Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption clients. In addition, popular apps, especially in the US, can always be commandeered by 3-letter agencies.

You're only anonymous as long as you're not actively targetted, despite using "secure" apps and stuff like Tor, which media makes it seem are unbreakable.



Not quite. They were using an app developed by the police as a honeypot. Someone else had even discovered this and blogged about it[0]. If they had used email and PGP they likely wouldn't have been caught in this way. 3-letter agencies are not going to use their trump card of backdoored OS or hardware to catch drug runners.

[0]https://webcache.googleusercontent.com/search?q=cache:PwQXt6...


True.. however the three letter agencies are going to pass along any relevant information that they stumble across while filtering for money laundering in relation to terrorism.

[0] https://en.wikipedia.org/wiki/Parallel_construction?wprov=sf...


If they used email and PGP, they wouldn't have been caught this way...

That is because the usability of PGP is so bad, they wouldn't have any time to actually operate their criminal enterprise.

Also - email, PGP or not, leaks metadata, and the police will happily end your whole criminal career based on metadata.


> Your hardware has backdoors, so does your OS, and encryption clients

None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot.

> popular apps

This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users.

> especially in the US

The app was deployed in Australia.

> can always be commandeered

Why distribute a random app when they could have gotten the criminals to use Signal or Telegram and bust them there?

> as long as you're not actively targeted

How long did it take to find Bin Laden?

> despite using "secure" apps

This was not a secure app and any audit would have revealed this (audits such as the ones that Signal and friends have undergone).

> and stuff like Tor,

Tor was not involved.

> media makes it seem are unbreakable.

None of the apps hyped as "unbreakable" were broken here, so...point still stands, I guess?

Honestly, if anything, the recommended approach from this incident would be to use the walled garden - an FBI-backed honeypot would have a lot harder time getting from the App/Play Store onto a user's phone if it was obviously a scam to collect user conversations, asked for a bunch of permissions, had no reviews, and no apparent update history. Who would download some random chat app that nobody uses?


> How long did it take to find Bin Laden?

Bin Laden used couriers in place of digital communications. And the trail that led to him began with his most trusted courier.

Allegedly, al-Kuwayti was uncovered, some of his communications were intercepted, and then he was followed up to Bin Laden's refuge.

> Who would download some random chat app that nobody uses?

The only thing that slowed the capture was using a courier network. Are you a criminal? Do not use a phone.

Seriously, criminals should know better, whether they are petty drug dealers or major terrorists.

Misplaced faith in cryptography is the gift that keeps on giving.

... https://en.wikipedia.org/wiki/Crypto_AG


Agree with most of what you said but:

> > especially in the US

> The app was deployed in Australia.

Australia has an even worse equivalent of US National Security Letters, allowing individual workers to be compelled to plant backdoors etc..


Not without notice of the company, and not for wide spreaed distribution, ie targeted enforcement.


I was also under the impression this can be served to individuals without the knowledge of their employer, leaving the individual in a position where they can consult a single lawyer about the legality of the request and face jail time for discussing the request with anyone else (including employers).

I would need to re-read the act, but the gov website[1] indicates you are correct that these requests are served to organisations and not individuals excepting sole traders.

[1] https://www.homeaffairs.gov.au/about-us/our-portfolios/natio...


> Not without notice of the company

Oh? The reports I read were that they could compel an individual to do something and not tell their employer.


The reports you read were likely based on commentary from techies who have no understanding about law, plus a handful of lawyers involved with digital rights organisations that have an incentive to play up the significance of the legislation a bit / talk about worst-case scenarios, worst possible interpretations of a dangerous law and the broadest possible interpretation of who constitutes a "designated communications provider". The government has stated that's not how they interpret the legislation, as the service provider will be the employer not the employee, and I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something.

I'm as suspicious about the Assistance and Access Bill as anyone, but the "telling an employee to implement a backdoor without telling their employer" is really a red herring and I don't know why the Australian tech community was so keen to go along with that.


> I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something.

Eh, from where I'm sitting, that's a pretty common tactic to pacify opposition to legislation that grants the government too much power.


Why would such a law target an employee, when as you claim, it targets the employer indirectly too?

Why not leave it at the employer? Just because won't cut it.


>The lesson here is complete trust in modern computing platforms is misplaced and impossible

For me the lesson here is the same old lesson - Your security is only as good as the humans that interact with it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: