Encrypted WhatsApp Message Recovered From Westminster Terrorist's Phone (indiatimes.com) 143
Bruce66423 brings word that a terrorist's WhatsApp message has been decrypted "using techniques that 'cannot be disclosed for security reasons', though 'sources said they now have the technical expertise to repeat the process in future.'" The Economic Times reports:
U.K. security services have managed to decode the last message sent out by Khalid Masood before he rammed his high-speed car into pedestrians on Westminster Bridge and stabbed to death a police officer at the gates of Parliament on March 22. The access to Masood's message was achieved by what has been described by security sources as a use of "human and technical intelligence"...
The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."
The issue of WhatsApp's encrypted service, which is closed to anyone besides the sender and recipient, had come under criticism soon after the attack. "It's completely unacceptable. There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
Security sources say the message showed the victim's motive was military action in Muslim countries, while the article adds that though ISIS claimed responsibility for the attack, "no evidence has emerged to back this up."
Bullshit. (Score:5, Insightful)
The claim is dubious. Why would they inform all the Terrorists that they can decrypt WhatsApp with ease? They wouldn't. The reason for the "disclosure" is to influence Terrorists to use some other - perhaps less secure - means of communication because they CAN NOT decrypt WhatsApp.
Re:Bullshit. (Score:5, Interesting)
It's possible that they didn't actually decrypt anything and, instead, managed to get into the phone. If the terrorist didn't secure his phone, then whatsapp could easily be opened and messages read. They had access to his phone, that was stated in the article.
Re: (Score:3)
That. Or simply retrieved the content from some temporary file/cache/whatever Whatsapp uses. Another possibility is that they simply got the content from whoever the message was sent to - which would explain the "human intelligence" (aka interrogating someone) part.
Re:Bullshit. (Score:5, Informative)
Lookup information on Open Whisper end-to-end encryption, which is what WhatsApp uses. You will see that the whole point of the system is to prevent police from "simply" doing what you have said. There are no unencrypted temporary files, caches, etc.
Getting the contents from the recipient is a valid possibility however without defeating the technology.
Re:Bullshit. (Score:5, Insightful)
Re:Bullshit. (Score:4, Insightful)
Why do you trust open source apps? No really, do you read all the code and then compile it yourself?
Just because something leaves an audit trail doesn't make it impervious to fraud.
Re:Bullshit. (Score:4, Insightful)
>"Why do you trust open source apps? No really, do you read all the code and then compile it yourself?"
At least it is POSSIBLE. With closed source, it is absolutely impossible for the end user to know what the program is doing. It means watchdog organizations can audit it and anyone can verify it. I don't look at much of my open source code, but you can bet someone is, and all it takes is one person to blow the whistle. And someone can compile it and compare the hashsum on distributed binaries to ensure it hasn't been tampered with downstream.
Re: (Score:2)
For Android apps you can run it through a decompiler and check, although that is a lot more work.
Re: (Score:2)
At least it is POSSIBLE. With closed source, it is absolutely impossible for the end user to know what the program is doing.
Double bullshit. For example, with Apple's iMessage it would be absolutely possible to detect if Apple was performing a MitM attack instead of just encrypting the sender's message with the receiver's public key.
Re: (Score:1)
How do you verify that iMessage is not sending your message to both the intended sender and someone else? How do you check whether the public key the message has been encrypted to is actually that one of your contact's? Oh, you trust the information that iMessage gives you...
Re: (Score:3)
At least it is POSSIBLE.
No it's not. For all but a tiny handful of people auditing the source is not possible as they lack the requisite skill or funding to get it done. How many open source programs out there actively get audited? And no, someone looking contributing to the code is not an audit. Many eyes are able to glaze over even the most simple of bugs.
but you can bet someone is
A bet that has been proven false over and over again in the past 5 years. From huge bugs discovered in very widely used software, to distrust in security software in general. W
Re:Bullshit. (Score:4, Interesting)
In the case of Signal, I do build it myself from source because I want to make some changes, like adding a decent backup function that Moxie won't do in Signal for some reason he doesn't want to explain. But apart from that, they have reprodcable builds so you can check a self compiled version is the same as the one you download (except for the signature of course).
Re: (Score:2)
Did you audit the code base line for line as you went?
The point is that few people have the technical ability to do that. Even fewer would catch underhanded code. e.g. Truecrypt. Not a massively complicated program yet took a team 2 years to actually audit.
You can trust open source a bit more than closed source in that you can be sure actively underhanded backdoors are likely to be marginally obfuscated, and that's about it.
Re: (Score:2)
No really, do you read all the code and then compile it yourself?
Thats what I would do if I had a particular need for security. But its really hard to do. Software I control on top of a kernel I don't control is no real help to me. I am seriously thinking about a micro controller solution.
Re: (Score:1)
Are you the same guys who added NSA modules into the Linux kernel? Because I would like to here more about your audit process on that.
https://en.wikipedia.org/wiki/Security-Enhanced_Linux
Re: (Score:2)
I know that this is a novel concept in this day and age, but some of us are still capable of understanding that closed source doesn't prevent reverse engineering of the product, it merely makes it harder.
Something being closed source doesn't mean it's a closed book, that's why we've had everything from DVD Jon to hacked Playstations over the years.
Re: Bullshit. (Score:1)
Re: (Score:2)
True. Open Whisper apparently partnered with WhatsApp on the implementation though. Other than the dubious decision regarding handling of key changes, there hasn't been any discussion of problems in the implementation of WhatsApp for end-to-end encryption. So this new finding is troubling!
Re: (Score:2)
However, WhatsApp tries to persuade you to make an unencrypted backup in the Google cloud if you run Android. And it won't take no for an answer, after refusing it tries again after some time.
Re: (Score:2)
Oh, so that's not just me? I always wondered why sometimes I would open WhatsApp and it was on the backup settings page. I always figured I had fat fingered it. ANNOYING!
Re:Bullshit. (Score:5, Interesting)
The BBC reported that they simply got it from the phone of the recipient (which they knew from metadata) who cooperated with them. That person was innocent and uninvolved in the attack so simply gave them the message in plain text.
Sorry no link, the BBC search engine is crap.
Re: (Score:1)
What puzzles me is why they didn't get it from Khalid Masood's phone. Unless he deleted the log, the message he sent is sitting on there.
Re: (Score:2)
What puzzles me is why they didn't get it from Khalid Masood's phone. Unless he deleted the log, the message he sent is sitting on there.
Allegedly, WhatsApp does not keep local files.
However unless he actually logged out of the app, they would have been able to retrieve it from the server.
Re: (Score:2)
My first suspicion too.
Re: (Score:2)
WTF Open Whisper?
Re: (Score:2)
At least their Signal does not allow Google to make a backup in the cloud. Unfortunately thet means you can't backup it yourself unless you've rooted your device or run a version that includes a decent backup (the standard backup does only the simple text messages).
Re:Bullshit. (Score:4, Interesting)
Re: (Score:3)
Accessing WhatsApp messages on a phone is easy when you have access to the device, even if it's locked (but not encrypted). Or they managed to get access to the unencrypted backup WhatsApp wants to make on Google Drive if you allow it (and have a Google account active on the phone). Assuming it was Android, I don't know how well that works with Apple.
Re: Bullshit. (Score:2)
Of which, none capture video of abuse of power by police.
Re: Bullshit. (Score:2, Insightful)
"Using a chat program to hide " doesn't even make logical sense.
Re: (Score:3)
"Using a chat program to hide " doesn't even make logical sense.
It does if the chat program using public key encryption [wikipedia.org] between the users. In that case even the mediating servers don't have access to message contents.
The scheme is flawless -- but then it almost always is unless it's devised by a total ignoramus. What they get you on is implementation.
Re: Bullshit. (Score:4, Interesting)
Tell that to the idiots using the forgotten social messaging app Whisper, which has nothing to do with the Whisper protocol or Whatsapp.
Nope, it's just a sort of Twitter clone that pretends to be anonymous, and tons of idiots fall for it and post for sale or want to buy messages for "contraband substances" as if nobody can trace them.
The app records the user's IP address, the IMEI of their phone, their GPS (which it uses to set a "nearby messages" group feature), their phone number, and none of this is encrypted in any way AND the developers proudly declare in the TOS that they will happily respond to any requests from law enforcement. The app also inserts ads from the Facebook network so anything you look at on FB may in turn spawn "related" ads in the app. So not only does the app know who you are, we can presume FB in turn knows a lot about which ads are seen when and perhaps even which content the user was looking at.
So it is completely NOT anonymous. And yet idiot users post their messages every day. I had NO idea there were even so many different words for pot.
The app has other major issues, such as a general lack of users -potheads and gays seeking gays seem to be the main users, but they don't add up to very many. So the developer hires workers to make fake posts, uses bots to repost and repost the same messages day after day after day, all in a bid to fake the place into looking like people use it. A lot of the Indian contractors don't even bother to hide that they are posting from Indian call centers.
The app also has a "Popular Posts" feature which presents those items when users first open the app. But what determines what is "popular" is not popularity but the whimsy of one of those Indian workers who decides to promote a particular post to the Popular page, which then gets a lot of views and so forth. So they are manufacturing popularity, not seeking what is naturally popular. It's fraud. The anonymity is fraud.
But very few users bother with this thing and nobody would really notice if it blew away.
Re:Bullshit. (Score:5, Insightful)
This isn't a fucking TV drama, it is more important to get the psychological leverage over the terrorist groups who are reminded they can't use tech to hide. It is also more important to remind the public that terrorists can't do that.
no it isn't. If anything the past experience with government agencies is that they'll exploit the heck out of security holes they can find and use that to get whomever they want to get. Heck that was the whole point of Snowden. There's no incentive or historical trend of governmental agencies effectively shouting out that they've found a way to see through the door. Instead they keep looking through the door gathering and using intelligence until someone notices.
at best this suggests that "Oh we're so strong we cracked WhatsApp" but it does so completely at the cost of their loophole. It's a silly stunt that's only effective if they have a backup in place.
Re:Bullshit. (Score:5, Insightful)
It's ironic that, if this kind of encryption existed during the US revolutionary war, the King of England would have outlawed it, and therefore the Founding Fathers would have included it as a right in the First Amendment. Government is the problem in the long run, the bigger picture, regardless of any short-term benefits.
Re:Bullshit. (Score:5, Insightful)
Indeed, every time some politician in the West decries encryption for some teeny-tiny, transitory problem like terrorism, billions around the world's hearts sink a little more into despair as their governments break encryption using the same techniques precisely to catch political opposition.
Says the oppressed in China, Russia, Turkey, "Well, our nightmare continues but damn, we are glad you wern't hampered too much gleaning a useless iota of information on that guy who is one trillionth the plague on your society our governments are on ours."
Re: (Score:1)
Re: (Score:2)
While your reasoning as it applies to terrorists is impeccable, there are other applications for an exploit that a state might want to keep secret. And then people at a political level aren't always that sophisticated; they may know spy dramas better than game theory.
Re:Bullshit. (Score:4, Interesting)
Re:Bullshit. (Score:4, Insightful)
The terrorist groups don't hide behind tech, they broadcast it out in the open.
What a load of garbage. Terrorist groups most definitely do hide behind tech and generally do so quite well. What they do out in the open is lay claim their successful attack.
Re: (Score:2)
That't what they want you to think. (Score:2)
They want you to think that they think they can trick you to using what's app by saying they can decrypt it when they can so that you will think they are saying they can decrypt it so you will think they can't because they are saying they can.. And yes that also makes no sense, just like your post.
Re: (Score:2)
Or alternatively, a moron politician that cannot be punished for an exceptionally stupid mistake was told by accident and then thought it was a good idea to tell the whole world. But outside of that, giving away a valuable source like the ability to decrypt WhatsApp is not likely to happen, I completely agree. The only other reason I see is because that ability was already about to become public.
Re:Bullshit. (Score:5, Insightful)
WhatsApp is owned by Facebook. It's encryption is a joke when the right people are asked nicely, hence the "using techniques that 'cannot be disclosed for security reasons.' What they mean is they can't tell you how they did it because it would look REALLY bad if people realized how stupid it is to put your faith in a company that specializes in profiling and biometric data collection; https://www.whatsapp.com/faq/g... [whatsapp.com]. If you're using WhatsApp on Google anything (Android, Chrome, etc.), you're in even worse shape because it's Google for Christ's sake. Remember Dirty COW? Google waited until after the election to fix it while every other Linux-based OS did months ahead of them.
But anyway, Facebook also invests huge amounts of money into cloud computing and AI. That combination one day will make all encryption and anonymity useless because we will all be digitally fingerprinted whether you have an account or not, especially if quantum computing advances, and you can assume your government will get a copy, just like they get copies of your DNA when you fall for the "fun and easy" TV advertised "ancestry" services. This "profile" is going to replace social security numbers. If you want real encryption (at least for now), use Signal (similar to Telegram but better) or a Tox client (similar to OpenVPN but for messaging). More importantly, use your brain. Both are free and open source and support text, talk, video, and file sharing. I would never use anything that important that I couldn't look at the code for. If you could look at WhatsApp's source code, I think security researchers would be horrified. And, Facebook gets caught spying on their mobile app all the time, so I don't see how WhatsApp would be any different. And just because a lot of people use it, doesn't make it the best. Matter of fact, that would make more of a target.
Some of the above links are kind of old, but note the ISP one. Legally, your internet service provider in the U.S. can sell your browsing information. Because of this, intelligence agencies can just purchase your data for cheap rather than getting a warrant and paying a government employee to waste their time. I'm mentioning ISP because Facebook has been trying for over a year now to bring the Internet to all kinds of places. They would become an "Internet Service Provider." In any case, if the app has an advertisement, you can be tracked.
The real note to take away from this is to realize data can be created and never destroyed and don't put anything on the internet you don't want found. I wish people would realize privacy settings are a joke; they only protect you from the average person. Anytime you see "convenient" or "secure" for a service, just assume it's complete BS because your government doesn't have the time or resources to actually physically search and seize everyone so they have software for it, contrary to "Martial Law" conspiracies; cloud computing makes it easier.
And since this news regarding terrorism, do you know why it was so hard to find Osama? It's because so far as we know, the most technologically advanced thing he ever personally used was a kidney dialysis machine or the Cold War weapons the U.S. gave him. The wor
Re: (Score:2)
Whoa. Way to completely miss the point. Facebook messenger and WhatsApp are completely different apps. WhatsApp is using the Signal protocol which is pretty much the best there is at the moment. All the messages and calls are end-to-end encrypted with the kind of crypto nerds used to only dream about. Mass surveillance is not possible (even for Facebook) with WhatsApp, because the attacker would need to do a MitM attack on all the discussions, which is easily detectable. Another option is to install malware
Re: (Score:2)
Re: (Score:2)
I do, but most of my friends don't. Pretty much everyone has whatsapp these days though.
WhatsApp is not a privacy app. It's a messaging app which also happens to have a hard core crypto implementation under the hood. That's a huge win for normal people who think they don't have anything to hide and don't know or care about encryption. They still have all their messages end-to-end encrypted and they don't have to do anything about it.
Re: (Score:3)
A fancy new app everyone is talking about, that nice GUI, local language support, readable fonts, lawyers and statements about protecting all users rights. Vast funding that never stops.
It's like buying crypto for an embassy or company in the 1950-80's. So many private sector options for a nation, gov or company to select from. Go with US, UK, NATO quality to keep the Soviet Union out?. Something from
Human and tech intel? (Score:2)
Re: (Score:2)
Can be a lot of other things, including plain old misdirection. For example, the phone may have been compromised long before.
idiot (Score:5, Insightful)
It is completely unacceptable that history majors like Amber Rudd, who evidently has not the slightest understanding of technology, end up in positions like Home Secretary. or "Secretary of State for Energy and Climate Change". Rudd seems to be an object lesson in how money and political connections trump competency and skill.
Re:idiot (Score:4, Interesting)
Indeed. The whole statement is so utterly stupid and disconnected from reality _and_ misses what states that tried to get where she wants to go were like (Stalinism, 3rd Reich, etc.) that she cannot be any good at understanding history either. So they have a _bad_ history major as Home Secretary.
Re: (Score:3, Insightful)
OK, let's play with Rudd's statement for a little while. Since any weakening of internet security applies to everyone who uses the internet, not just the people Rudd would like it to affect, how substituting the keyword "terrorist" for something else and see how it sounds then?
"It's completely unacceptable. There should be no place for [PLACEHOLDER] to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for [PLACEHOLDER] to communicate with each other,"
Investment bankers? Grassroots political organisers? MI5 and MI6 agents? Any more ideas?
Encrypt Everything! (Score:5, Insightful)
Re: Encrypt Everything! (Score:1)
Why.
I'm still waiting on an answer to why folk think A) that they NEED to encrypt everything.
B) what are you up to that you think you NEED to encrypt anything.
C) that there are nearly always methods for getting at data before or after encryption.
D) you don't think folk like yourself are the ones the spooks will spend resources on to answer the above questions.
Me,I don't give a toss if the authorities realy want to know what I'm up to,they will find out one way or the other,I've been under almost constant wa
Re: (Score:2, Insightful)
Since you asked...
A. I don't. But the more of my data that is encrypted, the less noticeable data that I critically need to be encrypted will be to would-be eavesdroppers. No sense in drawing any further attention to the occasions when I really do require it. Plus if I am always using it, then I don't have to especially remember to do anything out of the ordinary when I do actually need it.
B. Anything that requires some security against malicious eavesdroppers who might use the information to cause
Re: (Score:1)
Different AC.
A. Because we believe the government, (or anyone else for that matter), has no business monitoring every little thing we do, regardless of the reason. If the government wants to monitor us, prove to a judge that we may have done something illegal and get a warrant. It's basic due process, one of the things promised to us by the U.S. Constitution and the Bill of Rights as citizens. For everyone else, too bad get over it and find something else to do other than attempting to frame others so you c
Re: Encrypt Everything! (Score:1)
Because the spectre of terrorism (in the media) exists for precisely this reason.
Re: Encrypt Everything! (Score:2)
Template email sent when switching mobile providers.
Re: Encrypt Everything! (Score:1)
Huh? crooks in brazil do this all the time (Score:5, Interesting)
(OBNOTE: they might have done something far different, but this is one way it could be done -- and it is being done in Brazil):
1. Clone the victim's phone line (not chip, not iemsi, you just need to reassign its phoneline. Costs about US$100 in Brazil to get a sleazy, disgruntled phone-company-cellphone-outlet employee to do it for you).
2. Using the rogue SIM that has the victims' phone number active for a while, install whatsup. Do the SMS verification, it will pass. And yes, that *does* mean you could use the same !@#$@#$ trick to invade banking accounts, steal accounts with SMS verification enabled, etc. Say, like google, microsoft, or DNS registrar (and from there, anything else, such as US$ 200k-worth twitter identities, etc).
==> IT IS NO JOKE that the newest US gov regulations *strongly recommends against* (read: FORBID) the use of anything phone-carrier-routed (SMS, voice, phone number, etc) for security id/validation.
3. Whatsup will download the message history and contacts database, and you have access to the information.
Now, if the target is not an imbecile, he has whatsup 2FA enabled. That means step (2) is a lot more difficult, *but not impossible*. Here's where human intelligence can help, phone hacking can help, and even a court order for whatsup to NOT nuke the account no matter how many failed tries (assuming this does not run afoul of whatever protections did not allow them to order whatsup to shell out the history directly) can help.
IOW: have you removed the insanely dangerous "phone-number-based" recovery options of every account you treasure? If you did not, you better do now. It is quite possible to add defensive layers to SMS-based and voice-based recovery options, but all of them are of the "force several successful attempts over a *large* period of time, with random factors involved" so that the victim will notice what is happening, recover his phone number, and engage defensive measures. NOBODY implements this.
Re: (Score:3)
As for police, they simply ask the telco to tee pipe SMS to them, or
Re: (Score:1)
"==> IT IS NO JOKE that the newest US gov regulations *strongly recommends against* (read: FORBID) the use of anything phone-carrier-routed (SMS, voice, phone number, etc) for security id/validation."
Tell that to google, it's constantly asking me to put in a phone # for recovery... Never mind I don't even have one but yes it would be stupid to use this for security
Embarrassing typo (Score:3)
Re: (Score:2)
LOL! Maybe the meant the victim of the hacking. :-D
If there's no place for terrorists to hide (Score:5, Insightful)
If there's no place for terrorists to hide then there's no place for *anyone* to hide, and that is unacceptable considering how valuable it is to hide from oppression or the abusers of the system used to ensure there are no hiding spots, those who operate the system are disproportionately advantaged and with access comes the capability of concealing themselves, censoring, framing content and concealing context, etc.
This idea is ridiculous and imbalanced off the bat.
Re: (Score:1)
There is a very, very small chance that you'll ever encounter, let alone be killed by, a terrorist.
There is a huge chance that people like Amber Rudd will intrude on and screw up your lives if they are left unchecked to carry out their statist power grabs.
Terrorists are relatively easy to deal with, if one has the courage to simply not let terrorists into one's territory. Power grabbing cop-worshipping statists on the other hand are a purely domestic problem in pretty much every country, but they need deal
Re:If there's no place for terrorists to hide (Score:4, Interesting)
Indeed. Terrorists you can typically just ignore with no significant adverse consequences. Fascist politicians are a lot harder to deal with.
Re: (Score:2, Insightful)
Alternatively, she just asked knowingly for full-blown Fascism. I really would not rule that out anymore. George Orwell seems to have had the number of the British political class.
Re: (Score:2)
As far as I can tell, Amber Rudd is trying to force her policy through by appealing to emotions and fear. She is willing to use the act of violence (admittedly, somebody else took care of the dirty work for her) to further her agenda. Now, isn't that the very definition of a terrorist?
Then again, perhaps it's a moot point. The word "terrorist" has lost most of its meaning, and simply means enemy or opponent by now. So you could call her an enemy of the people, I suppose. That goes for a lot of people in pow
Re: (Score:2)
As a Brit: annoyingly, she's not the only one of our leaders who has no idea about technology. This probably won't be the last time they try to screw with the nuts and bolts of modern technology.
We also had that stupid cookie law. [silktide.com] Rather than ruling that, say, e-commerce sites be required to provide the option to delete your credit-card details on request (something websites still aren't required to do), they forced websites to show a warning if they used cookies. Perhaps in some alternate universe, people
Android (Score:1)
'nuff said
riddled with security weaknesses you could drive a truck through
Re: Android (Score:1)
And apparently, open ports.
xD
Original article: (Score:5, Informative)
Here's the original article [independent.co.uk] that this is all based on.
The police did what I would want them to do (Score:3)
They had a specifically targeted phone, they used "human and technical intelligence" to get into it. No broad request (specifically from them, anyway, in this case) to compromise everyone else's personal privacy and financial security in pursuit of their goal.
On the face of it, at least, this seems to be what I would want them to do.
Re: (Score:2)
As pointed out above, and what I suspected already, most likely there is no encryption broken: they asked the recipient (one of the suspect's contacts) nicely, and recipient simply gave them the message. A much more likely scenario than breaking the encryption of a single message that happens to be of utmost importance.
I for one mostly trust WhatsApp to put effort in working encryption. Why? It's their selling point, and the moment it's shown they're giving their messages to the NSA or whatnot it's on to th
Not suprising (Score:3)
Re: (Score:2)
What's your alternative? An open source messaging app that no one uses and therefore can't be used to send messages at all to anyone?
Even if I could convince people to use it, who has audited the code? That's beyond my capability. How do I know the compiled result I downloaded from an app store is the same as the compiled result from the code, I can't MD5 the app store. How do I know the compiled binaries published by the programmer actually represent the original code that is currently under review?
If you
Stop using "encrypted" apps on proprietary phones (Score:3, Interesting)
In the US anyway, freedom is worth dying for. The best way to fuck the terrorists is to show them that they can't change anything about our social norms. As far as I'm concerned, Whatsapp should be considered an in-the-clear messenger which is only "encrypted" because the government happens not care about the sender at this particular moment. What this sort of "pretend encryption" approach does is let the terrorists know that we're willing to give up our core values so they won't kill anymore of us. Heck, why stop there? We all might as well convert to their perverted brand of Islam. Of course, this is all misguided because eventually they'll find out how to do more damage, encryption or not. Which means we'll still have terror attacks a century from now, but what we won't have is private messaging.
What do we need in order to reclaim the freedom that our ancestors (in America, at least) literally died for? Open source everything, from the circuit diagrams in our chips all the way to the app layer. Is this happening? I hope I'm just ignorant, but the answer would seem to be "no". There's no "real money" in open source anything, and things are getting exponentially more complicated with time. So maybe there's something to be said for building a truly dumb "combox" for private messaging and nothing else, which actually could make money for the people behind it, and therefore be economically viable. Does anyone know of anything like this? And no, I'm not talking about some "brilliant" encryption app running on top of swiss cheese dogshit like Android.
Impossibility of access (Score:3)
Before encrypted electronic communications, criminals and terrorists had to use things like in-person meetings or unsecure communications methods (like analog telephony) to communicate. These were obviously vulnerable to being listened to for a determined party, but that was simply how it was, there was no other option. Law enforcement could use various human-powered means to target specific individuals or organizations, like tapping a particular phone line and having a human listen to it when it went active, or maybe stake out a particular meeting place with some high-power microphones. For the general non-criminal population, while it was technically possible for the government to listen to everyone all the time, it was realistically impractical because of the vast amount of manpower it would require.
Today we're in the opposite situation. Law enforcement can now get ahold of all electronic communications through various taps, but if criminals and terrorists use the proper technology and best practices, it is *impossible* for law enforcement to know what is being said. (Yes, deep-cover operatives are still possible but are impractical for all but the absolute highest-priority things for reasons of time, risk, and the same old manpower problem).
I don't have a great answer. Anything is either too insecure or seems too vulnerable to corruption. The only thing I've come up with is third-party escrow of encryption keys, but who is the third party and how do we know they aren't corrupt?
Data at rest (Score:1)
Hardly news, whatsapp is proven broken (Score:1)
"A secret place for terrorists to communicate" (Score:2)
I know a sure-fire legal way to ensure apps like this don't allow terrorists to communicate:
When you install it, it will ask, "Are you a terrorist? [Y/N]"
You're welcome.
Can also be read like... (Score:2)
There should be no place for terrorists to hide. We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other," U.K. home secretary Amber Rudd had said.
This can also be read by replacing "terrorists" with "government" with respect to harming the people they are supposed to be representing. Because naturally neither EVER lies to us nor do they have secret communications that only they are privy.
The WhatsApp exploit revealed on BBC Radio (Score:3)
Clearly our Home Secretary Amber Rudd has now found some people who "understand the necessary hashtags": http://mashable.com/2017/03/27... [mashable.com]
No place to hide (Score:2)
If there's no place for terrorists to hide then there's no place for anyone to hide.
Hmm (Score:2)
Re:The Liberals' war on vaginas (Score:5, Funny)
I am personally insulted by the ineptitude of this troll. Please try again. This time with feeling.
Re: (Score:2)
Naa, that would be the obvious explanation. Too simple and plausible.