- cross-posted to:
- pulse_of_truth@infosec.pub
- news@lemmy.world
- cross-posted to:
- pulse_of_truth@infosec.pub
- news@lemmy.world
You must log in or register to comment.
The Signal Clone the Trump Admin Uses Was Hacked… by the zio company that made it.
Shockingly comes days after the leak that the service is being used by the dork team. Someone really really really wants to get these backups.
Daily reminder that end to end encryption only works when both ends are secure
Just remember, no matter what way they spin this, they chose to ignore national security protocols and went out of their way to use an unsecure messaging app. That’s the real story. The witch hunt they’re undoubtedly going to go on is a perfect opportunity to redirect the public, save face, and further erode our freedoms.
You know, SOP for the whole Trump regime…
If leaking info to zios is unsecure, USA has much bigger problems.
Something something Hillary Clinton email servers
Yes, HRC was also completely incompetent.
Do libs think this is some kind of own?
Buttery Males
Also, the reason we know about it is because Mike Waltz invited a journalist to a group chat.
a snowball of stupidity if you will. Let’s see how big it grows… looks like it picked up momentum and size now with TG Signal hacked 🤡 ☃️
Actually, I’m more surprised people continue to believe the ‘end to end’ claims of these companies.
Signal makes it believable by providing source code and reproducible builds. It doesn’t rule out the possibility that they’ve done something clever with the random number generator, or have the app store you use give you a compromised app, or provide any protection against endpoint compromise, but it’s about as good as you can get.
Third party apps derived from theirs, which explicitly promise to log all your messages to a server somewhere, like TeleMessage, are, for obvious reasons, far less trustworthy.
Question: how can they even claim it’s e2ee if they also claim to log all the messages? Or is the claim that they log the messages in encrypted form? In which case any client(s) with the only copy of the keys could delete them, making the logs useless.
I don’t know how they claim that would work. But it’s important to note that only telemessage makes that claim, not signal.
well they’ve also had great peer code reviews, and the reproducible builds lets you know they’re not putting a different version on the app store….
Signal? Why wouldn’t they? Why would they want to claim E2EE, then steal people’s chats, and try really hard to make it completely invisible? Which would probably fail since it’s FOSS. Not everything is a conspiracy. Sure, they will sell user’s metadata eventually (if they aren’t doing it already) or become a paid app, maybe even add advertisments, who knows (nothing is safe from enshittification).
TeleMessage is a different thing altogether. Their “claim” is pretty much the opposite: take a known E2EE app and make it completely transparent.
Even with e2e security there is 2 e’s that can get compromised, their use of a altered version of the app on one end is enough to cancel out the whole encryption part it, also on the other end.
But in this case it’s like they have a lock for their garage door that is different from the lock on their car so they can’t steal the car when somebody steals the key to the garage door, but then think they can leave the keys in the lock because there is a lock (encryption) on the doors.
We have forked off from the darkest timeline into its stupidest.
Stupid malice is still malice.
I like that your optimism separated the two
Let’s put them back together:
“Like Idiocracy, only less fun”
For now, until they pull request it back to the dark timeline
Changes Requested
Wow. It’s almost like there is a reason that all those annoying OPSEC procedures exist.
Wait they were using an unpublished fork of Signal?
No. It’s a wrapper around Signal that sends everything into a corporate cloud. The Isaraeli miltary/defense/espionage whatever have been using this, then sold it to a US company. I’m guessing the company provides wrappers around other apps as well.
It completely defeats the purpose of E2EE. I’m sure somebody told our oh-so-competent US government that’s exactly what they need.
Like, it’s actually worse than SignalGate.
The Isaraeli miltary/defense/espionage whatever have been using this, then sold it to a US company.
Not at all suspicious. \s
So basically, they hacked themselves out of any benefit Signal was giving them, and then an external party finished the hack.
Goverment officials are required to archive all communications, so it doesn’t defeat the purposes of E2EE because you can’t have full E2EE to start with. If it was propely implemented and didn’t get hacked it would be fine. Tho I guess implementation wise if it really sends all the data to a corporate instead of government cloud that’s a problem as well.
If it was propely implemented and didn’t get hacked
If it was properly researched and approved by DoD and used on authorized, secure devices which were running on secured networks, it would be fine.
The baseline for security has been pretty decent for years. It’s painfully restrictive which is why they’re chomping at the bit to make it easier, but just slamming a corporate product into use with secret data with no oversight has never been fine even if it was secure.
They do provide wrappers for other apps too, I forget the name of the company but they provide them for WhatsApp, Telegram, and others.
well it’s published now….
the part where they’re a private company, keeping backups of top secret information… that’s only on there to avoid accountability….
yeah that’s bad too….i just hope the hackers are the leaker type and not the hostile foreign government type…
Good news. The fascist takeover will be foiled by the so called “flawless opsec 👊🇺🇸🔥” 🤣
Me(deadpan) : Wow, that is surprising.
You just have to assume that china and the blyats have all our shit.
This was literally a zio project but somehow libs blame china. smh.
So we’re thinking hackers from other countries saw an opportunity but noticed it was ZIO so they backed off? Phew, that’s a relief.
That was a given when he kept boxes of top secret material in his bathroom.
Or when he was showing off docs at mar-a-fucko parties.
Hopefully someone releases all their messages to throw more shit in their faces. Overwhelm them with bullshit just like they did to everything
Cool, cool, cool, cool, cool, cool, cool, cool, cool…
These goddamned idiots are going to get at least one supercarrier sunk. At least one.
Who could have seen this coming /s
Release em!
