Hacker News Reader

Comment by avg_dev | Hacker News Reader

i don't understand. i thought TLS or some other form of end-to-end encryption would prevent this sort of thing from happening. it seems like someone has access to the plaintext message other than the participants of the conversation.

how does this happen? (i am not a snapchat user)

not even to begin talking about the political ramifications...

View on HN

Snapchat texts are not end to end encrypted. I think we know exactly how that happens since Snowden. There won’t be political ramifications. Though this might be more tangible to the average users that don’t care about privacy.

But is there any claim that Snapchat automatically filters messages and alerts the UK security services?

Snapchat messages being surreptitiously downloaded and monitored by the NSA at some point where they are unencrypted (possibly only within Snapchat's datacenters) is consistent with what was revealed in Prism. I know that most companies have updated their standards to treat any network traffic as insecure since Prism but it's possible Snapchat doesn't.

Also as I understand it the NSA also has no legal issues with sharing any messages intercepted with the UK so long as one of the parties to the conversation is not a US national or on US soil.

Errr phones aren't safe. They are backdoored up the wazoo. Same with all your messaging companies. Any that are decent in size have had a visit from authorities and aren't allowed to disclose to you they have.

Iphones, android it doesn't matter. Your phones about the least safe tech device you own. It literally hacks itself if sent the right messages.

Edit: OK so it seems a fair few folks don't understand how spying across borders and things like the 5 eyes mean your tracked without a warrant legally.

So here's how it works. All 5 eyes countries are not allowed to spy on their own citizens in their countries without a warrant. All 5 eyes countries are allowed to surveil info about foreign individuals without a warrant. 5 eyes intel agencies basically just have to pipe a copy of local data say fb or in this case snapchat out via a friend in a another country then back to themselves and they don't need a warrant. As the data has now come from Intel sharing from your 5 eyes peers. The 5 eyes intel agencies between them all have deals and flex with just about every other intel agency in the world except the obvious few.

Intel sharing these days is as much as a treasure hunt for legal loopholes to get the data as it is hunting the data itself.

It literally hacks itself if sent the right messages.

can you think of any CCC presentations which explain this?

Its stuff like this. Phone recieves message, runs code embedded in msg for nfi reason why literally starting off the chain of events/exploits to hack yo device.

https://eugene.kaspersky.com/2023/06/01/a-matter-of-triangul...

We've had a few of these types of entry points in phones now over the years. Enough that if its still happening its probably by design as a favor to a 3 letter agency.

> as a favor to a 3 letter agency.

BBC ?

For that matter, you send something to someone as a joke. Maybe they think you're serious. Maybe they tell a friend. Maybe you sent it to the wrong person. Etc. Who knows what happens here.

> it seems like someone has access to the plaintext message other than the participants of the conversation

yea, everyone looking over your shoulder :)

The article somewhat suggests that the guy used the airport's wifi. In this case and assuming that the wifi network supports government surveillance by design, end-to-end encryption does not help.

That is simply not correct. With properly implemented E2EE, you can communicate confidently over a completely insecure channel. You could post the entire data stream publicly on the internet with no loss of privacy.

Sorry, to refine my comment: what typical B2C messengers and social media apps sell as end-to-end encryption does not help. Is this correct?

No?

What do you dislike about current E2EE?

I would still assume that with apps like Snapchat, there are inherent problems on meta-level (from an E2EE view) because for the users, Snapchat is essentially a trusted third party, providing governance/management features. But it can well be that Snapchat does not provide E2EE; I cannot see any remarks about it on their webpage.

However, on the WhatsApp webpage, you can find the E2EE hand-waving that I was alluding to: https://faq.whatsapp.com/820124435853543

"WhatsApp _considers_ chats with businesses that use the WhatsApp Business app or manage and store customer messages themselves to be end-to-end encrypted."

And later, they write that in many cases, Meta can actually read the messages.

The entire point of TLS (let alone E2EE!) is to make something like this particular scenario safe.

Reply on news.ycombinator.com