mfs be like ‘don’t use xmpp omemo is insecure’ and then you learn about how the FBI gets people are it’s literally just an informant who takes screenshots on their phone
Timeline
Post
Remote status
Context
1
@ug Wait until you learn about how the US military identified targets for drone strike in Iraq and Afghanistan!
Replies
15@scathach how’s that?
@ug Was almost entirely based on social graphs; person A is a known Taliban leader, people B, C, and D regularly interact with him so let's kill them. "Interact" here could mean anything from frequent text messages picked up by local cell infrastructure or sniffed by predator drones to a drone footage of them in physical proximity
Contents of messages didn't matter at all
Contents of messages didn't matter at all
@scathach yeah that ‘we kill people with meta data’ shit
don’t tell signal stans this
@ug Ironically Signal is one of the only protocols that is even a little bit resistant to social graph attacks
It's definitely possibly for Signal to work around sealed-sender by analyzing the timing of traffic between various IP addresses over time to build a rough social graph but that's a lot more difficult to build and there's a lot less information available than, say centralized OMEMO XMPP like what WhatsApp is based on
(It should go without saying that Signal is doing exactly that and that their insistence on requiring phone numbers is in a large part an attempt at linking real-world data to those rough social graphs)
@ug @mia P2P protocols are more resistant to social graph and timing analysis in the practical sense that the data is usually scattered across loads of servers with different owners but on a protocol level (assuming a hostile actor can slurp data down from the entire network) they're equally vulnerable
beyond the kind of wide net that the NSA etc. are able to cast and the definite reality that Signal traffick is highly scrutinized by them… a thing about signal evangelists that drives me up the wall is in the end we have to just trust that signal does what they say, and assume that there isn’t some kind of deep level infiltration by feds.
and you bring this up and they’re elike ‘that’s crazy, why would the federal government do such a thing?” like of course they would do that, were you born yesterday?
@scathach @ug @mia they hosted on AWS because AWS had instances with decent (for the time) secure enclave key management. Since then the first revision of the AWS secure enclave has been pwned and key recovered, so probably already pwned by the feds at that time. v2 is in deployment for Signal now.
Don't read this as a defense of Signal or AWS, but that's why they were using it.
Don't read this as a defense of Signal or AWS, but that's why they were using it.