Comment by nexuist | Hacker News Reader

Comment by nexuist | Hacker News Reader

Parent Full thread

> Your hardware has backdoors, so does your OS, and encryption clients

None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot.

> popular apps

This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users.

> especially in the US

The app was deployed in Australia.

> can always be commandeered

Why distribute a random app when they could have gotten the criminals to use Signal or Telegram and bust them there?

> as long as you're not actively targeted

How long did it take to find Bin Laden?

> despite using "secure" apps

This was not a secure app and any audit would have revealed this (audits such as the ones that Signal and friends have undergone).

> and stuff like Tor,

Tor was not involved.

> media makes it seem are unbreakable.

None of the apps hyped as "unbreakable" were broken here, so...point still stands, I guess?

Honestly, if anything, the recommended approach from this incident would be to use the walled garden - an FBI-backed honeypot would have a lot harder time getting from the App/Play Store onto a user's phone if it was obviously a scam to collect user conversations, asked for a bunch of permissions, had no reviews, and no apparent update history. Who would download some random chat app that nobody uses?

> How long did it take to find Bin Laden?

Bin Laden used couriers in place of digital communications. And the trail that led to him began with his most trusted courier.

Allegedly, al-Kuwayti was uncovered, some of his communications were intercepted, and then he was followed up to Bin Laden's refuge.

> Who would download some random chat app that nobody uses?

The only thing that slowed the capture was using a courier network. Are you a criminal? Do not use a phone.

Seriously, criminals should know better, whether they are petty drug dealers or major terrorists.

Misplaced faith in cryptography is the gift that keeps on giving.

... https://en.wikipedia.org/wiki/Crypto_AG

Agree with most of what you said but:

> > especially in the US

> The app was deployed in Australia.

Australia has an even worse equivalent of US National Security Letters, allowing individual workers to be compelled to plant backdoors etc..

Not without notice of the company, and not for wide spreaed distribution, ie targeted enforcement.

I was also under the impression this can be served to individuals without the knowledge of their employer, leaving the individual in a position where they can consult a single lawyer about the legality of the request and face jail time for discussing the request with anyone else (including employers).

I would need to re-read the act, but the gov website[1] indicates you are correct that these requests are served to organisations and not individuals excepting sole traders.

[1] https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...

> Not without notice of the company

Oh? The reports I read were that they could compel an individual to do something and not tell their employer.

The reports you read were likely based on commentary from techies who have no understanding about law, plus a handful of lawyers involved with digital rights organisations that have an incentive to play up the significance of the legislation a bit / talk about worst-case scenarios, worst possible interpretations of a dangerous law and the broadest possible interpretation of who constitutes a "designated communications provider". The government has stated that's not how they interpret the legislation, as the service provider will be the employer not the employee, and I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something.

I'm as suspicious about the Assistance and Access Bill as anyone, but the "telling an employee to implement a backdoor without telling their employer" is really a red herring and I don't know why the Australian tech community was so keen to go along with that.

> I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something.

Eh, from where I'm sitting, that's a pretty common tactic to pacify opposition to legislation that grants the government too much power.

Why would such a law target an employee, when as you claim, it targets the employer indirectly too?

Why not leave it at the employer? Just because won't cut it.

Reply on news.ycombinator.com