into my wireless router. With my PC, who knows what the hell it's doing because some software decided to download an update. PCs and phones are not simple enough that you can expect them to have no network activity when idle. The Echo is simple enough to have no network activity when idle.
Because the Echo would be so easy to detect if it were improperly recording you, I do not think a state actor would risk trying to observe anyone security-conscious in that way.
None at all. There is also no reason to exclude the Echo from the list of backdoorable devices.
Privacy-conscious people need to learn sign language.
Also we have to separate assessments of irrational paranoia into pre-Snowden and post-Snowden realities. The lens through which we now view these things is fundamentally different.
It's easier for a malicious software engineer to embed a backdoor than the NSA, barring any vulnerabilities in open source software (openssl, Linux, etc.).
The "wakeword" is detected by a pretty large user space program, constantly observing filtered audio. The device can not recognize much on its own.
The Echo family also can't stream audio continually, the CPU is not very powerful and the sheer bandwidth required would be enough for anyone tech savvy to notice.
The firmware and OTA process is likely more secure than necessary and it would be stupid difficult for a 3rd party to produce a signed firmware image, and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut.
I would be (and am) much more concerned about my phone or laptop (or surroundings) recording me than the Echo devices.
I am happy to talk more about the device security privately. I am sick at the amount of FUD around this class of products. There are so many more frightening threats out there.
(Disclaimer: I used to, but no longer, work for Amazon.)
Of course. An engineer within the company has access to source code without having to involve multiple parties. This does not preclude other threats or diminish the reach of a well-funded agency.
Can an engineer at Google write code to log searches more easily than an outsider? Sure. That doesn't mean that you should write off the possibility that a third party could do the same.
This is probably the most compelling independently-verifiable argument.
Even assuming the ability to do arbitrary things with an Echo, logging or transmitting useful voice all the time without notice isn't doable. And it seems hard to recognize suspicious discussions and turn on just for those (Echo has enough trouble recognizing "Alexa" 100% reliably).
You could subvert Echo so that it records you during pre-determined times - but there are so many other devices you could subvert, too. Getting malware on a government official's personal laptop via spearphishing seems so much easier.
You can stream voice in 10kbps. When I was a kid I streamed voice using a Z80. CPU and bandwidth are not limiting factors.
The fear isn't over what the Echo does in normal operation, it is what the Echo does when it has been compromised. It is nothing but a fancy remote controlled microphone sitting in your living room -- people used to write books about this to describe a dystopian future.
What is the bandwidth required to stream speech? I remember reading back in the old days that speech only required 8k of bandwidth. Now with codecs that do efficient compression of speech, like Speex[1] and Opus[2], I expect that figure should be much improved.
Are you really going to notice an 8k increase in your bandwith usage?
[1] - https://www.speex.org/
[2] - http://opus-codec.org/
> and involving Amazon would likely rouse the suspicion of many engineers and they're not known to keep their mouths shut
pretend I'm NSA. I show up to head counsel at AMZN with an NSL saying "all your code are belong to me". He says "yessa massa" and bows. I say, "ok, not all your code, but give me full disk images of the build server that signs code for the echo, and full disk images of the git server housing the current echo build.
One "yessa massa" later, and he briefs CTO of DevOps to do the pull, which happens at 2:30am on a sunday morning (when those chatty-cathy engineers are fast asleep in their neckbeard nests). `cp disk1 disk2 /nsa_folder/` wait 20 minutes, done. NSA is doing full signed echo builds by EOD Monday.
what is actually precluding that from happening. Now NSA can build "updates" for the echo, sign their builds, "deploy" them using their rooted telco infrastructure. what would actually keep this hypothetical scenario from happening ?
well that settles it then. I'm sure an unscrupulous entity would never think of compressing an audio stream for later retrieval/conversion to text/spurious retrieval. That would be dishonest.
Or you can just use a private server and wipe it clean.
One of Signal's goals is to be proliferated in main stream applications (like Whatsapp) so hopefully those not savvy enough to use signal directly can benefit from the pressure that savvy users exert on Facebook and others to be reasonably confident in their crypto. Similarly, I've never personally verified that my version of Signal is the same as one that I could build from source, but I make the tradeoff that someone more paranoid than me would notice a widespread compromising of the app store.
I'd rather have an infosec-competent government than one that's an open book to foreign adversaries. The last few months have been embarrassing. We had one top official run their own email server out of a private basement in suburban New York, unsecured and unmonitored. We had John Podesta, seventy years old, fall for a Russian phishing scheme that involved downloading an executable email attachment, presumably clicking thru the warning and running it anyway.
In the wake of that, political officials may have been scared into caring about infosec. We may be winning the fight against apathy and incompetence -- but we are still losing the fight against hypocrisy.
--
Both the current and previous administrations are full of powerful people who want privacy and security for themselves, while denying the same to the citizens they serve.
The previous administration promised, in 2008, to be the most transparent ever. It proceeded to have an abysmal record with respect to whistleblower prosecution, government transparency, and FOIA obstruction. The new administration looks likely to be even worse.
Laws like the Snoopers Charter, recently passed in the UK, cast an ominous shadow over the whole American security profession. Thoroughly nontechnical old men run our government. We must convince them and the public that strong encryption with no backdoors is critical both for national security and for the preservation of our First Amendment rights.
Call your senators and call your representative. Demand better.
What does Podesta's age have to do with anything at all??
I took it as implying that old people tend to be less technically savvy (although as the hackers of last generation age this is increasingly untrue).
1. my wife did have a student protest the no phones in class ban so he could login with Google Authenticator, so it's not like there aren't exceptions.
Second: > The new administration looks likely to be even worse
Try googling next time
Lavabit's situation was different because they were a "choose not to look" solution, not a "can't look" solution.
That said, Signal is centralized, so it's not like they are particularly robust against that sort of thing, just that other than getting Signal shut down, any strong-arm tactics are unlikely to result in very useful information from OWS.
https://www.aclu.org/blog/free-future/new-documents-reveal-g...
I honestly don't see a revolution coming if Signal is shut down. There will be some angry folks, sure, and that will last a while, but then everyone will move on. Exactly as it happened with the Snowden revelations.
If Signal goes down I would speculate a lot of people who already have things like encrypted messengers, adblockers, things of that nature, would start to move to the only-vpn, no javascript run ever, no Google Play Services on your phone, no proprietary software at any stage of your life sort of deal.
Doesn't matter how you design the architecture. Someone can just force them to "update" their app via the app store, and all of your privacy is gone.
https://github.com/WhisperSystems/Signal-Android/blob/master...
For any classified material officials can use their SIPRNET/JWICS emails, for which suspicious access is much more closely monitored, of course.
Not many security people in the world would sign on to that position.
Do you mean to suggest that Gmail is more secure than government classified networks?
Signal's authors may be more technically competent than a government security officer, but Signal can be coerced into releasing an update that surreptitiously changes the behavior of the application whereas well-protected NSA officers are (theoretically) more immune.
Clearly, I'd rather Clinton use GApps than run her own email server. But for security, her worst option was the official servers.
A month before the hacking revelations, Bilton reported, DNC staffers were told they should use this "Snowden-approved" app whenever they were mentioning Donald Trump, especially if their message was disparaging.
Signal is an incredibly easy-to-use app for iPhone and Android that allows both encrypted text and voice communications. Founded by Moxie Marlinspike in 2014, it requires no sign-up, registration, or exchange of information between parties. You just download the app, install it on your phone, and call whoever you want to talk to, using regular phone number.
http://www.businessinsider.com/clinton-dnc-snowden-signal-20...
I'd hope not, and I rather think they they all hope not. But I wonder what happens when push comes to shove.
And yes, if you're doing something critical, verify the security codes first!
Then there's no need to retrieve a device and dump its message store, which obviously depends on the device being in a functional state. Instead there's a one-time setup when Signal is first installed.
That doesn't mean the user can't export the messages himself.
javascript:location.href='https://www.google.com/webhp?%23q='%20+%20encodeURIComponent(location.href)%20+%20'&btnI=I'
E.g. http://facebook.com/l.php?u=http://www.wsj.com/articles/poli...
javascript:location.href='http://facebook.com/l.php?u='+encodeURIComponent(location.hr...
Make a bookmark with that, call it I'm from Facebook or something, and go to it when you hit a paywall.
It never existed, it doesn't exist now, and it is unlikely to exist in the future.