cross-posted from : https://lemmy.zip/post/71321898
Netzpoltik details that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance
Interesting they highlight Signal again as though this is a vulnerability.
If someone else has access to a linked device… that’s you fucking up access controls.
I want a version of Signal that doesn’t allow linked devices. Linking devices is a clear vulnerability.
Im going to go out on a limb here and suggest something that should be obvious - you don’t have to link devices
But “Law enforcement” can do it by spoofing sms. I want one account, one device.
Signal does not use SMS.
The vulnerability they call out in the article is a phishing attack. A phishing attack requires the user’s input. There is no defense, no security, no techniques or technology to prevent you from handing the key to your safe to someone else.
It’s a vulnerability precisely because people always swarm to defend Signal in stories like this, as though using Signal means the authorities can’t read your messages. Seems like every six months there’s some story involving Signal users getting hacked, and every time there’s a rush of wellacshuallys explaining why it wasn’t really Signal’s fault. (that last one is particularly egregious because I remember people defending it as “it wasn’t Signal, it was their partner who they subcontracted and gave your personal data to”, which is crazy levels of mental gymnastics.)
Security is more than just encryption. If you flag something up as “hey use this if you want to hide from the Government” and have a personal phone number attached to it, that’s like a red rag to a bull.
Why are you lying about what security guarantees Signal say they offer?
Nobody who understands the topic thinks this.
Signal exists to prevent the contents from being read off the wire and from having the capability of compelling Signal’s parent company from turning over stored messages.
It doesn’t exist to hand hold you so you don’t get phished, or prevent you from running it on a vendor phone full of spyware. You’re responsible for making sure your hardware is secure and that you’re not socially engineered.
Yes, and articles like this are important so people who DON’T understand don’t think this.
You don’t think the tens of millions of people who use signal all understand that just because everyone says it’s super secure, doesn’t mean they can’t be hacked or phished, right?
They even inform you in the app about spying vectors like keyboard apps…
https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard
Yeah most people click through warnings like that lol
IT DOESN’T ADVERTISE ITSELF AS A SECURE PLATFORM!!!
It says PRIVACY. If you are dancing ass naked inside your house but you have your windows open… guess what?
A lot of these types use ‘perfect being the enemy of good’ as their attack vector. If it’s not private and anonymous why bother? If you can’t cut out all big tech companies, if you can’t stop buying any American goods, if you can’t feed all the poor or house all the homeless, etc. It’s an effective way to attack progression by making people believe they should just stop fighting, they’ll never win. You nailed it, Signal is private, it doesn’t claim to be anything else.
You just pointed something out there that I haven’t really considered. But its also the difference between abolitionists and reformists too- namely, abolition should be the goal, but don’t let that stop you from making reforms too.
lol, the block caps three exclamation marks aren’t doing much to dispel the “rabid fanboi” image of Signal supporters
A rabid fan of a message application? Just for trying to point out that if the police get your unlocked phone then they have compromised your messages?