Helping law enforcement lawfully access the Signal app | Hacker News Reader

Helping law enforcement lawfully access the Signal app

cellebrite.com

42 pointseyegor24 comments

I'll quote the top post from there.

> This immediately smells of marketing bullshit:

>> Decrypting messages and attachments sent with Signal has been all but impossible…until now.

>> We found that acquiring the key requires reading a value from the shared preferences file and decrypting it using a key called “AndroidSecretKey”, which is saved by an android feature called “Keystore”.

>Yeah, if you have all the keys you can decrypt stuff..

> This is dumb, please please do not upvote

Are all the keys really easily accessible if they have possession of a locked device? I suppose if they can unlock your device they can just open signal and read the messages right?

Does signal allow generation of new passphrase protected private key and can this software bypass that?

If you have a device and it's unlocked, one can simply open signal app and read the messages. You do not need to do any "hacking" here. I fail to see any extra value in the app, except maybe they are looking to get some of the taxpayer's money funneled through to them

I think one can lock Signal app with a pin so if someone has the device unlocked they would still need the pin.

Signal has considered this scenario by adding an additional client-side "encrypt my messages" locally feature. Which prevents your messages to get sucked out by some digial forensics tool like it would for iMessage, Messager, etc. So I'm curious if this is what they are referring to.

Post-physical unlocked HD access to the device, aka digital forensics, is assumedq here, this is what this company does.

As others have pointed out Signal might have been storing the local pin/password in an Android secure enclave of "AndroidSecretKey" which they found other means around.

Here is the original blog post (also posted by someone else in this thread):

https://web.archive.org/web/20201210150311/https://www.celle...

If you can't tell for yourself, here is Moxie's reply (also linked to by the same hn user):

> This (was!) an article about "advanced techniques" Cellebrite uses to decode a Signal message db... on an unlocked Android device! They could have also just opened the app to look at the messages.

> The whole article read like amateur hour, which is I assume why they removed it.

> https://twitter.com/moxie/status/1337434126186553345

Basically yeah, adding a pin to signal would also prevent this, they didn't bypass such extra measures.

This is what they did in their blog post:

> We found that acquiring the key requires reading a value from the shared preferences file and decrypting it using a key called “AndroidSecretKey”, which is saved by an android feature called “Keystore”.

No further mention of it, so I assume they just had access to it. From Moxie's post, I assume that the keystore is unlocked when the phone is.

lmao yeah if you've got keystore access, you don't really need much else. This is just stupid.

https://web.archive.org/web/20201210150311/https://www.celle...

https://news.ycombinator.com/item?id=25415827

“Cellebrite Physical Analyzer now allows lawful access to Signal app data.”

How can they say that? After they sell the device they won't know how it will be used.

Perhaps they mean: assuming one already has legal authority to access somebody else's app data, this is a legal mechanism to remove any remaining technical barriers? (I.e., the other mechanism available for getting past technical barriers would be illegal, e.g. torturing someone who knows the password.)

Just guessing, and trying to be charitable.

They only sell it to government agencies so they assume that any use for it would be legal even if it’s not.

There were reports of Mexican cartels having access to cellphone decryption software. Yeah, you can say that the cartels are the government in those areas where they have the power. That tells you everything you need to know about lawful access.

Yeah I agree. This type of solutions can always end in the wrong hands.. But you don't need to go that far. The same agencies that buy it can use it in an unlawful way.

https://gizmodo.com/u-s-schools-are-buying-phone-hacking-tec...

They also didn't rule out non-lawful access ;)

> (...) the app also employs a proprietary open-source encryption protocol (...)

Is it possible for something to be open-source and proprietary at the same time? Is it possible if one assumes the definition of the OSI?

The technical term is "oxymoronic snake oil"

Multi-licensing comes to mind but I dont believe that characterization fits in this case as the git repos seem to be GPLv3 and AGPLv3.

"Proprietary" does not necessarily mean "paid" or some other technical term relating to a source license - it just means "our own variety of X".

>it just means "our own variety of X".

I don't buy it. Can you find any instances where it's used like that? According to that definition, you could also say "SpiderMonkey is Mozilla's proprietary javascript engine", which is obviously absurd.

Furthermore, the definitions listed on wiktionary and merriam-webster both seem to incorporate some sort of exclusivity. Just because it's your own variation doesn't make it proprietary.

Mozilla most definitely has exclusive ownership of their property. Ask the people who've tried to repackage Firefox without fully stripping the branding, and get prodded by Mozilla's lawyers.

Here it's a case of semantics, whether you're talking about the open-source software or the full package including services from Mozilla and the Firefox branding. Firefox as a whole is certainly proprietary to Mozilla, even if the code is not.

I suspect the intent re: signal is similar, where the code is indeed open-source, but IIRC signal doesn't network with non-official clients?

Probably best to avoid using the word "proprietary" because of the confusion/connotations, but I don't think it's entirely wrong.

Is it possible for something to be open-source and proprietary at the same time?

It is not. Although in this case, it could perhaps be interpreted as "proprietary protocol for (interacting with?) open-source encryption".

Perfectly possible. It's "proprietary" in contrast to "standardized", not in contrast to "open". The Signal protocol isn't a standard from any standards body (eg ISO, or the IETF), so it's proprietary. Its spec is freely accessible, and free to use, but it's still one company's protocol.

This is awful, And also it is obvious that if one physically possesses the device, the keys, one can access this data.

Reply on news.ycombinator.com