6mo ago

WhatsApp and Signal messages at risk of surveillance following EncroChat ruling, court hears | Computer Weekly

www.computerweekly.com WhatsApp and Signal messages at risk of surveillance following EncroChat ruling, court hears | Computer Weekly

Police could lawfully use bulk surveillance techniques to access messages from encrypted communications platforms such as WhatsApp and Signal, following a ruling by the UK’s Investigatory Powers Tribunal (IPT), a court has heard.

Technology @lemmy.world

www.computerweekly.com /news/366596534/WhatsApp-and-Signal-messages-at-risk-of-surveillance-following-EncroChat-ruling-court-hears

180 19

51 comments

Stop promoting "just trust me bro software" in the same title.
Anti-libre software, WhatsApp, bans us from proving its E2EE claims, any claims. It bans us from forking its source code, removing backdoors. It fails to include a libre software license text file, like AGPL, so they control it, not us. WhatsApp, anti-libre software, is a scam.

Wonder how they'd manage that as they both are E2EE.
- A French and Dutch Joint Investigation Team (JIT) harvested more than 115 million supposedly encrypted messages from an estimated 60,000 users of EncroChat phones after infecting the handsets with a software “implant”.
  Looks like they just hack the phone
  
  https://en.m.wikipedia.org/wiki/EncroChat
  So this sounds like the ANOM phone story with extra steps?
  I get that they can "access" messages, but the headline feels misleading if it requires full access to the device.
  It's not that they're breaking encryption or reading messages in transit, it's more like they're installing malware on specific devices so that they can look at your screen?
  
  How does one get an "implant" onto a phone?
- Apparently what happened is that French police installed some of malware on the phones to read the messages, and this was now decided to be legal in the UK.
  
  Damn, we'll need those linux phones working soon.
- Honestly mentioning Enchrochat together with other mainstream message clients is kind of misleading. The Enchrochat message client was also E2EE. However Enchrochat was also a company that sold their own mobile phones with a prorietary OS on it together with own sim cards and only those phones were able to connect to each other. And law enforcment had enough evidence that they sold those hardware in shady untracable ways similar to drugs. At that point there was no western government that didn't want to help seizing their infrastructure and taking over their update services for example.
  The bigger problem however for the general public is that certain politicians want to break encryption all together by forcing companies to implement backdoors on client side. This has been an ongoing discussion for 2 years in EU parliament and it has to stop: https://www.eff.org/deeplinks/2024/06/now-eu-council-should-finally-understand-no-one-wants-chat-control
  
  And law enforcment had enough evidence that they sold those hardware in shady untracable ways similar to drugs
  It doesn't matter. Using that phone or app cannot possibly be anywhere close to probable cause for a search.
- With a warrant they could probably force signal/whatsapp to inject Malware into their apps to spy on users.
  Don't know how possible it is with signal and their reproducible builds. They would need to add this to the source code of the app.
  
  Could they though, I thought signal would just leave the market
- Especially with Signal being open source. What stops the official Signal company from advertising another fork?
  
  "Gruyere Signal"
  
  The server software is not open source.

Can someone explain how this is even possible with a service like Signal? I was under the impression that encrypted messages can't be intercepted.
Extremely frustrating either way, I hate constantly having to manage different messaging services with different people and I'd really like to not have to add one more if signal becomes compromised.
- It’s all client side. It even mentions infected clients.
- Anything on the signal protocol could have an infected cilent be delivered, or backdoor server side by providing the wrong keys.
  Facebook might comply. Would guess that Signal would refuse and would be hit by some absurd fee like 100mil a day for not complying and be forced to pull their services out of the UK.

51 comments