I actually believe that law enforcement has the legal right to subpoena information, with a judge's consent, while investigating criminal activity. This is exactly the solution to that problem. These platforms should want to know as little about you as possible.
For iOS users, that will be a death knell.
You press the only non-"give up" button at each stage and you're done.
Remember that Fortnite succeeded in convincing people to do this by the millions. It's not hard.
Somewhat. And sometimes. And when the high-security-site for installing a high-security-tool is asking you to do a thing, it's quite a bit psychologically different than e.g. a reddit post saying "install this apk and approve all prompts: http://www.5z8.info/hack-outlook_w2f7vj_dogfights"
Come to think of it, that'd be the perfect place to go to demand a wiretap - at least one such popular "LY" service already exists.
I'm still shaking my head at what many regular users will agree to..
I’ve been watching _The Wire_ and Idris Elba’s character sounds like a good overlap, but he feels very unusual (in fiction)--and definitely too careful about OpSec to use that kind of service.
More generally, there’s a lot of anecdotic evidence between problematic behaviour and low-level spelling details: one that is apparently better documented now is a correlation between insurance fraud and whether you capitalise properly the name of your employer on registration form.
If they had developers in, say, France, who would need to accept changes made somewhere else then a single country could not force such secret modifications.
Of course an app is actually a binary, so there must be a way to verify that code + compilation = the published binary.
The Internet may interpret censorship as damage and route around it, but spy agencies interpret laws as inconveniences and ignore them.
As access closes in one place (i.e application layer), they will just get closer to the source (i.e operating system or supply chain)
Same goes for music and video - we won't be legally allowed to hear and watch non-DRM-playable devices as the speakers and displays will be rented not owned by corporations.
We have almost arrived at the Rental Economy, where we dont own anything and are at the behest of corporations. It's modern serfdom
The more I think about it, the more I am convinced they could do this, but they would rather not because it's much harder, since it requires a special warrant with high evidence thresholds for each user. This reinforces the claim that what they really want is an ability to get any messaging data without a warrant, but they don't want to say so.
The problem is abuse of that system.
Let's be clear There is no reason to assume that this type of thing is constrained to "just the type" the government can have their arm forced into admitting to.
> "... In a democratic country governed by the rule of law, indiscriminate spying on individuals cannot be allowed except with sufficient statutory safeguards, by following the procedure established by law under the Constitution ...
> We had made it clear to the learned Solicitor General on many occasions that we would not push the Respondent-Union of India to provide any information that may affect the national security concerns of the country. However, despite the repeated assurances and opportunities given, ultimately the Respondent-Union of India has placed on record what they call a "limited affidavit", which does not shed any light on their stand or provide any clarity as to the facts of the matter at hand.
> However, this does not mean that the State gets a free pass every time the spectre of "national security" is raised. National security cannot be the bugbear that the judiciary shies away from, by virtue of its mere mentioning. Although this Court should be circumspect in encroaching the domain of national security, no omnibus prohibition can be called for against judicial review.
> The Respondent-Union of India must necessarily plead and prove the facts which indicate that the information sought must be kept secret as their divulgence would affect national security concerns. They must justify the stand that they take before a Court. The mere invocation of national security by the State does not render the Court a mute spectator"
> ... We are not interested in knowing matters related to security or defence. We are only concerned to know whether Govt has used any method other than admissible under law ..."
Source: Supreme Court Constitutes Independent Expert Committee To Probe Pegasus Snooping Allegations - https://web.archive.org/web/20211029130706/https://www.livel...
PS: I didn’t notice the attachement. Yup, that’s _exactly_ what they send. Curious whether the suspect could recognise their creation date and know that they are being investigated that way--and whether that exposes Signal.
I read a good short story on the subject recently, "The Truth of Fact, the Truth of Feeling": https://en.wikipedia.org/wiki/The_Truth_of_Fact,_the_Truth_o...
I could be wrong but I was under the impression that the way end-to-end encryption worked (like what Signal claims, I thought) was it was physically impossible for them to decrypt (handover decrypted data (aka your messages) to a court of law) because the public/private keys are impossible to crack and also not known by Signal.
It sounds like this isn't the case whatsoever.
I don't really understand modern chat apps that talk about encryption. By no means am I a pro on the subject so I apologize in advance but... if you really don't want ANYBODY EVER snooping on your data network wise (unless they are holding one of the devices and reading the screen after it has been unlocked via passcode/biometric, etc.), can't you just tell your friend a key and exchange it offline and then communicate freely with no middleman? Or even, with a middleman... that is just transporting your data and doesn't know your agreed upon shared secret or keys.
How could a subpoena ever work against this kind of data?
Then there's IPs. If you log IPs along with when someone connects, then an IP can often be tracked to a WiFi router, which then pins your location.
Most E2EE communication protocols will see (and thus potentially log) the time and destination of every message you send. If two people have been accused of conspiring to commit a crime, this could be material in forming the case. They may also store your contact list, but a sufficiently long list of messages sent will practically determine your contact list anyways.
Even just the time of messages could be important; if someone interviewed claimed to be in the shower at a certain time, but there were logs of a message being sent at that time, that's probably enough for an obstruction of justice charge to stick.
I guess you mean each time you connected to their server to retrieve messages? There is no "login" step, Signal doesn't have a log in process. Presumably a typical Signal client calls several times per day.
The record they provided says connection date and despite being supplied in milliseconds since the epoch the value appears to indeed represent a whole day not a specific time. So you're correct Signal could be lying and actually store the exact moment you last connected, for whatever that's worth, and we could not prove they don't have that info.
> Most E2EE communication protocols will see (and thus potentially log) the time and destination of every message you send
Signal doesn't know who sent messages among close friends, and optionally not anybody who sent messages to a sensitive account.
Let's take the example of a message I sent to my friend Chris. I know Chris, I've sent messages to him previously and he knows me, so I'm in his contacts list. As a result by default my Signal client keeps some "Sealed Sender" tokens for Chris. When I send a message to Chris, my client uses a token it learned from a previous conversation with Chris, but Signal doesn't know who I am, just that I have a valid token for sending messages to Chris. So it stores the message, and gives it to Chris. Chris's client can determine that this is a message from me, tialaramex, but the Signal service never knew who sent the message.
If one day Chris hates me and blocks me from sending messages, his client invalidates all Sealed Sender tokens, and begins issuing new ones to his other friends so they can continue to contact him.
I am aware of this, and I had split my comment into "extra things Signal could log" and "Extra things most other E2EE services could log" but somehow lost the divider between the two during editing.
Also, "Impossible" is not the right term. "Extraordinarily expensive" is a better one. And yes, anyone can share public keys with each other offline and have end-to-end encrypted communication without help from a service. But advertising companies and the govt are not incentivized to make that practice convenient, and people typically do what is most convenient.
Issue a subpoenas for something they know they can't architecturally fulfill? I would imagine the government will get mad and shut them down, no?
can't you just tell your friend a key and exchange it offline and then communicate freely with no middleman
Yes, keywords are pubkey, fingerprint, diffie hellman. It’s easy to use, just run:
openssl genrsa -des3 -out private.pem 2048
openssl rsa -in private.pem -outform PEM -pubout -out public.pem
openssl rand -base64 32 > key.bin
openssl rsautl -encrypt -inkey id_rsa.pub.pem -pubin -in key.bin -out key.bin.enc
openssl enc -aes-256-cbc -salt -in message.txt -out message.enc -pass file:./key.bin
While you might forgive someone working for interior ministries, this is an automatism towards fearful stupidity. Benefits don't play are role here, it is exclusively about any potential security benefit, doesn't matter how small.
Sadly signal is based on phone numbers which I dislike, but other messengers should take note here.