• 1 Post
  • 36 Comments
Joined 3 years ago
cake
Cake day: July 6th, 2023

help-circle


  • Fwiw: signal is a honey pot, perhaps not by intent but by architecture.

    Security postures are driven by capabilities not intentions.

    Signal:

    • centralized
    • uses centralized push notifications
    • stores encryption keys in the cloud SVR

    Thus a three letter agency has the capability of breaking signal, even if they don’t intend to.

    As a thought experiment imagine you run the intelligence service of a non-us ally country (nk, Iran, China, Russia, etc) - would you in good faith recommend using signal, as is, for your classified and sensitive government communications?

    how to break signal

    SVR stores master key backed by a trivial pin, but uses Intel sgx enclaves to prevent brute forcing… a TLA just gets Intel to sign new code for the sgx enclave that allows brute forcing, runs it against the cloud data extracts master keys, and ta da all communication revealed.

    Signal allows people to store their master key using a random bip32 key, but even if you do this, none of your contacts will do this