Comment by revelation | Hacker News Reader

Comment by revelation | Hacker News Reader

I love how the NYT turns their own ignorance of technology into some condemnation of WikiLeaks. That tweet is perfectly fine. What exactly do they believe "bypass" to mean? Of course their own misstep here is only referred to as "a honest misunderstanding" of the generic "press".

The article then goes on to explain what should have been researched from the beginning and delivers the brilliant sentence

This should not come as a surprise.

Right. Here is the salient excerpt from the WikiLeaks release linked in the tweet (!):

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the "smart" phones that they run on and collecting audio and message traffic before encryption is applied.

You turned a tweet into a press article, didn't bother to read the referred article and then have the audacity to depict that as some sort of deliberate misinformation campaign in yet another article instead of simply admitting you rushed for the clicks. On the upside, it is now much clearer that it's maybe not only WL that is in the business of misinformation..

Not really, having a rootkit on a device allows you to bypass anything this is a given.

Wikileaks tweets are also quite demagogic and are tailored for maximum effect, these "techniques" do not actually allow the CIA to bypass the encryption, bypassing the encryption is a whole other thing completely what it does is allow the CIA to read anything on the phone and use any of it's hardware sensors.

Overall the problem with this leak specifically it that there is so far nothing damning, this is exactly the toolkit a modern intelligence agency should have, in fact this is likely to kiddy stuff not the rogue nation targeting kinetic payloads.

What it doesn't show is who these tools target, if Wikileaks to be believed the NSA only targets journalists and human rights activists whilst in reality this isn't the case.

Unlike the NSA the CIA is also not interested in mass surveillance, the CIA produces intelligence analysis primarily revolving around humint sources and targets, which means that their operations tend to be much more targeted a SIGINT agency which relies on bulk data collection.

> bypassing the encryption is a whole other thing completely what it does is allow the CIA to read anything on the phone and use any of it's hardware sensors

I really cannot understand the difference between "bypassing" the encryption and allowing the CIA to read anything on the phone. Those sound like trivial synonyms.

Bypassing encryption means that you are actually bypassing the encryption method, e.g. fooling WhatsApp to not encrypt and not alert the user, forcing WhatsApp to use a specific key again without alerting the user, finding a way to access the clear text messages in the service itself etc.

Reading the clear text pre or post description isn't bypassing encryption because this can be done regardless of the type or method of encryption used.

If I beat you with a wrench until you tell me your password it doesn't mean I managed to bypass the encryption of your password manager.

The definition of bypass seems to be exactly the opposite of what you're saying. Here's one. "a secondary channel, pipe, or connection to allow a flow when the main one is closed or blocked"

I understand bypass to mean "go around" basically. So if I bypass something, I have found a way to avoid it. I really think this is the common usage.

You burn a strawman to explain what bypass means then suggest hooking an app to extract data before encryption after gaining code execution is not bypassing. You took a wrong turn here somewhere.

I'm not really interested in another repeat of the "there is nothing here" discussion. We seem to get that for each of these releases; lots of people swarming in to tell us they were perfectly aware of all these things since, well, forever.

> ...these "techniques" do not actually allow the CIA to bypass the encryption...

The definition of the word bypass is, "a secondary channel, pipe, or connection to allow a flow when the main one is closed or blocked." How is a rootkit not bypassing encryption? It doesn't break encryption.

> Unlike the NSA the CIA is also not interested in mass surveillance...

Why do you believe this to be true?

> Overall the problem with this leak specifically it that there is so far nothing damning

The wholesale violation of 4th Amendment protections isn't damning to you?

> wholesale violation of 4th Amendment protections

Where is there a violation of the 4th Amendment? The 4th Amendment is not about capabilities, which always have existed in one form or another (e.g., reading people's mail), but about legal authorization to use them.

You seem to have confused an editorial written by a college professor with a news article written by a reporter. This is an opinion piece and should be treated as such. Apparently you have a different opinion (which is perfectly fine!), but that has nothing to do with how the NYT covers technology.

Reply on news.ycombinator.com