Technical analysis of the Signal clone used by Trump officials(micahflee.com)
micahflee.com
Technical analysis of the Signal clone used by Trump officials
https://micahflee.com/tm-sgnl-the-obscure-unofficial-signal-app-mike-waltz-uses-to-text-with-trump-officials/
383 comments
See also: "The Signal Clone the Trump Admin Uses Was Hacked" https://www.404media.co/the-signal-clone-the-trump-admin-use...
See also https://news.ycombinator.com/item?id=43890179 for discussion of whether that article should count as a follow-up or SNI.
Normally I wouldn't link to meta discussion but this was such a weird borderline case that I spent over an hour trying to figure it out. Maybe that makes it interesting.
Edit: in case anyone's confused about the sequence here, micahflee posted the current thread 2 days ago. The timestamp at the top of this page is an artifact of us re-upping it (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...).
Normally I wouldn't link to meta discussion but this was such a weird borderline case that I spent over an hour trying to figure it out. Maybe that makes it interesting.
Edit: in case anyone's confused about the sequence here, micahflee posted the current thread 2 days ago. The timestamp at the top of this page is an artifact of us re-upping it (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...).
FWIW, I never clicked into this when I originally saw it because I'm not that interested in a "technical analysis", but gained interest when the other title said that the app was hacked. To me, that's worth discussing, but here that lede is a bit buried. And I now only know about it because a friend sent me the link.
I do feel there's a pattern of me reading some interesting tech news, then thinking "wait, why didn't I see this discussed on HN?", to searching for it and finding a buried/flagged HN discussion due to it being somewhat tied to politics (what isn't?)
I do feel there's a pattern of me reading some interesting tech news, then thinking "wait, why didn't I see this discussed on HN?", to searching for it and finding a buried/flagged HN discussion due to it being somewhat tied to politics (what isn't?)
I have recently switched to the “active threads” feed which shows flagged content: https://news.ycombinator.com/active
As a non-native English understander, I find it funny that discussions related to politics are “flagged”. I.e. carrying a flag.
Someone carrying a flag is flagging.
Someone who had a flag applied to them was flagged.
Noun to verb conjugations are unofficial English. But we love verbing our words. Google has been verbed into Googling. And when someone is the target of Google we call that getting Googled.
It's again, unofficial and unwritten and unstudied American English. So don't sweat it. It's how our slang evolves. Apologies for the lack of consistency in our language!
Someone who had a flag applied to them was flagged.
Noun to verb conjugations are unofficial English. But we love verbing our words. Google has been verbed into Googling. And when someone is the target of Google we call that getting Googled.
It's again, unofficial and unwritten and unstudied American English. So don't sweat it. It's how our slang evolves. Apologies for the lack of consistency in our language!
> It's again, unofficial and unwritten and unstudied American English.
Hm? Where'd you get that impression?
It's certainly unofficial -- English has no official governing body, so essentially _all_ English is unofficial. However, zero-derived denominal verbs are quite common in even formal written English [0], are well studied [1], and aren't at all limited to American English [2].
----
[0] As seen in this very thread.
[1] It took me almost no time to find a random academic paper [1a] and two Wikipedia articles [1b][1c].
[1a] https://dingo.sbs.arizona.edu/~hharley/PDFs/HarleyDenominalV...
[1b] https://en.wikipedia.org/wiki/Denominal_verb
[1c] https://en.wikipedia.org/wiki/Conversion_(word_formation)
[2] https://www.thetimes.com/uk/politics/article/the-pedant-noun...
Hm? Where'd you get that impression?
It's certainly unofficial -- English has no official governing body, so essentially _all_ English is unofficial. However, zero-derived denominal verbs are quite common in even formal written English [0], are well studied [1], and aren't at all limited to American English [2].
----
[0] As seen in this very thread.
[1] It took me almost no time to find a random academic paper [1a] and two Wikipedia articles [1b][1c].
[1a] https://dingo.sbs.arizona.edu/~hharley/PDFs/HarleyDenominalV...
[1b] https://en.wikipedia.org/wiki/Denominal_verb
[1c] https://en.wikipedia.org/wiki/Conversion_(word_formation)
[2] https://www.thetimes.com/uk/politics/article/the-pedant-noun...
Or "had a flag waved at them", like football assistant referees or F1 peoples.
Or “called them over by raising a hand” with “flagged down”.
I also read it as carrying a flag (applied by others) to highlight that it needs to be reviewed or hidden.
Imo it's a brand new thing so it deserves this technical analysis, the follow up also deserves its own post because of its both importance and political/security nature (government app attacked).
It would be if Google announced Gmail and there was a technical analysis and then it was hacked the same day, I would hope there would be a post for that.
It would be if Google announced Gmail and there was a technical analysis and then it was hacked the same day, I would hope there would be a post for that.
See https://news.ycombinator.com/item?id=43896978 for why we didn't do that.
Short version: it's not possible to have separate discussions in the way you describe. They would just get totally blended.
I like your Gmail analogy but I don't think it applies here. The "technical analysis" article is driven by the same political/security concerns as the "hacked" update.
Short version: it's not possible to have separate discussions in the way you describe. They would just get totally blended.
I like your Gmail analogy but I don't think it applies here. The "technical analysis" article is driven by the same political/security concerns as the "hacked" update.
Thanks for adding the little bit of meta commentary here. I think it helps to understand a bit more about how the site functions. And with this case, particular, it is a very useful timeline to help follow the discussion.
This article doesn’t include information on the Hack.
The 404 media article linked in this article is an earlier article.
The 404 media article with the hack was posted last night at 6pm. So that needs a seperate post, and should not be marked duped.
The 404 media article linked in this article is an earlier article.
The 404 media article with the hack was posted last night at 6pm. So that needs a seperate post, and should not be marked duped.
I think I addressed all these points in https://news.ycombinator.com/item?id=43896978 and https://news.ycombinator.com/item?id=43901823, but if you read those and still have a question that isn't answered there, I can take a crack at it.
dang: the two posts are different topics, also isn't this one "show hn"? I'm so confused by the application of rules around self-posts.
They are the same topic in the sense that the HN threads about them are going to lead to the exact same discussion. If you read https://news.ycombinator.com/item?id=43896978 and https://news.ycombinator.com/item?id=43901823, that should be clear - but if not, let me know and I'll try to clarify further.
"Show HN" is a separate thing entirely - it's true that the submitter of this article was the author (which is great), but that's not enough to make a post a Show HN (https://news.ycombinator.com/showhn.html).
"Show HN" is a separate thing entirely - it's true that the submitter of this article was the author (which is great), but that's not enough to make a post a Show HN (https://news.ycombinator.com/showhn.html).
SNI means?
Sorry! norome is correct. See https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
significant new information
Still trying to grasp the idea of archiving messages from E2E encrypted communication system into a storage that entirely breaks the purpose of using something like Signal.
It’s like encashing on the trust of Signal protocol, app while breaking its security model so that someone else can search through all messages.
What am I missing here?
It’s like encashing on the trust of Signal protocol, app while breaking its security model so that someone else can search through all messages.
What am I missing here?
> What am I missing here?
OK, say you're a bank. The SEC states you need to keep archives of every discussion your traders have with anyone at any time (I'm simplifying things but you get the point). You keep getting massive fines because traders were whatsapping about deals
So now you've got several options - you can use MS Teams, which of course offers archival, compliance monitoring etc. But that means trusting MSFT, and making sure your traders only use Teams and nothing else. You can use a dedicated application for the financial industry, like Symphony or ICE Chat or Bloomberg, but they're clunkier than B2C apps.
And then the Smarsh (owners of Telemessage) salesman calls you, and says "your users can keep using the apps they love - WhatsApp, Signal - but we make it compliant". And everyone loves it (as long as no-one in your Security or Legal teams are looking too hard at the implications of distributing a cracked version of WhatsApp through your MDM...)
Edit: here's the install document for their cracked WhatsApp binary https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
OK, say you're a bank. The SEC states you need to keep archives of every discussion your traders have with anyone at any time (I'm simplifying things but you get the point). You keep getting massive fines because traders were whatsapping about deals
So now you've got several options - you can use MS Teams, which of course offers archival, compliance monitoring etc. But that means trusting MSFT, and making sure your traders only use Teams and nothing else. You can use a dedicated application for the financial industry, like Symphony or ICE Chat or Bloomberg, but they're clunkier than B2C apps.
And then the Smarsh (owners of Telemessage) salesman calls you, and says "your users can keep using the apps they love - WhatsApp, Signal - but we make it compliant". And everyone loves it (as long as no-one in your Security or Legal teams are looking too hard at the implications of distributing a cracked version of WhatsApp through your MDM...)
Edit: here's the install document for their cracked WhatsApp binary https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
> say you're a bank. The SEC states you need to keep archives of every discussion your traders have with anyone at any time
These records are encrypted in storage.
These records are encrypted in storage.
That is more than overly optimistic given how slow the pace of any technical innovation in finance is. The recent and not so recent issues with Citi are a good example of that.
Seems like it doesnt resolve the trust issue it just shifts it to a smaller firm with more to lose.
It definitely doesn't resolve the trust issue! I would trust MSFT a million times more than these cowboys. What it does give you is peace with your traders (who can be real divas..) - they can keep using "WhatsApp" and "Signal" and you can monitor everything
[deleted]
Oh wow! There are other ways to archive whatsapp messages that don't involve modified WhatsApp apks. Meta lawyers do not take kindly to modified WhatsApp apks.
> There are other ways to archive whatsapp messages that don't involve modified WhatsApp apks.
What other ways are there that don't involve WhatsApp's Google Drive backup feature or scraping the web interface?
What other ways are there that don't involve WhatsApp's Google Drive backup feature or scraping the web interface?
The clean way to do it (which is how Telemessage’s competitors do it) is to use WhatsApp business APIs with dedicated phone numbers.
Most traders I dealt with want to do it on personal cell phone so they can keep contacts as they move around. Most of them are like salespeople, they know exactly how much money they bring in and successful ones refuse to do anything that will impede THEIR method of working. SEC Fines, Regulations? Those are for less successful people.
EDIT: There was another post calling them divas, alot of them act that way.
EDIT: There was another post calling them divas, alot of them act that way.
yes, that's why TeleMessage managed to sell such a hacky solution - there was a clear desire for that product
I mean if they're going to use their personal devices for this then a cracked Whatsapp wouldn't help the business anyway.
For devices the company controls they can of course use the API the above poster mentioned though
For devices the company controls they can of course use the API the above poster mentioned though
Yes it does. They convince the traders to let them install MDM and take over the phone, WhatsApp/Telegram/Signal still works, the business gets the records and if they leave the trading firm, the phone gets wiped but traders can just reinstall Store versions, log back in and everything is back.
I had scraping the web interface in mind.
ok, this absolutely reminds me of using indian whatsapp mods years ago. stickers, more features, local and portable backups... wouldn't try that as a member of the government though
[deleted]
Is it a coincidence that it reads almost exactly like SMERSH?
https://en.wikipedia.org/wiki/SMERSH
https://en.wikipedia.org/wiki/SMERSH
Probably coincidence. The founder of the company was named Stephen Marsh.
There's a point at which coincidence and opportunity meet.
[deleted]
Probably not. It's trendy to give edgy names to companies. See: Palintir.
You mean Palantir
And the name is not very edgy and a pretty exact mission description - it describes exactly what it grows from. Seeing stones aka cellphone data of everyone, collected, analyzed and turned into predictions for kings.
Not even pretending to not be evil is what makes it edgy.
To be honest, the good guys - turned out to be pretty embarrassing too.
The whole "everyone thinks like us" delusion bought with the surplus of a good times window distributed all around and its still willing to return to this delusional state of affairs.
The obvious plot-holes they reveal when it comes to we do not discuss nature (the bugs in the human mind are all fixable with education) and we do not discuss nurture (all cultures are equal, and equally capable - disregard the evidence before your eyes).
You don't get to juggle and drop so many balls and do not massively loose confidence!
The rule of (finger in ears) "La-La-La" is over - the problem is- the right is a reactionary mess, that has no solutions, analysis and tools to exploit these weaknesses.
The whole "everyone thinks like us" delusion bought with the surplus of a good times window distributed all around and its still willing to return to this delusional state of affairs.
The obvious plot-holes they reveal when it comes to we do not discuss nature (the bugs in the human mind are all fixable with education) and we do not discuss nurture (all cultures are equal, and equally capable - disregard the evidence before your eyes).
You don't get to juggle and drop so many balls and do not massively loose confidence!
The rule of (finger in ears) "La-La-La" is over - the problem is- the right is a reactionary mess, that has no solutions, analysis and tools to exploit these weaknesses.
> You don't get to juggle and drop so many balls and do not massively loose confidence!
You don't get to run all this circus if you don't intend to run it only as a circus. It's time to stop kidding ourselves that anybody mainstream is sincere and smart enough to move anywhere different from where they all are told to go.
You don't get to run all this circus if you don't intend to run it only as a circus. It's time to stop kidding ourselves that anybody mainstream is sincere and smart enough to move anywhere different from where they all are told to go.
Huh? If the goal is compliance, you wouldn't use something that's worse for compliance - which is why the Legal and Security wouldn't like it. If it helped with compliance, they'd love it! So the reason can't be compliance.
You can never control what I do on my device with the message received- I can make screenshots, or, if the app prevents that, take a picture of the screen.
The goal of signal is trusted end-to-end encrypted communication. Device/Message security on either end is not in scope for Signals threat model.
The goal of signal is trusted end-to-end encrypted communication. Device/Message security on either end is not in scope for Signals threat model.
TM SGNL changes the security model from "I trust the people in the chat" to "I trust the people in the chat and also the company archiving the chat".
If you don't trust the people in your chat, they shouldn't be in your chat.
If you don't trust the people in your chat, they shouldn't be in your chat.
> If you don't trust the people in your chat, they shouldn't be in your chat.
I assure you, none of these people trust each other. Backstabbing is normal.
They're also likely using it to talk to foreign counterparts. Again, most of whom they don't trust a bit.
Encryption isn't just about "do I trust the recipient".
I assure you, none of these people trust each other. Backstabbing is normal.
They're also likely using it to talk to foreign counterparts. Again, most of whom they don't trust a bit.
Encryption isn't just about "do I trust the recipient".
You are conflating levels of trust.
The trust level required with Signal is, "do I trust the people in this chat not to share the specific communications I am sending to them with some other party whom I do not want to have a copy".
There are many many situations where this level of trust applies that "trust" in the general sense does not apply. It is a useful property.
And if you don't have that level of trust, don't put it in writing.
TM SGNL changes the trust required to, "do I also trust this 3rd party not to share the contents of any of my communications, possibly inadvertently due to poor security practices".
This is a categorical and demonstrably material difference in security model. I do not understand why so many are claiming it is not.
The trust level required with Signal is, "do I trust the people in this chat not to share the specific communications I am sending to them with some other party whom I do not want to have a copy".
There are many many situations where this level of trust applies that "trust" in the general sense does not apply. It is a useful property.
And if you don't have that level of trust, don't put it in writing.
TM SGNL changes the trust required to, "do I also trust this 3rd party not to share the contents of any of my communications, possibly inadvertently due to poor security practices".
This is a categorical and demonstrably material difference in security model. I do not understand why so many are claiming it is not.
>TM SGNL changes the trust required to, "do I also trust this 3rd party not to share the contents of any of my communications, possibly inadvertently due to poor security practices".
That's the same level of trust really. Signal provides a guarantee that message bearer (i.e. Signal) can't see the contents, but end users may do whatever.
You can't really assume that counterparty's device isn't rooted by their company or they are themselves required by law to provide written transcripts to the archive at the end of each day. In fact, it's publicly known and mandated by law to do so for your counterparty that happens to be US government official.
The people who assume that they are talking with one of the government officials and expect records not to be kept are probably doing (borderline) illegal, like talking treason and bribes.
No, this is not a "nothing to hide argument", because those people aren't sending dickpics in their private capacity.
That's the same level of trust really. Signal provides a guarantee that message bearer (i.e. Signal) can't see the contents, but end users may do whatever.
You can't really assume that counterparty's device isn't rooted by their company or they are themselves required by law to provide written transcripts to the archive at the end of each day. In fact, it's publicly known and mandated by law to do so for your counterparty that happens to be US government official.
The people who assume that they are talking with one of the government officials and expect records not to be kept are probably doing (borderline) illegal, like talking treason and bribes.
No, this is not a "nothing to hide argument", because those people aren't sending dickpics in their private capacity.
If your counterparty is compromised, that still only leaks your communication with that counterparty, but not other, unrelated conversations.
> This is a categorical and demonstrably material difference in security model. I do not understand why so many are claiming it is not.
Because all it takes is one user to decide they trust the third party.
Right now you actually have to do more than trust everyone, you have to trust everyone they trust with their chat history. Which already can include this sort of third party.
Because all it takes is one user to decide they trust the third party.
Right now you actually have to do more than trust everyone, you have to trust everyone they trust with their chat history. Which already can include this sort of third party.
One of the most popular “e2ee”
communication systems, iMessage, does exactly this each night when the iMessage user’s phone backs up its endpoint keys or its iMessage history to Apple in a non-e2ee fashion.
This allows Apple (and the US intelligence community, including FBI/DHS) to surveil approximately 100% of all non-China iMessages in close to realtime (in the usual case where it’s set to backup cross-device iMessage sync keys).
(China, cleverly, requires Apple to not only store all the Chinese iCloud data in China, but also requires that it happen on machines owned and operated by a joint venture with a Chinese-government-controlled entity, keeping them from having to negotiate continued access to the data the way the FBI did.)
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Yet Apple can still legitimately claim that iMessage is e2ee, even though the plaintext is being backed up in a way that is readable to them. It’s a backdoor by another name.
Everyone wins: Apple gets to say E2EE, the state gets to surveil the texts of everyone in the whole country without a warrant thanks to FISA.
This allows Apple (and the US intelligence community, including FBI/DHS) to surveil approximately 100% of all non-China iMessages in close to realtime (in the usual case where it’s set to backup cross-device iMessage sync keys).
(China, cleverly, requires Apple to not only store all the Chinese iCloud data in China, but also requires that it happen on machines owned and operated by a joint venture with a Chinese-government-controlled entity, keeping them from having to negotiate continued access to the data the way the FBI did.)
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Yet Apple can still legitimately claim that iMessage is e2ee, even though the plaintext is being backed up in a way that is readable to them. It’s a backdoor by another name.
Everyone wins: Apple gets to say E2EE, the state gets to surveil the texts of everyone in the whole country without a warrant thanks to FISA.
I suppose if both you and the recipient have cloud backups disabled, then Apple can no longer view your messages.
But outside of that scenario, is there any advantage to iMessage using e2ee instead of just regular TLS?
Edit: Apparently it's up to you whether you want your iCloud backups to use e2ee. There's an account setting: https://support.apple.com/en-us/102651. Standard protection is a sensible default for regular who aren't tech-savvy, as with e2ee they're at risk of losing all their iCloud data if they lose their key.
But outside of that scenario, is there any advantage to iMessage using e2ee instead of just regular TLS?
Edit: Apparently it's up to you whether you want your iCloud backups to use e2ee. There's an account setting: https://support.apple.com/en-us/102651. Standard protection is a sensible default for regular who aren't tech-savvy, as with e2ee they're at risk of losing all their iCloud data if they lose their key.
That's an old article. According to Apple docs, Advanced Data Protection covers Device and Messages backups, which means they are E2EE.
Correct, but nobody turns it on because it’s opt in, and even if you turn it on, 100% of your iMessages will still be escrowed in a form
readable to Apple due to the fact that the other ends of your iMessage conversations won’t have ADP enabled because it’s off by default.
Again, Apple gets to say “we have e2ee, any user who wants it can turn it on” and the FBI gets to read 100% of the texts in the country unimpeded.
If Apple really wanted to promote privacy, they’d have deployed the so-called “trust circle” system they designed and implemented which allowed a quorum of trusted contacts to use their own keys to allow you to recover your account e2ee keys without Apple being able to access it, rolled that out, and then slowly migrated their entire user base over to e2ee backups.
They have not, and they will not, because that will compromise the surveillance backdoor, and get them regulated upon, or worse. The current administration has already shown that they are willing to impose insanely steep tariffs on the iPhone.
You can’t fight city hall, you don’t need a weatherman to know which way the wind blows, etc. The US intelligence community has a heart attack gun. Tim Apple does not.
Separately it is an interesting aside that Apple’s 1A rights are being violated here by the presumptive retaliation should they publish such a migration feature (software code being protected speech).
Again, Apple gets to say “we have e2ee, any user who wants it can turn it on” and the FBI gets to read 100% of the texts in the country unimpeded.
If Apple really wanted to promote privacy, they’d have deployed the so-called “trust circle” system they designed and implemented which allowed a quorum of trusted contacts to use their own keys to allow you to recover your account e2ee keys without Apple being able to access it, rolled that out, and then slowly migrated their entire user base over to e2ee backups.
They have not, and they will not, because that will compromise the surveillance backdoor, and get them regulated upon, or worse. The current administration has already shown that they are willing to impose insanely steep tariffs on the iPhone.
You can’t fight city hall, you don’t need a weatherman to know which way the wind blows, etc. The US intelligence community has a heart attack gun. Tim Apple does not.
Separately it is an interesting aside that Apple’s 1A rights are being violated here by the presumptive retaliation should they publish such a migration feature (software code being protected speech).
And yet, it's somehow so effective that it's illegal in the UK because it doesn't let the government read everyone's messages.
TBF, governments trying to outlaw some kind of privacy doesn't necessarily mean it's a current impediment to them. They can be planning ahead, securing their position, or just trying to move the window of what is considered acceptable.
Are there any stats as to the percentage of iPhone users that enable Advanced Data Protection? Defaults matter a lot, and I wouldn't be surprised if that number is (well) below 10%.
If you are the only person out of all the people you correspond with who has ADP enabled, then everyone you correspond with is uploading the plaintext of your messages to Apple.
If you are the only person out of all the people you correspond with who has ADP enabled, then everyone you correspond with is uploading the plaintext of your messages to Apple.
The number is well well below 1%. I would bet six figure sums it is below 0.1%.
Effectively nobody has it on. 99%+ of users aren’t even aware of the feature’s existence.
https://daringfireball.net/linked/2023/12/05/icloud-advanced...
You have to remember that there are something like a billion+ iOS users out there. 100 million people have not written down their 27 character alphanumeric account recovery key.
Effectively nobody has it on. 99%+ of users aren’t even aware of the feature’s existence.
https://daringfireball.net/linked/2023/12/05/icloud-advanced...
You have to remember that there are something like a billion+ iOS users out there. 100 million people have not written down their 27 character alphanumeric account recovery key.
The same applies to WhatsApp.
Messages backups are unencrypted by default and even the whole iPhone backup includes the unencrypted chat history of WhatsApp by default.
One reason why it was a big deal for UK to disable iCloud’s E2EE backup.
There are compliance reasons where you want the communications encrypted in flight, but need them retained at rest for compliance reasons. Federal record keeping laws would otherwise prohibit the use of a service like Signal. I'm honestly impressed that the people involved actually took the extra effort for compliance when nothing else they did was above board...
> There are compliance reasons
Makes sense. But still debatable if the compliance requirements are acting against the security model or perhaps there are biggest concerns here than just secure communication.
Makes sense. But still debatable if the compliance requirements are acting against the security model or perhaps there are biggest concerns here than just secure communication.
[deleted]
I would not assume the archives were meant for compliance and federal records.
We also have no evidence it was in use back in March. It may be a response to that oops.
Any client-side limitations are not part of the security model because you don't control other people's devices. Even with an unmodified app, they're trivially bypassed using a rooted/jailbroken device.
Not part of Signal's security model, but trusting people in that chat very much can and should be part of the user's security model. If you don't trust them, why are they in the chat in the first place?
It's not a person in the chat, it's an account. The account is usually controlled by the person associated with it, but you can't assume that it's always controlled by that person.
Is it though? I think TM Signal is just emailing the chats to a server from the phone it's installed on.
> If you don't trust them, why are they in the chat in the first place?
Journalist? Taliban negotiator? Ex-wife?
Journalist? Taliban negotiator? Ex-wife?
You are conflating "trust in all ways" with "trust to receive the communications in the specific chat they are party to". The former is not relevant.
Well the ex-wife in question can be trusted to receive it a-okay and screenshot them to send to her lawyer and cops too, depending on contents. So do US government officials. Now we just know how exactly they do it.
Or with the more affordable (in terms of skills) method of using another phone to take pictures of key messages on the screen of the first one.
OK, say you're a bank. The SEC does not care what you do and is actively working to make sure nobody else does either. You never get fines and all the traders are whatsapping about deals and it's awesome. But what if the FEC decides to care in the future? Just mark all your messages as self-deleting. But what if you want to be able to read them in the future?
And then the Smarsh (owners of Telemessage) salesman calls you, and says "your users can keep using the apps they love - WhatsApp, Signal - but we archive the self-deleting messages somewhere you can hide from the SEC if they happen to change their mind". And everyone loves it (you already fired all the Security or Legal teams).
And then the Smarsh (owners of Telemessage) salesman calls you, and says "your users can keep using the apps they love - WhatsApp, Signal - but we archive the self-deleting messages somewhere you can hide from the SEC if they happen to change their mind". And everyone loves it (you already fired all the Security or Legal teams).
The purpose of using something like Signal is not compatible with the needs of the government or the law.
I’ve worked for non-Federal government. Your work product is not your own, and the public interest, as expressed by the law requires that your communications and decisions can be reviewed by the government you serve.
The US government created the dark web to enable espionage — its pretty obvious why they need to read their employees mail.
I’ve worked for non-Federal government. Your work product is not your own, and the public interest, as expressed by the law requires that your communications and decisions can be reviewed by the government you serve.
The US government created the dark web to enable espionage — its pretty obvious why they need to read their employees mail.
My guesses:
You want to talk to people who want to use Signal, but you yourself don't care about E2E
You trust Telemedia, but not Telegram, or Meta. And you want convenient archiving.
You want to talk to people who want to use Signal, but you yourself don't care about E2E
You trust Telemedia, but not Telegram, or Meta. And you want convenient archiving.
Maybe someone wanted to please the procedure of law but also had to please the bros. The result is a hack of a secure program that adds conversation archiving.
My wild speculation is that someone wants to use AI to monitor everyone’s communication.
What they should have done is write a bot that you invite to every conversation for "archival purposes". No new app.
Then you have a new attack surface. It's still missing the point of signal.
If your institution has to log the messages, they are a third party to the conversation, I would rather they were "in the chat" than the lowest bidder third party.
A chat participant bot would also be handy if you wanted to feed everything through your Ai bot at the same time.
A chat participant bot would also be handy if you wanted to feed everything through your Ai bot at the same time.
The big part of this story which nobody is talking about is the fact that the app is literally controlled by a bunch of “former” Israeli intelligence officers. Who now have what is arguably the worlds most valuable access out of anyone.
I don't think it's that big: USG procures defense and intelligence tech more or less constantly from Israel. It's unlikely that Israel would threaten that relationship (and the value they extract from it in terms of favorable relations) in exchange for military intelligence that's already shared with them.
(I feel like I have to say this in every thread that insinuates something sinister about being a "former Israeli intelligence officer": the structure of Israel's military and mandatory service is such that just about everybody with technical skills serves in some kind of "intelligence" capacity. It's not a very big country. This is, of course, independent from any normative claims about Israel's government, politics, etc. -- it's what you'd expect in any small country that has mandatory military service with a significant intelligence component.)
(I feel like I have to say this in every thread that insinuates something sinister about being a "former Israeli intelligence officer": the structure of Israel's military and mandatory service is such that just about everybody with technical skills serves in some kind of "intelligence" capacity. It's not a very big country. This is, of course, independent from any normative claims about Israel's government, politics, etc. -- it's what you'd expect in any small country that has mandatory military service with a significant intelligence component.)
> I don't think it's that big: USG procures defense and intelligence tech more or less constantly from Israel. It's unlikely that Israel would threaten that relationship (and the value they extract from it in terms of favorable relations) in exchange for military intelligence that's already shared with them.
Correct - they would not use that intelligence to threaten that relationship, but to maintain it. Knowing the political leanings of politicians and government officials (for example, identifying any that think that relationship is more of a cost than a benefit) is extremely valuable to that end.
Correct - they would not use that intelligence to threaten that relationship, but to maintain it. Knowing the political leanings of politicians and government officials (for example, identifying any that think that relationship is more of a cost than a benefit) is extremely valuable to that end.
The over/under there doesn't make sense: the US hasn't had a meaningfully hostile-to-Israel policy ever, so pervasively tapping some of the most sensitive USG communications would be a stunning risk to take with a very safe ally.
(It also beggars belief in the current climate -- I would be hard-pressed to name a single member of the current administration who hasn't yelled until purple in the face about their support for Israel's current government and wartime policies.)
(It also beggars belief in the current climate -- I would be hard-pressed to name a single member of the current administration who hasn't yelled until purple in the face about their support for Israel's current government and wartime policies.)
You might think so, but they didn't face any backlash for buying politicians [1,2] and bragging about it [3], so why would they worry? You also assume that the US is a "very safe ally" naturally, and not as a consequence of means such as these.
[1] After House Speaker Mike Johnson Pushed Through Israel Aid Package, AIPAC Cash Came Flowing In - https://theintercept.com/2024/01/20/israel-aipac-house-mike-...
[2] The Israel lobby and U.S. foreign policy - https://www.hks.harvard.edu/publications/israel-lobby-and-us...
[3] More than 95% of AIPAC-backed candidates won their election last night! Being pro-Israel is good policy and good politics! - https://x.com/AIPAC/status/1590362232915132417
[1] After House Speaker Mike Johnson Pushed Through Israel Aid Package, AIPAC Cash Came Flowing In - https://theintercept.com/2024/01/20/israel-aipac-house-mike-...
[2] The Israel lobby and U.S. foreign policy - https://www.hks.harvard.edu/publications/israel-lobby-and-us...
[3] More than 95% of AIPAC-backed candidates won their election last night! Being pro-Israel is good policy and good politics! - https://x.com/AIPAC/status/1590362232915132417
Everyone is tapping everyone else to the extent they can get away with it - especially allies, because they can get away with it more. You don't think the NSA monitors every single bit that flows in and out of the USA?
Periodically, someone gets caught red-handed, a fuss is made, some diplomats get thrown out and replaced with other ones, and then everyone continues doing it.
Periodically, someone gets caught red-handed, a fuss is made, some diplomats get thrown out and replaced with other ones, and then everyone continues doing it.
They have never had a hostile-to-Israel policy and never will because of the leverage Israel has over US politicians.
There's a reason the US bought this app from Israelis, and it wasn't because of improved security or archive compliance.
For how much they like to beat the "buy American" drum, this contradicts that.
There's a reason the US bought this app from Israelis, and it wasn't because of improved security or archive compliance.
For how much they like to beat the "buy American" drum, this contradicts that.
You'll note that this case caused exactly the kind of outcome I'm talking about: Pollard was an anomaly (to my knowledge, the only recorded case of a US citizen spying for a US ally) whose activities caused a massive intelligence break between US and Israel that lasted for years and probably did more damage than "good" it served for Israel's intelligence apparatus[1]. That kind of lesson is hard-learned and probably not forgotten, regardless of the fact that Pollard is a poster-boy in Israel's version of a culture war.
[1]: https://www.thedailybeast.com/israeli-spies-arent-exactly-re...
[1]: https://www.thedailybeast.com/israeli-spies-arent-exactly-re...
Julius and Ethel Rosenberg were also US citizens spying for a US ally, at least in theory. Though the Soviet Union had stopped being an ally before they were convicted, of course.
The most "hostile to Israel" policy was under JFK, which is interesting.
Yep. In general there's been no truly "hostile to Israel" US president. The closest thing to "hostility" has been negotiating (under JFK, Carter, Bush Sr., and Obama most notably) with regards to one or more of Iran, the '67 border, WB settlements, etc. Israel has increasingly (and wrongly) considered these "meddling" under its far-right government, which is a internal change within their own politics rather than a marked change in the US's own tactics.
I’m saying this as someone who almost certainly has a lot more knowledge about intelligence and the US / Israeli relationship than you do.
While some of the points you make are indeed correct it actually paints an inaccurate overall picture.
For example: not widely known but 100% true, Israel is and has been for a long time classified as the highest level of counterintelligence threat to the US on par with China, Russia, Cuba and others.
I assure you, this is a big fucking deal and not something to be waved away with “everyone’s intel, don’t worry it’s probably nothing”.
While some of the points you make are indeed correct it actually paints an inaccurate overall picture.
For example: not widely known but 100% true, Israel is and has been for a long time classified as the highest level of counterintelligence threat to the US on par with China, Russia, Cuba and others.
I assure you, this is a big fucking deal and not something to be waved away with “everyone’s intel, don’t worry it’s probably nothing”.
I'm not saying it's not a big deal. It obviously is.
I'm saying that the fact that it's Israeli tech is not itself the biggest part of the story.
I'm saying that the fact that it's Israeli tech is not itself the biggest part of the story.
Israël have different interest than the usa.
Today they may collide in most instances, who's to say tomorrow it will still be the case. For instance when Iran gets the nuclear bomb and threaten Israel with it ?
An encrypted messaging system, used by the American government, is in my opinion even worst than the supposed Huawei 5g antenna data collection.
Huawei wouldn't have had access to secret talk between top government official, at least not decrypted.
Today they may collide in most instances, who's to say tomorrow it will still be the case. For instance when Iran gets the nuclear bomb and threaten Israel with it ?
An encrypted messaging system, used by the American government, is in my opinion even worst than the supposed Huawei 5g antenna data collection.
Huawei wouldn't have had access to secret talk between top government official, at least not decrypted.
>For instance when Iran gets the nuclear bomb and threaten Israel with it ?
I don't know if this was your intention, but it's exceedingly likely that the US would side with Israel in all circumstances if Iran threatened Israel with a nuclear weapon, no matter who is president. In fact, the threat of Iran attacking Israel was one of the key reasons† Biden refused to unilaterally stop all arms shipments to Israel.
† Source: War by Bob Woodward.
I don't know if this was your intention, but it's exceedingly likely that the US would side with Israel in all circumstances if Iran threatened Israel with a nuclear weapon, no matter who is president. In fact, the threat of Iran attacking Israel was one of the key reasons† Biden refused to unilaterally stop all arms shipments to Israel.
† Source: War by Bob Woodward.
Given that Trump's foreign policy is quite alien compared to his predecessors, I don't know how valuable looking to the past is for this sort of thing. A new president, of any political bent, may follow the example and make further breaks with the past.
I agree for the most part, his foreign policy is very alien compared to Biden or any other "normal" president. When it comes to Iran and supporting Israel, though, I think he's still pretty hawkish and predictable for a Republican president (or as predictable as Trump can be). Remember during his first presidency, he withdrew from the Iran nuclear deal, then he imposed a bunch of tight sanctions on Iran while reinforcing ties with Israel and recognizing Jerusalem as its capital.
Part of his hawkishness toward Iran comes from the kinds of national security advisers he keeps (typically all hawkish on Iran themselves, with some exceptions like General Mark Milley), and part of it comes from his admiration for "strongman" leaders like Bibi.
Part of his hawkishness toward Iran comes from the kinds of national security advisers he keeps (typically all hawkish on Iran themselves, with some exceptions like General Mark Milley), and part of it comes from his admiration for "strongman" leaders like Bibi.
megous(2)
The US and many other countries have been buying Israeli surveillance tools for years or decades.
I would hope that any message archiving is being done on an organization-owned server though.
I would hope that any message archiving is being done on an organization-owned server though.
> The US and many other countries have been buying Israeli surveillance tools for years or decades.
Yes, tools like Cellebrite and zero-day exploits.
Those are tools which are used to spy on people outside of the government.
This is a tool that has data created by the government.
Yes, tools like Cellebrite and zero-day exploits.
Those are tools which are used to spy on people outside of the government.
This is a tool that has data created by the government.
> I would hope that any message archiving is being done on an organization-owned server though.
There's compelling evidence that the messages all pass through TM servers before being archived.
https://www.404media.co/the-signal-clone-the-trump-admin-use...
There's compelling evidence that the messages all pass through TM servers before being archived.
https://www.404media.co/the-signal-clone-the-trump-admin-use...
There's compelling evidence that the messages all pass through TM servers before being archived.
The question is where the E2E encryption goes between.
The question is where the E2E encryption goes between.
The E2E encryption is likely not even relevant, unless I'm missing something?
The builds that are distributed would likely just send the plaintext un-encrypted message separately to the archive, and I'm guessing that means it goes right to TM servers before being dispatched elsewhere.
The builds that are distributed would likely just send the plaintext un-encrypted message separately to the archive, and I'm guessing that means it goes right to TM servers before being dispatched elsewhere.
Ah yes, it's end-to-end alright, end-to-end cleartext.
I know it's pretty fun to do the espionage angle with this comment.
But is this really just evidence that a mandatory draft is actually good economic policy? Having a forced networking event where a bunch of similar skilled individual meet each other seems to be producing a ton of economic value for Israel.
But is this really just evidence that a mandatory draft is actually good economic policy? Having a forced networking event where a bunch of similar skilled individual meet each other seems to be producing a ton of economic value for Israel.
>The big part of this story which nobody is talking about is the fact that the app is literally controlled by a bunch of “former” Israeli intelligence officers. Who now have what is arguably the worlds most valuable access out of anyone.
You are just talking about the clone, NOT signal foundation and the dev team?
You are just talking about the clone, NOT signal foundation and the dev team?
It's not like Israel doesn't already have the highest level of access to the administration's plans. Canada could be made the 51st state and Israel would still have more access to the Trump administrations plans. There is some sort of strong connection between the USA and Israel. What that is, I don't know.
harrisrobin(1)
The bigger story is the follow up that shows someone already hacked telemessage because the app seems to be vulnerable to several exploits (and transmits data in the clear apparently).
https://news.ycombinator.com/item?id=43896138
https://news.ycombinator.com/item?id=43896138
I can’t read that full article, but are you saying the chats go e2e encrypted into signal and then come out non e2e when transmitting to the archive? That seems like an unlikely design for even an amateur. Why wouldn’t you just add something like an archive bot that sits in signal chats and sees everything e2e?
It seems TM SGNL also works when you're messaging with somebody using the genuine Signal app. They aren't gonna make a group chat with your archive bot to message you, and they might not be pleased when you add them to such a group chat.
Maybe but if that’s their opinion, I don’t think they’d be pleased to know that you are archiving their chats in any case. I guess it would depend on who the user base is.
White House communications director previously revealed (after “Signalgate”) that Signal was an approved and whitelisted app for gov’t officials to have on work phones and even discuss top-secret matters on. But I haven’t heard that TeleMessage was approved (and I’d have serious questions if it were given the foreign intelligence factor). Anyone know if there is a clear answer to whether it’s been approved?
It was incontrovertibly approved as it is only installable via MDM.
A likely explanation is that the communications director (or the people informing her) wouldn’t know to distinguish between Signal the app, and a Signal compatible app that is nearly indistinguishable from Signal. A lot like Kleenex is a common term for tissue paper regardless of brand.
When the leak was first revealed, there was loud speculation about the legality of government chat messages being set to auto-delete. This additional revelation, about the use of TeleMessage, shows that someone with a security background has actually thought about these things. It makes perfect security sense to archive messages somewhere secure, off phone, for record keeping compliance while ensuring that relatively vulnerable phones don’t retain messages for very long. It’s also an easy explanation for why such an app was created in the first place. There is an obvious market for it.
A likely explanation is that the communications director (or the people informing her) wouldn’t know to distinguish between Signal the app, and a Signal compatible app that is nearly indistinguishable from Signal. A lot like Kleenex is a common term for tissue paper regardless of brand.
When the leak was first revealed, there was loud speculation about the legality of government chat messages being set to auto-delete. This additional revelation, about the use of TeleMessage, shows that someone with a security background has actually thought about these things. It makes perfect security sense to archive messages somewhere secure, off phone, for record keeping compliance while ensuring that relatively vulnerable phones don’t retain messages for very long. It’s also an easy explanation for why such an app was created in the first place. There is an obvious market for it.
> It was incontrovertibly approved as it is only installable via MDM.
Only if this his standard govt issued phone. It's also been shown they are also using their own personal phones. The could easily be using unapproved phones some random DOGE'er bought gave them with an MDM setup, without any real oversight.
Only if this his standard govt issued phone. It's also been shown they are also using their own personal phones. The could easily be using unapproved phones some random DOGE'er bought gave them with an MDM setup, without any real oversight.
This is currently my bet. This looks like something I would set up— state actors are not in my threat list. But, I’m usually being paid to protect the employer not the employee.
> The could easily be using unapproved phones some random DOGE'er bought gave them with an MDM setup, without any real oversight.
No. Even if you managed to get the app and push it to devices, you can't just use TM-SGNL without having an archiving account from Telemessage.
Source: I manage this exact setup for several clients.
No. Even if you managed to get the app and push it to devices, you can't just use TM-SGNL without having an archiving account from Telemessage.
Source: I manage this exact setup for several clients.
> you can't just use TM-SGNL without having an archiving account from Telemessage
Why wouldn't the government (DOGE in this scenario) be able to get an archiving account?
Why wouldn't the government (DOGE in this scenario) be able to get an archiving account?
The device would have to be jailbroken right? These apps are (obviously) not in the App Store, I mean one of them is a cracked WhatsApp ...
No, you can distribute custom managed apps through Apple's MDM programme. https://support.apple.com/en-gb/guide/deployment/dep575bfed8...
Sorry yes I meant for personal devices. These are designed to be deployed under MDM on corporate devices
edit: found their install doc! https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
edit: found their install doc! https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
You can put personal devices on an MDM, many have special modes for this too.
These are all high profile, high net worth individuals. Their 'personal' devices will all be managed by MDM as well.
> This additional revelation, about the use of TeleMessage, shows that someone with a security background has actually thought about these things.
We only have evidence they used TeleMessage after the scandal. When the same guy let the press take a photo of his messages with Vance, Rubio, Gabbard and others.
We only have evidence they used TeleMessage after the scandal. When the same guy let the press take a photo of his messages with Vance, Rubio, Gabbard and others.
If DOGE can storm into government offices and get root access to sensitive system without proper procedure, couldn't SECDEF and co. strong arm their way past the IT worker managing the MDM?
According to the new 404 Media article [0] about the app's archive server actually being hacked, TeleMessage does have contracts with several governmental agencies. Still not a direct answer to the question, I know, but it tilts the answer overwhelmingly towards "yes."
[0]: https://www.404media.co/the-signal-clone-the-trump-admin-use...
[0]: https://www.404media.co/the-signal-clone-the-trump-admin-use...
This is so frightening. I worked in corporate security, and that was occasionally a leaking ship, but this wouldn’t even fly with our engineers even if we wanted their message history. This is negligence.
The scariest part? They also sell to corporations...
Read their install guide and weep at the idea of pushing cracked WhatsApp binaires through MDM https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
Read their install guide and weep at the idea of pushing cracked WhatsApp binaires through MDM https://smarsh.my.salesforce.com/sfc/p/#30000001FgxH/a/Pb000...
> cracked WhatsApp binaries
On a more meta note, I wonder who even works at companies founded on ideas that are just... bad. On average, I expect good engineers to push back on such business requirements and also have better job mobility so they can leave and work elsewhere. The researcher found the vulnerabilities "in less than 30 minutes" so it seems there's some lack of competence here.
Unfortunately, misguided business requirements like this won't simply disappear and I get that those can be niche offerings that attract juicy contracts.
On a more meta note, I wonder who even works at companies founded on ideas that are just... bad. On average, I expect good engineers to push back on such business requirements and also have better job mobility so they can leave and work elsewhere. The researcher found the vulnerabilities "in less than 30 minutes" so it seems there's some lack of competence here.
Unfortunately, misguided business requirements like this won't simply disappear and I get that those can be niche offerings that attract juicy contracts.
Casinos, scams (both of these Web3 as well as traditional), game hack developers, ransomware and database hackers. Adtech, which thousands of HNers work in (anyone at Google). Temu, Shein, gacha/lootbox games, dopamine drug dealers (Meta, Bytedance). NSO group, spyware. Policeware, Clearview, surveillance tech. You could name defense as well, but I find that more ambiguous.
I wouldn't be surprised if it at least 25% of HN has worked for such companies for at least 2 years of their career.
I wouldn't be surprised if it at least 25% of HN has worked for such companies for at least 2 years of their career.
The reality is that its a dog eat dog world out there. I know people who worked in adtech. Yeah, they thought it sucked too and was boring stupid work compared to doing something cool. But it paid the bills, and interesting work is hard to land even without having to pivot into it mid career.
People generally need jobs, and some of these jobs aren't so good. Not everyone is talented enough to work at the next hot startup building a frontend to ChatGPT.
The White House communications director lies continually, so the value of that statement is nil.
dashundchen(2)
The correct answer is no one outside US Government IT knows for sure what is or isn't approved per their own rules. Every article (and comments therein) are just speculation and people trying to confirm their own biases, desperately looking for something to blame someone for, to produce more rage-bait and thus feed more ad clicks.
Every single article is written with the presumption that there are no actual IT people in the White House, that someone wheeled in a Starlink dish on a dessert cart in the yard which is somehow running the entire government. It's silly and ridiculous.
Every single article is written with the presumption that there are no actual IT people in the White House, that someone wheeled in a Starlink dish on a dessert cart in the yard which is somehow running the entire government. It's silly and ridiculous.
> It's silly and ridiculous.
As is putting someone with a brain parasite and anti-vax beliefs as the head of HHS, but here we are.
“Silly and ridiculous” does not mean “implausible” with this administration. It’s the standard.
As is putting someone with a brain parasite and anti-vax beliefs as the head of HHS, but here we are.
“Silly and ridiculous” does not mean “implausible” with this administration. It’s the standard.
> The correct answer is no one outside US Government IT knows for sure what is or isn't approved per their own rules
Veterans Affairs actually publishes a list of approved software as part of their Technical Reference Model: https://www.oit.va.gov/services/trm/ (don’t know how complete it is)
But I’m not aware of other agencies doing this. I suppose that VA, given the nature of what they do, likely feels that there is less risk in publicising this information
There’s also the FedRAMP program for centralized review of cloud services - fedramp.gov - I haven’t looked to see if Telemessage is listed as approved but I see some references to FedRAMP and Telemessage online suggesting that it may be
Another source of info is SAM.gov - https://sam.gov/opp/ab5e8a486e074d73bfe09b383ba819ab/view (that’s for NIH) - if there is an agency paying for it, you can assume they’ve approved it for use (or are in the process of doing so) even if they haven’t otherwise publicly said they are. But, not all contracts are public, so just because you can’t find it on SAM.gov doesn’t mean it doesn’t exist
Veterans Affairs actually publishes a list of approved software as part of their Technical Reference Model: https://www.oit.va.gov/services/trm/ (don’t know how complete it is)
But I’m not aware of other agencies doing this. I suppose that VA, given the nature of what they do, likely feels that there is less risk in publicising this information
There’s also the FedRAMP program for centralized review of cloud services - fedramp.gov - I haven’t looked to see if Telemessage is listed as approved but I see some references to FedRAMP and Telemessage online suggesting that it may be
Another source of info is SAM.gov - https://sam.gov/opp/ab5e8a486e074d73bfe09b383ba819ab/view (that’s for NIH) - if there is an agency paying for it, you can assume they’ve approved it for use (or are in the process of doing so) even if they haven’t otherwise publicly said they are. But, not all contracts are public, so just because you can’t find it on SAM.gov doesn’t mean it doesn’t exist
>that someone wheeled in a Starlink dish on a dessert cart in the yard
That situation was ridiculous, in that to score the marketing points, but fighting with the whitehouse IT the starlink is installed at a remote location with much the same point of failure as their fibre services.
That situation was ridiculous, in that to score the marketing points, but fighting with the whitehouse IT the starlink is installed at a remote location with much the same point of failure as their fibre services.
gopher_space(2)
It would have to be approved; there is no way for lay-users to install/configure TM-SGNL in their own; it needs to be deployed via MDM.
Source: I'm the admin who installs TM-SGNL for many users.
Source: I'm the admin who installs TM-SGNL for many users.
Would be interesting to dump the app binaries so people can take a look at how its put together, I suspect its a minefield of sloppy injection functions into how signal works.
Signal is open source for the client, no one is doing work they don't have to cracking a binary you can just compile.
FYI, the server is also open source.
https://github.com/signalapp/Signal-Server
https://github.com/signalapp/Signal-Server
I was looking for the modified client to look into, not the main line signal binary
> Source: I'm the admin who installs TM-SGNL for many users.
So... is it properly open source?
So... is it properly open source?
I felt the writer implied open source code was a bad/insecure thing, since they downloaded a zip file from some WordPress upload folder. I'm guessing the code was being made available to companies that "legally" obtained TM-SGNL.
His repo, not theirs: https://github.com/micahflee/TM-SGNL-Android/commits/master/
He points out that "You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy."
His repo, not theirs: https://github.com/micahflee/TM-SGNL-Android/commits/master/
He points out that "You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy."
The publicly known recommendations, from CISA for example, was to use Signal for non-classified information only.
>> Signal was an approved and whitelisted app for ... discuss top-secret matters on.
No. Just no. Anyone who has handled TS information would know how nutz that sounds. Irrespective of software, TS stuff is only ever displayed in special rooms with big doors and a man with a gun outside. The concept of having TS on an everyday-use cellphone is just maddening.
No. Just no. Anyone who has handled TS information would know how nutz that sounds. Irrespective of software, TS stuff is only ever displayed in special rooms with big doors and a man with a gun outside. The concept of having TS on an everyday-use cellphone is just maddening.
timschmidt(2)
More and more I am starting to understand that making money with software really has nothing to do with quality. It's about checking boxes. Enterprise SSO? Check. Auditing? Check. Does it "kinda" do the thing as advertised? Sort of, poorly, and slower than many free open source offerings. Oh, and also the company is in talks for an acquisition, so the entire engineering team is just drawing up plans for their vacation homes and picking out their BMWs at this point, while the product rots. Doesn't matter, here's your eight figure contract so we can tell the SLT we did a thing. By the time enough people have had to deal with it to get rid of it, all the decision makers will have moved on to something else.
Is Signal allowing arbitrary apps to connect to its network? How do I know that my correspondent is using TM Sgnl or another unofficial app?
Doesn't that break Signal's security guarantees? For example, what if I set my message to delete in 1 hour but TM Sgnl archives it, or some other app simply ignores the retention setting?
If Signal allows it, it seems like a major vulnerability? I suppose I must trust other users - they could always screenshot a conversation. But while I trust them not to intentionally cheat me, I shouldn't have to trust them to accurately evaluate the security implementation of a software application - something most people can't do, Mike Waltz being the most famous example.
Maybe Signal should identify users unofficial clients. A downside is that it would provide significant identifying information - few people use unofficial apps.
Doesn't that break Signal's security guarantees? For example, what if I set my message to delete in 1 hour but TM Sgnl archives it, or some other app simply ignores the retention setting?
If Signal allows it, it seems like a major vulnerability? I suppose I must trust other users - they could always screenshot a conversation. But while I trust them not to intentionally cheat me, I shouldn't have to trust them to accurately evaluate the security implementation of a software application - something most people can't do, Mike Waltz being the most famous example.
Maybe Signal should identify users unofficial clients. A downside is that it would provide significant identifying information - few people use unofficial apps.
> Doesn't that break Signal's security guarantees? For example, what if I set my message to delete in 1 hour but TM Sgnl archives it, or some other app simply ignores the retention setting?
Disappearing messages has never been a security guarantee of Signal. People can always archive things their own way (screenshots in the worst case). It's just a convenience feature, not a security thing.
Disappearing messages has never been a security guarantee of Signal. People can always archive things their own way (screenshots in the worst case). It's just a convenience feature, not a security thing.
> Disappearing messages has never been a security guarantee of Signal.
What makes you say that? Has Signal posted something about it?
Retention settings are widely used for messaging security.
Also, I just used retention as an example. There could be many other holes in the unofficial client, including how it communicates with the Signal network. Maybe my messages aren't E2EE when communicating with that client. Maybe the mess up the encrytion implementation.
What makes you say that? Has Signal posted something about it?
Retention settings are widely used for messaging security.
Also, I just used retention as an example. There could be many other holes in the unofficial client, including how it communicates with the Signal network. Maybe my messages aren't E2EE when communicating with that client. Maybe the mess up the encrytion implementation.
> What makes you say that? Has Signal posted something about it?
I mean, if you want Signal's blog post where they introduced it, it's here: https://signal.org/blog/disappearing-messages/
But also, of course Signal hasn't promised that if they're remotely competent, because that's impossible. You can't stop people from retaining messages if they want to. Now perhaps they're not remotely competent, but in reality they do know better.
> Retention settings are widely used for messaging security.
I mean, maybe people think they're using it for that, but regardless of the context, it will not provide any actual security, because that's impossible! Your recipient could get out a camera and take a photograph if that's what it comes to.
I mean, if you want Signal's blog post where they introduced it, it's here: https://signal.org/blog/disappearing-messages/
But also, of course Signal hasn't promised that if they're remotely competent, because that's impossible. You can't stop people from retaining messages if they want to. Now perhaps they're not remotely competent, but in reality they do know better.
> Retention settings are widely used for messaging security.
I mean, maybe people think they're using it for that, but regardless of the context, it will not provide any actual security, because that's impossible! Your recipient could get out a camera and take a photograph if that's what it comes to.
> Your recipient could get out a camera and take a photograph if that's what it comes to.
You are making the perfect the enemy of the good. As I said, two comments up: "I suppose I must trust other users - they could always screenshot a conversation. But while I trust them not to intentionally cheat me, I shouldn't have to trust them to accurately evaluate the security implementation of a software application - something most people can't do, Mike Waltz being the most famous example."
IT security professionals do use retention settings for security; it's not perfect, as you say, but it's very helpful. For example, many businesses auto-delete messages after a certain period except messages that the user intentionally preserves.
And as I said, there are other security functions in Signal that users must trust their apps to handle correctly.
You are making the perfect the enemy of the good. As I said, two comments up: "I suppose I must trust other users - they could always screenshot a conversation. But while I trust them not to intentionally cheat me, I shouldn't have to trust them to accurately evaluate the security implementation of a software application - something most people can't do, Mike Waltz being the most famous example."
IT security professionals do use retention settings for security; it's not perfect, as you say, but it's very helpful. For example, many businesses auto-delete messages after a certain period except messages that the user intentionally preserves.
And as I said, there are other security functions in Signal that users must trust their apps to handle correctly.
> You are making the perfect the enemy of the good.
They merely said: "Disappearing messages has never been a security guarantee of Signal".
Signal guarantees end-to-end encryption in transit. They don't guarantee anything that happens on the phones, because they can't. They try to help where they can, e.g. with disappearing messages. But that is a convenience tool, not a security guarantee by Signal.
They merely said: "Disappearing messages has never been a security guarantee of Signal".
Signal guarantees end-to-end encryption in transit. They don't guarantee anything that happens on the phones, because they can't. They try to help where they can, e.g. with disappearing messages. But that is a convenience tool, not a security guarantee by Signal.
We agree; you just seem to want to argue with a strawperson.
My point is that they could help a lot more by verifying the clients.
> Signal guarantees end-to-end encryption in transit.
They can't guarantee that unofficial clients do E2EE. For example, what if the client sent messages in a way that leaked information, including contact information of the users?
> But that is a convenience tool
It's a security tool, it's just not guaranteed.
My point is that they could help a lot more by verifying the clients.
> Signal guarantees end-to-end encryption in transit.
They can't guarantee that unofficial clients do E2EE. For example, what if the client sent messages in a way that leaked information, including contact information of the users?
> But that is a convenience tool
It's a security tool, it's just not guaranteed.
I see responses like yours quite often. They are correct, of course, but if users keep getting confused about it, may be the UX is bad.
People have been requesting various changes to this feature for years, but hear crickets from Signal.
People have been requesting various changes to this feature for years, but hear crickets from Signal.
There's no way for Signal to prevent any piece of code that can make a TCP connection and speak its protocol from using the service.
While that's true even in the general case (through reverse engineering), it's especially true in the case of Signal because it's open source.
There are libraries for interacting with Signal services (one from Signal themselves), here is a CLI tool that uses a patched official library: <https://github.com/AsamK/signal-cli>
There are libraries for interacting with Signal services (one from Signal themselves), here is a CLI tool that uses a patched official library: <https://github.com/AsamK/signal-cli>
You'd need hardware attestation, but you can essentially implement DRM like schemes that prevent any unofficial client from working.
Why not require keys signed with Signal's private key?
If the keys are generated on the device, they can't be trusted by Signal since any clone could generate them too. If the keys are generated by Signal and sent to the device, they can be intercepted and used in any clone
Thanks. Signal could use unique public keys for each valid client. It could be intercepted and used for DoS against the valid client's Signal service, but that's not a confidentiality risk. It could serve as a UID, but maybe there are workarounds to that.
If it quacks like the official Signal client, there's no way for the Signal network to know that it's otherwise.
The question is - how do you intend to verify whether an application is official or unofficial? What's stopping the official application to be 'patched' with a fake signature feigning validity?
Asymmetric cryptography?
How? If you're validating a server, sure. But a server validating a client?
Anything you ship with the app can be extracted.
Anything you ship with the app can be extracted.
I thought the only client allowed on Signal was the official build provided by Signal itself? Does this mean Signal does officially allow another build (Telemark's TM SGNL) access to the Signal network?
From what I know, Signal tries to block known bad clients. But guaranteeing such blocks is impossibly hard short of forcing attestations via things like SafetyNet that would legitimately impact users as well.
There was a case where a teenager in India rose to news media popularity by publishing a messaging app, which was a simple rebranding of Signal he made using some other tool which patches assets iirc.
It was blocked by Signal, but only after reports surfacing about it being an insecure rebrand.
There was a case where a teenager in India rose to news media popularity by publishing a messaging app, which was a simple rebranding of Signal he made using some other tool which patches assets iirc.
It was blocked by Signal, but only after reports surfacing about it being an insecure rebrand.
China's WeChat certainly wouldn't like this yet there's a modified build of that as well, according to the article.
I don't think they asked Signal Foundation for permission, they just did it. Just because you're an Israeli government contractor doesn't mean you can't get rich from piracy and modding so long as you find gullible buyers
Also, how would Signal know this isn't the official app that's accessing their network? They do have a standing policy against it but if someone copy-pastes the APK and makes modifications in parts that don't talk to your server, how's your server to know that an illegitimate client is talking to it
I don't think they asked Signal Foundation for permission, they just did it. Just because you're an Israeli government contractor doesn't mean you can't get rich from piracy and modding so long as you find gullible buyers
Also, how would Signal know this isn't the official app that's accessing their network? They do have a standing policy against it but if someone copy-pastes the APK and makes modifications in parts that don't talk to your server, how's your server to know that an illegitimate client is talking to it
That is not true. There is a popular mod of Signal called Molly - https://molly.im/. It allows multi-device access, which I find very useful. I have been using this on Signal network for a long time now.
That's correct, but presumably this is unpopular enough to fly under the radar (until now at least).
There’s chatter on bsky.
But tl;dr anything said on those phones is assumed to be compromised until proven otherwise by time or a whole lot of very interesting security verifications. So far the evidence that this is a very large leak looks probable based on the evidence presented.
But tl;dr anything said on those phones is assumed to be compromised until proven otherwise by time or a whole lot of very interesting security verifications. So far the evidence that this is a very large leak looks probable based on the evidence presented.
(this was originally a reply to https://news.ycombinator.com/item?id=43890827 but since it's an on-topic comment, I moved it to the merged thread)
Why do you say "everything said on those phones" - did you mean "on this app"? If the backend of an app was compromised, that wouldn't mean the phone itself was rooted?
It is reasonable to assume that the intelligence services of unfriendly countries are actively devoting significant resources to compromising both issued and personal phones of top-level officials in the US government. They would be negligent not to. It's also a good guess that those efforts would be increased after the first time it became public knowledge the officials were likely using those phones for secret official business.
It is also reasonable to guess that such services have access to malware similar to the infamous Pegasus and a nonzero success rate at deploying it. In short, it's careless to assume none of the phones aren't rooted by a hostile actor.
That's one of several reasons the government has rules requiring that classified conversations take place on specific approved devices which aren't used for anything else.
It is also reasonable to guess that such services have access to malware similar to the infamous Pegasus and a nonzero success rate at deploying it. In short, it's careless to assume none of the phones aren't rooted by a hostile actor.
That's one of several reasons the government has rules requiring that classified conversations take place on specific approved devices which aren't used for anything else.
By installing MDM you’re effectively chaining your security to the security of the MDM. The MDM gives you the ability to install arbitrary code via a blessed backdoor. There’s no reason currently not to suspect that anything said on that phone (signal or not) is compromised.
The MDM admin can do whatever the user can do (or more), sure. So yes the MDM admin can potentially read/hear/see stuff, but everyone knows that. That's not a vulnerability, that's by design.
The compromise is only wrt the admin. Are you claiming the admin itself is compromised? What's the evidence for that?
The compromise is only wrt the admin. Are you claiming the admin itself is compromised? What's the evidence for that?
We should all feel relieved that trump admin are following law to archive their chats after all.
Unfortunately this Israeli company is just incompetent, should try something from Russia next time, given that’s all the data end up to be anyway.
Unfortunately this Israeli company is just incompetent, should try something from Russia next time, given that’s all the data end up to be anyway.
I wonder if they were using it from the start, or if after the first SignalGate, someone scrmabled to find a supplier who could "make their Signal compliant" (which is exactly what TeleMessage/Smarsh are selling)
According to this tweet the government contract for the software was originally from 8/24 during the Biden administration: https://x.com/_MG_/status/1918148557670105354
Can you quote the contents of this tweet for those of us without Twitter accounts?
You can still read the tweet without an account.
Just replace x.com with xcancel.com
I am pretty sure China has some backups too.
cutting the middle man is very neo lib of you. you may have a bright future in this administration.
also keeping government honest and open is also very libertarian. covering all fronts.
also keeping government honest and open is also very libertarian. covering all fronts.
This news story has been strange for me for awhile because on one hand NO our public officials should not be using Signal, but it isn’t because Signal is a bad technology choice. Signal is great. It’s probably the most useable service that’s verifiably secure.
Speculation, as no 'technical' analysis could be performed without access to the actual binaries. These aplications are unlisted and otherwise assigned to organisations using device management. This analysis is based on documentation and how this assignment process works. There is no way to determine if an original application got modified, as this would be the same for the WeChat, WhatsApp applications, or that they recompiled the open source version?
There are images from the user's screen, with him on the photograph using the application, showing the chats from the app reproduced verbatim (forwarded) to a GMail account.
The article states that "at least one line of code must've been added" to support such a feature, which I believe to be an honest and accurate assessment.
The article states that "at least one line of code must've been added" to support such a feature, which I believe to be an honest and accurate assessment.
But it is unknown if the current version was modified to do so. As the name "TM SGNL" looks shortened to fit after hex editing the app. This can all have been achieved by library overloads etc.
> One line
This can also be a single JMP and RTS statement, to a function that makes a screenshot, or something that takes the message.
No technical analysis of a working application has been performed. Just speculation of how this could work. I am not saying Micah is wrong. I just hoped more was available, so an actual disassemble was possible.
I would speculate that they did not recompile from source, but used the same process as used by the other applications. Intrusive by modification of the code execution, by injection, etc. That is speculation from my end, but reuses similar approaches across all of their applications.
> One line
This can also be a single JMP and RTS statement, to a function that makes a screenshot, or something that takes the message.
No technical analysis of a working application has been performed. Just speculation of how this could work. I am not saying Micah is wrong. I just hoped more was available, so an actual disassemble was possible.
I would speculate that they did not recompile from source, but used the same process as used by the other applications. Intrusive by modification of the code execution, by injection, etc. That is speculation from my end, but reuses similar approaches across all of their applications.
I presume that there is an official application that has
been created by the US military / NSA / some other entity
to facilitate secure encrypted messaging for a presidential
administration?
If such a beast exists what is it called? How does it work?
I would more expect it to be a specific combination of hardware physically approved phones and software.
Did the prior administration use it exclusively?
I remember Obama allegedly refusing to part with his Blackberry.
If such a beast exists what is it called? How does it work?
I would more expect it to be a specific combination of hardware physically approved phones and software.
Did the prior administration use it exclusively?
I remember Obama allegedly refusing to part with his Blackberry.
SCIF - Sensitive compartmented information facility. Officials are often not too far away from one (including in their own home), and can usually get to one in less than 5 minutes.
From my understanding, the BlackBerry thing was largely for personal use.
From my understanding, the BlackBerry thing was largely for personal use.
For classified communication there are SME-PED devices.
The decision to use a signal knockoff was a planned and managed one, not just on a whim. Who's responsible for managing the phones?
It's not really a knockoff, it's a deliberately cracked version of a B2C app to adapt it to a corporate setting
The Signal client app is open source; it's probably not reasonable to describe a modified version as "cracked". Signal does discourage the use of modified clients for security reasons, but does not actively block most of them.
harrisrobin(1)
Installing Signal using this method provides none of the guarantees Signal can normally provide by being an open verifiable application. It not only opens you up to state actors, but also IT folks like us. This is very much tech news. It helps explain why MDM is both critically important for businesses and terrible for security.
Here is the thing about e2e encrypted messengers: They lock you and your data in and do not allow you control of your life. There is a right to data portability (at least in the eu) that they violate and there is no one fighting for it. Whenever i engage in conversation about this i get empty faces, hostility and vague references to features that are crippled or just don't work at all. There are people and institutions that have to archive the communication centrally and they don't have control over how they are contacted and cannot have conversation about the channel used in every interaction all the time. The solution is to finally force messengers to allow api access to all communication data and then show a sign similar to ssl warnings in browsers to the other side that this user is using an archival api service.
There's a difference between data transport and data hosting. Modern expectations of messengers seem to blur this line and it's better if it's not blurred.
Incidentally: The reason why they blur it is because of 2 network asymmetries prevalent since the 1990's that enforced a disempowering "all-clients-must-go-through-a-central-server model" of communications. Those 2 asymmetries are A) clients have lower bandwidth than servers and B) IPv4 address exhaustion and the need/insistence on NAT. It's definitely not practical to have a phone directly host the pictures posted in its group chats, but it would be awesome if the role of a messaging app's servers was one of caching instead of hosting.
In the beginning though: the very old IRC was clear on this; it was a transport only, and didn't host anything. Anything relating to message history was 100% a client responsibility.
And really I have stuck with that. My primary expectation with messaging apps is message transport. Syncing my message history on disparate devices is cool, and convenient, but honestly I don't really need it in a personal capacity if each client is remembering messages. I don't understand how having to be responsibile for the management of my own data is "less control of my life," it seems like more control. And ... I'm not sure I care about institutional entitlement to archive stuff that is intended to be totally personal.
I understand companies like to have group chats, and history may be more useful and convenient there, but that's why I'm not ever going to use Teams for personal purposes. But I'm not going to scroll back 10 years later on my messaging apps to view old family pictures. I'm going to have those saved somewhere.
Incidentally: The reason why they blur it is because of 2 network asymmetries prevalent since the 1990's that enforced a disempowering "all-clients-must-go-through-a-central-server model" of communications. Those 2 asymmetries are A) clients have lower bandwidth than servers and B) IPv4 address exhaustion and the need/insistence on NAT. It's definitely not practical to have a phone directly host the pictures posted in its group chats, but it would be awesome if the role of a messaging app's servers was one of caching instead of hosting.
In the beginning though: the very old IRC was clear on this; it was a transport only, and didn't host anything. Anything relating to message history was 100% a client responsibility.
And really I have stuck with that. My primary expectation with messaging apps is message transport. Syncing my message history on disparate devices is cool, and convenient, but honestly I don't really need it in a personal capacity if each client is remembering messages. I don't understand how having to be responsibile for the management of my own data is "less control of my life," it seems like more control. And ... I'm not sure I care about institutional entitlement to archive stuff that is intended to be totally personal.
I understand companies like to have group chats, and history may be more useful and convenient there, but that's why I'm not ever going to use Teams for personal purposes. But I'm not going to scroll back 10 years later on my messaging apps to view old family pictures. I'm going to have those saved somewhere.
> Those 2 asymmetries are A) clients have lower bandwidth than servers and B) IPv4 address exhaustion and the need/insistence on NAT.
There's a third asymmetry: C) power-constrained clients which are asleep most of the time. And this applies not only to battery-powered phones/tablets and laptops, but also to modern desktops which are configured by default to suspend on inactivity.
There's a third asymmetry: C) power-constrained clients which are asleep most of the time. And this applies not only to battery-powered phones/tablets and laptops, but also to modern desktops which are configured by default to suspend on inactivity.
This is the reason IRC, which is a pure message transport, failed.
Molly is a fork of signal that is allowed to access Signals APIs and their APIs are much more open than any other similar service [1] . Signal is not really designed for communicating with people that you don't know in real life such that you can be beyond suspicion that they would be archiving messages but it is basically impossible to monitor if your conversations are being archived if someone is just taking pictures of their phone with another device.
[1] https://github.com/mollyim/mollyim-android
[1] https://github.com/mollyim/mollyim-android
I don't understand this: there's nothing intrinsic to e2e that makes interoperability particularly hard. There are multiple open-source e2e protocols that demonstrate this tidily, and my understanding is that there are governments in the EU that are adopting e.g. Matrix for this reason.
> show a sign similar to ssl warnings in browsers to the other side that this user is using an archival api service.
There is no sound way to do this and there probably never will be, especially if the protocol is interoperable and therefore the user can pick any client they please. The other client can always lie about what it's doing or circumvent detections through analogue means, e.g. pointing a camera at the screen.
> show a sign similar to ssl warnings in browsers to the other side that this user is using an archival api service.
There is no sound way to do this and there probably never will be, especially if the protocol is interoperable and therefore the user can pick any client they please. The other client can always lie about what it's doing or circumvent detections through analogue means, e.g. pointing a camera at the screen.
If you have interoperability, then you need cipher negotiation between clients with different capabilities (and they will always have different capabilities), and that's a huge, juicy attack surface. Multiple critical SSL/TLS CVEs-- including some we know for a fact the NSA relied on-- came from cipher negotiation.
> If you have interoperability, then you need cipher negotiation between clients with different capabilities (and they will always have different capabilities), and that's a huge, juicy attack surface.
Not really. The degree of malleability in cipher negotiation is widely considered to have been a Bad Move in SSL/TLS's early design, and modern (well-designed) cryptographic protocols don't enable the kinds of parametric malleability that made SSL/TLS so exploitable at the time.
Signal's protocol, for example, is perfectly interoperable; the lack of interoperability comes from a (not unreasonable) constraint at the application layer, not the protocol itself. Another example would be MLS[1], which supports fixed suites rather than parametric malleability and uses the technique from RFC 8701[2] to prevent clients from getting clever and trying to add their own extensions that undermine the fixed suites.
[1]: https://datatracker.ietf.org/doc/rfc9420/
[2]: https://www.rfc-editor.org/rfc/rfc8701.html
Not really. The degree of malleability in cipher negotiation is widely considered to have been a Bad Move in SSL/TLS's early design, and modern (well-designed) cryptographic protocols don't enable the kinds of parametric malleability that made SSL/TLS so exploitable at the time.
Signal's protocol, for example, is perfectly interoperable; the lack of interoperability comes from a (not unreasonable) constraint at the application layer, not the protocol itself. Another example would be MLS[1], which supports fixed suites rather than parametric malleability and uses the technique from RFC 8701[2] to prevent clients from getting clever and trying to add their own extensions that undermine the fixed suites.
[1]: https://datatracker.ietf.org/doc/rfc9420/
[2]: https://www.rfc-editor.org/rfc/rfc8701.html
what is going on in the US gov IT?
They took an Israeli app, that is a modified version of signal. the modification BREAKS the one thing signal is excellent at (keeping your messages encrypted so that only the desired endpoints can read them), then distributed it within the US Gov.
This is insanity!
US's enemy's couldn't manufacture a better result themselves!
They took an Israeli app, that is a modified version of signal. the modification BREAKS the one thing signal is excellent at (keeping your messages encrypted so that only the desired endpoints can read them), then distributed it within the US Gov.
This is insanity!
US's enemy's couldn't manufacture a better result themselves!
The messages do need to be recorded in a way that can be read by people other than the intended recipients due to federal record keeping laws. I’m curious if this particular app has been in use for a long time within the government and only recently became a target after it was accidentally revealed in that cabinet meeting photo.
They have a mandate to record conversations, so they modify the app to record conversations. I don't see the problem?
This is much less illegal than the other explanation - that they were using Signal to avoid having conversations recorded.
If you have a problem, you should have a problem with the mandate to record all conversations, not with installing a modified app to do it. If the person wasn't told this was happening, you should have a problem with that too, although who would accept a phone from the government and then not think it's tapped?
This is much less illegal than the other explanation - that they were using Signal to avoid having conversations recorded.
If you have a problem, you should have a problem with the mandate to record all conversations, not with installing a modified app to do it. If the person wasn't told this was happening, you should have a problem with that too, although who would accept a phone from the government and then not think it's tapped?
It's not just the US gov - TeleMessage/Smarsh sell to everyone: banks, corporations etc. Their USP is that your employees get to "keep using their apps" but still comply with all the boring data retention stuff - instead of using a dedicated corporate chat app
What's interesting is that they also sell a hacked version of WhatsApp, and the Meta legal team haven't steamrolled them yet
What's interesting is that they also sell a hacked version of WhatsApp, and the Meta legal team haven't steamrolled them yet
> US's enemy's couldn't manufacture a better result themselves!
in the game of nationalist geopolitics, it's only a matter of time before a current strategic ally becomes an enemy. it's the natural order of nationalism at global scale.
in the game of nationalist geopolitics, it's only a matter of time before a current strategic ally becomes an enemy. it's the natural order of nationalism at global scale.
You have to archive messages in some sectors by law, fine. But taking an E2E encrypted app and decrypting and storing the messages in plain text is a brain dead solution.
You get a group of people, say 5, and you generate a Shamirs Secret Split key requiring a minimum of 3 shares to recover, call it the archive key, with each share encrypted to one of those people. You have the modified apps encrypt chat logs every day to a new one time use key, and encrypt that to the Archive key, and upload the encrypted logs somewhere all can access.
Now 3 people in that set of 5 people get a subpoena to disclose logs in a given time period. Each one can consent to using their archive key in an ephemeral secure enclave server to decrypt the daily log keys in the requested date ranged, and decrypt the requested logs.
This way everything is end to end encrypted unless M-of-N people agree to decrypt specific archived logs to comply with a court order.
This shit is not that hard and with the budget of the White House there are 0 excuses for not running a private server and end to end encrypted chat apps with reproducible builds using archive tactics along the lines I just described.
But, I am also not mad at them making public fools of themselves either.
You get a group of people, say 5, and you generate a Shamirs Secret Split key requiring a minimum of 3 shares to recover, call it the archive key, with each share encrypted to one of those people. You have the modified apps encrypt chat logs every day to a new one time use key, and encrypt that to the Archive key, and upload the encrypted logs somewhere all can access.
Now 3 people in that set of 5 people get a subpoena to disclose logs in a given time period. Each one can consent to using their archive key in an ephemeral secure enclave server to decrypt the daily log keys in the requested date ranged, and decrypt the requested logs.
This way everything is end to end encrypted unless M-of-N people agree to decrypt specific archived logs to comply with a court order.
This shit is not that hard and with the budget of the White House there are 0 excuses for not running a private server and end to end encrypted chat apps with reproducible builds using archive tactics along the lines I just described.
But, I am also not mad at them making public fools of themselves either.
They took down the source code page: https://www.telemessage.com/developer/api-libraries/
Screenshot of previous version: https://0x0.st/8Jqf.png
Screenshot of previous version: https://0x0.st/8Jqf.png
Kinda curious why meta isnt the one developing these government versions of messaging apps. Seems like a nice side biz
So this whole app exists because Signal doesn't have a way to archive messages on iPhone. Maybe they should take the hint and see that this is actually something a lot of people would find useful, instead of keeping it the backlog for a decade.
It's not a question of archiving on the device - it's a question of your employer being able to archive/monitor your conversations
[deleted]
Well no, then you could just use Messenger or WhatsApp. The point of Signal is to be as secure as possible
TeleMessage/Smarsh also sell a cracked WhatsApp :)
[edit: apparently I responded to the wrong post. uh, oops. that's embarrassing.]
I would say, you maintain a blog where you demonstrate your skill and knowledge. As a side effect, I’m pretty lots of people here would be interested to read your debugging, design process, etc :)
Sorry I nuked my comment after realizing it was in the wrong article but I wanted to say I appreciate the response. I’m a decent writer (which is why I think I should probably get around to applying to 0xide) but finding time to blog with a full time job and a kid is hard. Not that that’s an excuse.
That’s a decent excuse! Your time with your kid definitely takes priority :)
Wishing you all, the best!
Is this feigned incompetence. Perhaps a cry for help, or a calculated disclosure?
I can't imagine anyone who would make the mistakes this guy makes, yet here he is; freely using his computer in clear view of a reporter with a camera.
I can't imagine anyone who would make the mistakes this guy makes, yet here he is; freely using his computer in clear view of a reporter with a camera.
Its just what it appears. Occam's razor
[deleted]
From what I have read, the various secretaries have a
"work" phone and a private phone.
The work one is hardened and communicates on a secured
government VPN system
Wait, wait, wait.
Did TM SGNL archived conversations at a central server for later dissemination in an decryptable manner at the central server?
Did TM SGNL archived conversations at a central server for later dissemination in an decryptable manner at the central server?
To me the shocking thing about the USA Gov't is that they manage to lose trillions in the defense dept that they can't account for, but somehow are unable to develop their own communications apps? What? Signing messages with a crypto key takes like 4 lines of code. It's not rocket science. Yet they use some corporate app?
My only theory is that they're pretending to have only 'Signal' so that when they want to they can allow hackers to "see" stuff they WANT to be seen. Like a disinformation honey pot designed to misdirect America's enemies. While they actually have a totally separate secret app that is secure and is developed by the NSA.
My only theory is that they're pretending to have only 'Signal' so that when they want to they can allow hackers to "see" stuff they WANT to be seen. Like a disinformation honey pot designed to misdirect America's enemies. While they actually have a totally separate secret app that is secure and is developed by the NSA.
You are severely overestimating the intelligence levels of the people currently occupying the halls of power in America.
I don't think the current administration came up with the idea of using Signal. However whatever team did was pretty "security illiterate" (to use a polite phrase), unless the NSA is secretly operating Signal from the inside. It's hard to know which is the case.
There are 2 secure messaging apps in the US govt according to reporting. But I dunno maybe they didn't have emojis....
I heard they use "Signal" as an official app. That blew my mind. Sure they must have others, but why are they even allowed to use commercial apps at all? That's insane.
enjoyed this but not sure how technical it is if you can't actually look at or disassemble the app in question.
You can. The author made the source code of the app itself available: https://micahflee.com/heres-the-source-code-for-the-unoffici...
oh a bigger analysis is inbound from the author! Excellent.
OK, so now a foreign power has dirt on senior US officials as well as operational details about their plans. The first possibility leads to blackmail, the second to defeat, and both to scandal.
As far as I know, there is no mechanism in the US for this to be a scandal or a -gate, or for punitive accountability, due to the parties involved. It will be a bit of a story for a few days then swept under the rug based on precedent.
[deleted]
Mike should have used a GDPR-enabled app.
There is new reporting that a hacker has breached the parent company, TeleMessage, including live data being passed across servers in production.
https://www.404media.co/the-signal-clone-the-trump-admin-use...
It was marked as a DUPE of this discussion, despite being a major new development https://news.ycombinator.com/item?id=43890034 Hopefully that decision can be reconsidered
https://www.404media.co/the-signal-clone-the-trump-admin-use...
It was marked as a DUPE of this discussion, despite being a major new development https://news.ycombinator.com/item?id=43890034 Hopefully that decision can be reconsidered
You can just link the new development in an ongoing story that's already on the front page, just like you did. The alternative would be a second front page thread which splits the discussion and is worse all-round.
That's a fair point, and it's your call - however, if the new (major) development is covered in this way then 1) users on the front page won't see mention of it at headline level and 2) the discussion of that development on HN will be affected by/limited to the time-decay of a post that is 12 hours older. I understand that there are tradeoffs at play, it really comes down to if the development at hand is big-enough to justify another post, and, again, that's your call.
I concur. An analysis of potential risks and vulnerabilities is a different beast from actual proof that the app has indeed been hacked. I call for the other discussion to be restored.
Edit: Wanted to respond to the top-level comment but you get the point.
Edit: Wanted to respond to the top-level comment but you get the point.
It's not my call, I'm just explaining how HN typically works. If you want some story handled differently, you should send an email to [email protected]. But 'two or more things about the same thing on the fp at the same time' is a big barrier to overcome, it almost never happens.
There is mod commentary on 'people might miss things because of the title' as well, it's mostly 'it's ok for people to click through the story or thread to figure things out' and that's also a fairly longstanding 'how HN works most of the time' thing.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
The operating assumption here is that people are smart enough to follow the developments in the story themselves - in the the thread and outside.
There is mod commentary on 'people might miss things because of the title' as well, it's mostly 'it's ok for people to click through the story or thread to figure things out' and that's also a fairly longstanding 'how HN works most of the time' thing.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
The operating assumption here is that people are smart enough to follow the developments in the story themselves - in the the thread and outside.
> The data includes apparent message contents; the names and contact information for government officials; usernames and passwords for TeleMessage’s backend panel; and indications of what agencies and companies might be TeleMessage customers.
http://archive.today/HqMvy
It's insane that this isn't front page news. This takes the original Signalgate breach to an order of magnitude higher level of severity.
It's insane that this isn't front page news. This takes the original Signalgate breach to an order of magnitude higher level of severity.
[deleted]
There seems to be a coordinated and consistent campaign to bury submissions from 404 Media on HN. Hopefully something can be done about that, too.
In August last year I got this from dang when reporting a dead 404 link: "The site 404media.co is banned on HN because it has been the source of too many low-quality posts and because many (most?) of their articles are behind a signup wall."
Not that I've really seen the low quality and the signup requirement doesn't stop other domains. There's quite a few things that originated from 404, so I hope HN gets over whatever it was that annoyed them originally.
Not that I've really seen the low quality and the signup requirement doesn't stop other domains. There's quite a few things that originated from 404, so I hope HN gets over whatever it was that annoyed them originally.
The main issue is the (sometimes) hard signup wall. I've been a moderator on HN for longer than 404media has existed, and I know from experience that this changes from time to time or article to article. Other paywalled sites that appear on HN (WSJ, NYT etc) have a porous paywall; you can (almost) always get around it by using an archive site like Archive.today.
If it's a good article (contains significant new information and can be a topic of curious conversation) and a paywall workaround works for that article, we'll happily allow it.
If it's a good article (contains significant new information and can be a topic of curious conversation) and a paywall workaround works for that article, we'll happily allow it.
If they do their own, original, investigative reporting, you may want to be a bit more permissive.
Since HN doesn't really facilitate any workarounds anyway and we've been doing manual archive links and content reposting as needed in other cases... I suspect we can handle 404 as well as a community.
Even porous paywalls can have a marked effect on story performance on HN.
The New York Times tightened its paywall markedly in August 2019, with a net effect that appearances in the top-30 stories on HN's front-page archive (the "Past" links in the site header) fell to ~25% of their previous level.
I'd asked dang at the time if HN had changed any of its own processes at the time. Apparently not.
I suspect then that this reflects frustrations and/or inability to access posted articles behind the paywall.
See: <https://news.ycombinator.com/item?id=36918251> (July 2023)
The New York Times tightened its paywall markedly in August 2019, with a net effect that appearances in the top-30 stories on HN's front-page archive (the "Past" links in the site header) fell to ~25% of their previous level.
I'd asked dang at the time if HN had changed any of its own processes at the time. Apparently not.
I suspect then that this reflects frustrations and/or inability to access posted articles behind the paywall.
See: <https://news.ycombinator.com/item?id=36918251> (July 2023)
[deleted]
https://archive.is/2025.05.04-225615/https://www.404media.co...
Why are these being instantly marked as dead?
Why are these being instantly marked as dead?
Seems to be a censorship campaign targeting 404 Media. Been going on for at least weeks.
Submissions from some domains aren’t prevented but automatically get deaded. It’s not a campaign.
See https://news.ycombinator.com/item?id=43891088 in which a user reports that moderator dang said why that happens for this domain.
See https://news.ycombinator.com/item?id=43891088 in which a user reports that moderator dang said why that happens for this domain.
Sounds like the definition of a censorship campaign, implemented by HN itself.
The fact that archive link works should make this eligible for unflagging. From tomhow (mod)
> If it's a good article (contains significant new information and can be a topic of curious conversation) and a paywall workaround works for that article, we'll happily allow it.
> If it's a good article (contains significant new information and can be a topic of curious conversation) and a paywall workaround works for that article, we'll happily allow it.
Anything with a potentially negative impact on Musk, Trump or DOGE seems to get flagged immediately. Coordinated or not it extremely frustrating people flag rather than honestly engage.
I appended a 'd' to the end of the title to pre-empt objections that they're not still using it. If it's known for sure that they are, we can de-'d' that bit.
Edit: this subthread is obsolete now - I took a phrase from the author's update to the article to use as the title above.
Edit: this subthread is obsolete now - I took a phrase from the author's update to the article to use as the title above.
honest question, but you decided to go against the "don't change titles" rule to choose one unprovable point until another just as unprovable point is proven? it could be argued both ways with the same argument.
"Used" still allows "use" in the mitch-hedbergian sense.
There's no "don't change titles" rule, though it's interesting how the actual rule gets truncated to that in people's minds! Here's the actual rule:
"Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html
In this case I was thinking of both the 'misleading' and 'linkbait' bits of that 'unless'. (By the way, this is common HN moderation practice—bog standard, as I often say.)
> to choose one unprovable point until another just as unprovable point is proven
You might have a, er, provable point if that were the case! but I'm taking for granted that the officials in question did actually use this client, so "used" is known while "use" (which I took to mean "are still using") isn't yet known for sure. Did I miss something?
Edit: btw, in case anyone's wondering why we left the submitted title up instead of reverting it to what the article says, one reason is that the submitted title struck me as arguably less linkbaity (and therefore ok under the rule) and the other reason is that we cut authors a bit of slack when they post their own work.
"Please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html
In this case I was thinking of both the 'misleading' and 'linkbait' bits of that 'unless'. (By the way, this is common HN moderation practice—bog standard, as I often say.)
> to choose one unprovable point until another just as unprovable point is proven
You might have a, er, provable point if that were the case! but I'm taking for granted that the officials in question did actually use this client, so "used" is known while "use" (which I took to mean "are still using") isn't yet known for sure. Did I miss something?
Edit: btw, in case anyone's wondering why we left the submitted title up instead of reverting it to what the article says, one reason is that the submitted title struck me as arguably less linkbaity (and therefore ok under the rule) and the other reason is that we cut authors a bit of slack when they post their own work.
the "use" assume nothing happened after the report (app still in managed domain). "used" assume an extra action taking place, which is a stretch imo.
but i assumed wrong that you added the "d", not that you're only exempting the submitter title. thanks for the insight into your always nice moderation.
follow up question: you work seven days a week??
but i assumed wrong that you added the "d", not that you're only exempting the submitter title. thanks for the insight into your always nice moderation.
follow up question: you work seven days a week??
I did add the 'd' but I am sorry to say that all information associated with that instance of that letter has already been flushed out of my memory.
> you work seven days a week??
By no means all day every day, but yes in the sense that my hours get distributed semi-randomly.
> you work seven days a week??
By no means all day every day, but yes in the sense that my hours get distributed semi-randomly.
> i assumed wrong that you added the "d"
dang seems to be saying that he did add the “d” though?
FWIW I would have preferred it to be just left as “uses” per the article title.
dang seems to be saying that he did add the “d” though?
FWIW I would have preferred it to be just left as “uses” per the article title.
> 404 Media journalist Joseph Cox published a story pointing out that Waltz was not using the official Signal app, but rather "an obscure and unofficial version of Signal that is designed to archive messages"
Wow. And that's while their entire point of using Signal is to have conversations scrapped after a week to leave no no traces of criminal activity.
Wow. And that's while their entire point of using Signal is to have conversations scrapped after a week to leave no no traces of criminal activity.
Do you think they are using the message archiving version so that they can meet organizational message retention requirements? Maybe they are using signal to ensure they have e2e encrypted messaging on their devices?
There are already government e2e apps. The only reason to use something else is to have selective auto-deletion and/or to use personal devices for official classified data.
Another reason: all of the folks on that group chat have legitimate reasons to have contacts on their phone that would be outside government apps. Foreign leadership. Journalists. Etc.
Signal is likely to be one of the main ways of communicating with those.
Signal is likely to be one of the main ways of communicating with those.
Using separate apps for government and external communication might have prevented the recent scandal.
It wouldn't actually. The contact in his phone (incorrectly added by Apple AI from a forwarded email) would be the same regardless which app he was using.
Instead, Signal (and this forked version) would have to do its own independent contact management, maybe based on in-person scanning of QR codes plus web-of-trust.
Instead, Signal (and this forked version) would have to do its own independent contact management, maybe based on in-person scanning of QR codes plus web-of-trust.
The contact (a journalist) wouldn't be reachable on a government messaging app.
[deleted]
Do you have the link to this alleged government-produced e2e software so we can inspect ourselves? I realize they have an incentive to appear incompetent, but surely there must be evidence (further than your testimony) of such gossip popping up somewhere
There are not just government e2e apps, but government-provided and customised smartphones specifically for them, like the DMCC-S programme. [0]
Some of the apps are listed in that brochure.
There's no excuse for using Signal on personal devices for classified conversations.
[0] https://www.disa.mil/~/media/files/disa/fact-sheets/dmcc-s.p...
Some of the apps are listed in that brochure.
There's no excuse for using Signal on personal devices for classified conversations.
[0] https://www.disa.mil/~/media/files/disa/fact-sheets/dmcc-s.p...
Are the apps usable? The jargon seems intentionally impenetrable. The editor of that document should be shot every time they used an acronym. Like i get the DOD is a profitable dick to suck but this is just embarrassing for a document intended for the public.
Anyway can you link the source? That's presumably the useful half. The marketing bit doesn't add anything.
Anyway can you link the source? That's presumably the useful half. The marketing bit doesn't add anything.
I don't care how usable they are, this is the DoD and NSA-approved mechanism for conducting classified conversations and viewing classified data on mobile devices. The adversaries here are other countries who are very good at what they do, security is far more important than convenience.
As for further research, there's plenty online about his programme and these devices. Feel free to Google it yourself. You're asking to be spoonfed.
As for further research, there's plenty online about his programme and these devices. Feel free to Google it yourself. You're asking to be spoonfed.
So, I think it's pretty straighforward.
First, they are not supposed to use personal devices for classified conversations.
But they are allowed to use ordinary consumer devices for non-classified conversations. That even if not classified, they still might want to be secure -- or to communicate with other people who prefer signal.
But those conversations need to be archived, per government policy.
So on their ordinary consumer devices have a version of Signal on it that archives, to meet ordinary government policies.
This is all ordinary, and I believe probably the previosu administraiton had the same thing.
The only non-ordinary thing is that they insisted on using the consumer devices for classified conversations even though it violates policy, so just use the 'best' app on there for that. Which is not good enough, because you are not supposed to be having conversations including classified material on ordinary consumer devices, because they are not secure enough.
First, they are not supposed to use personal devices for classified conversations.
But they are allowed to use ordinary consumer devices for non-classified conversations. That even if not classified, they still might want to be secure -- or to communicate with other people who prefer signal.
But those conversations need to be archived, per government policy.
So on their ordinary consumer devices have a version of Signal on it that archives, to meet ordinary government policies.
This is all ordinary, and I believe probably the previosu administraiton had the same thing.
The only non-ordinary thing is that they insisted on using the consumer devices for classified conversations even though it violates policy, so just use the 'best' app on there for that. Which is not good enough, because you are not supposed to be having conversations including classified material on ordinary consumer devices, because they are not secure enough.
I don't think it follows that they selected the archiving messenger because they wanted disappearing messages. The whole disappearing messages thing was just internet speculation.
No it was reported by the journalist who was in the chat.
> Waltz set some of the messages in the Signal group to disappear after one week
https://www.theatlantic.com/politics/archive/2025/03/trump-a...
> Waltz set some of the messages in the Signal group to disappear after one week
https://www.theatlantic.com/politics/archive/2025/03/trump-a...
[deleted]
Whether it was for that purpose or not, the messages did wind up disappearing. The CIA admitted it in a court filing.
https://www.nytimes.com/2025/04/15/us/politics/cia-director-...
https://www.nytimes.com/2025/04/15/us/politics/cia-director-...
This TM SGNL app is compatible with legit Signal clients and servers.
It’s also possible that they are using this app to archive chats that other parties _believe_ to be disappeared.
In other words, set your chats to disappear in 5 minutes and convince your target to dish some sensitive info. They think it’s off the record, but it’s instantly archived
It’s also possible that they are using this app to archive chats that other parties _believe_ to be disappeared.
In other words, set your chats to disappear in 5 minutes and convince your target to dish some sensitive info. They think it’s off the record, but it’s instantly archived
The counterparty should be naive or stupid to think that whatever they send has no chance to be recorded forever. They should always assume otherwise.
The only interesting use case of disappearing messages is that messages one receives will disappear securely, even if they forget about receiving such messages, or have no access to the device at the time.
The only interesting use case of disappearing messages is that messages one receives will disappear securely, even if they forget about receiving such messages, or have no access to the device at the time.
Naive or stupid? No way, not the counterparties of alcoholic media personalities.
[deleted]
You can turn off message disappearance with the app store app so this seems like a red herring.
Maybe they wanted to use Signal to thwart eavesdropping but they had to modify it in order to comply with govt record retention requirements?
this appears to be the most concise answer. TM SGNL provides interop with Signal users in the field, but also includes FOIA archiving.
who manages the archiving service is a general government problem, and less of one for Signal or appointees. NSA should have been operating the archiving service and not a foreign country imo.
who manages the archiving service is a general government problem, and less of one for Signal or appointees. NSA should have been operating the archiving service and not a foreign country imo.
Distantly reminds me of the Nixon tapes ... what could go wrong?
I wonder what the people he communicated with knew / thought?
I wonder what the people he communicated with knew / thought?
What? The point of Signal is not message scraping, but a good E2E encryption. Message scraping is just one feature the app provides that you can turn of if you wish.
[deleted]
[deleted]
[deleted]