U.S. officials urge Americans to use encrypted apps amid unprecedented cyberattack

The Australian government tried to straight up ban encryption some years ago.

Different parts of the government. Both existed then and now. There has for a long time been a substantial portion of the government, especially defense and intelligence, that rely on encrypted comms and storage.

More like 23 years ago when the Patriot Act was signed, and every time it has been re-authorized/renamed since. Every President since Bush Jr. is complicit, and I'm getting most of them in the previous 70-ish years (or more) wish they could've had that bill as well.

They knew, they were putting backdoors when they needed them.

Now the new administration will take half of the blame in public opinion (that's how this works) and also half of the profits, so they won't investigate too strictly those who've done such things.

But also words don't cost anything. They can afford to say the obvious after the deed has been done.

End to end is end to end. Its either "the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them" or it's not.

Signal is a more trustworthy org, but google isn't going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.

If its not Open Source and Audited yearly, its compromised. Your best option for secure comms is Signal and Matrix.

Well yeah, to use RCS on Android, you need to use Google's Messenger app, so they can absolutely still get your data. Source from GrapheneOS.

I don't use RCS because I refuse to use Google's Messenger app. Simple as.

RCS is an industry standard, not a Google thing.

End-to-end encryption matters if your device isn't actively trying to sabotage your privacy.

If you run Android, Google is guilty of that.

If you run Windows in a non-enterprise environment Microsoft is guilty of that.

If you run iOS or MacOS, Apple is (very likely) guilty of that.

Yes, like Signal!
Which does not only use end-to-end encryption for communication, but protects meta data as well:

Signal also uses our metadata encryption technology to protect intimate information about who is communicating with whom—we don’t know who is sending you messages, and we don’t have access to your address book or profile information. We believe that the inability to monetize encrypted data is one of the reasons that strong end-to-end encryption technology has not been widely deployed across the commercial tech industry.

Source: https://signal.org/blog/signal-is-expensive/

I haven't verified that claim investigating the source code, but I'm positive others have.

Or alternatively, Molly

No, BPs are a risk. Better to avoid apps that require phone numbers

A good advice: start learning how to self host, specially a matrix instance.

All that happens under Dems, too. Stop giving them a pass.

Y’all keep hitting that downvote button. I’d like to know how many of you are ok with fascism when it’s a Dem at the helm.

In the voice of Nelson Muntz: "Nobody spies on our citizens but us!"

The reporter mentioned signal, though the gov spokespeople didn't seem to recommend any specific app

Use something where the client is open source.

Bets on this being directly related to back doors that US spy agencies demand be installed?

When a whole nation's communications are intercepted by another entity, yes, the bad part is that it's another nation. Especially an adversarial one.

This is not about individuals' personal privacy. It's about things that happen at a much larger scale. For example, leverage for political influence, or leaking of sensitive info that sometimes finds its way into unsecured channels. Mass surveillance is powerful.

Yes. Wars happen. Even corrupt politicians are nicer when their control base is inside the country.

You don't need technical knowledge to see the problem.

If you live in an apartment and your landlord has a master key, then all an attacker needs to do is get that master key. In an apartment complex, maybe that's okay because who's going to break in to the landlord's office? But on the internet, tons of people are trying to break in every day, and eventually someone will get the key.

Even for the landlord, I'd rather them have a copy of my key than a master key, because that way they'd need to steal my key specifically.

It was always recognized.

Every time I go to the Interwebs and read what people have to say on security, it's always the same high horse absolutism.

I've read Attwood's book on Asperger's syndrome a couple weeks ago. There such absolutism was mentioned as a natural trait of aspies, but one that, when applied to social power dynamics or any military logic, gets you assroped in jail.

People who want to spy on you or read all your communications understand too that general security suffers, but just not having that power is out of question for them, and also with the power they already have the security effect on them personally won't be too big.

It's a social problem of the concept of personal freedom being vilified in the Western world via association with organized crime, terrorism, anarchism, you get the idea.

It's not hard to see that the pattern here is that these things are chosen because they challenge state's authority and power, because, well, subsets of what's called organized crime and terrorism that can be prevented by surveillance are not what people generally consider bad, and anarchism is not something bad in any form.

What's more important, people called that do not need to challenge the state if the state is functional, as in - representative, not oppressive and not a tool for some groups to hurt other groups.

As we've seen in all the world history, what's called organized crime and what's called terrorism are necessary sometimes to resolve deadlocks in a society. It has never happened in history that a society could function by its formalized laws for long without breaking consistency of those. And it has never happened that an oppressed group\ideology\movement would be able to make its case in accordance with the laws made by its oppressor.

Why I'm typing all this - it's not a technical problem. It's a problem of bad people who should be afraid not being afraid and thus acting, and good people who should be afraid not being afraid and thus not acting.

“So it’s like a filter on the tubes?” - Our legislators

I go one further and also use public/private key pairs that my acquaintances must use to decrypt the scrambled letters I mail them.

I use some decoder ring I found in a cereal box, it's totally secure.

B̷̡̡̢̧̺̩̝̤̜̪̰͖̻̗͇͓͙͍̦̹̹͚̠̲͔͕̫̤͎̳̱̦̜̖̤͙̎͌͑̂̿̋͐͂̉͜͜͜ͅe̸̺̠̰̋̐͑͒͗͑̑͂̿͑͘͠͝ ̴̡̨̢̨̨̡̯̺̤̝͇̠̯͚͇̰͈͙͍͕̖͕͖̜̹̰̗͙̈̍̄͂́͜ṣ̵̡̞̰͎̝͙͚̘̞̓̊̿̂̉͐͐̐̀̍̂́͋̏́̚͘͠͠ư̴̧̧̨̧̝͙̰̗͓͉͚͇̻͇̝͖̞͙̤͙̞͔̯͈̙̗̰̖̺̼͕͇̗̂̎̐̅͊̔͋̄̿̅̎̍͂̏͘̚ͅṛ̶͙͙͚͖̭̆̄̎̔̾͛̏̈̽͌̎͋̿̈̌̃̃͑̑̏̐̽̎̉́̊̿̆̌̕͜͝͠e̵̛̝̱͓̐̂͊̀̓̑̈́̒̓́̂̿̒̒̔͌̆͌̎͆̓͂̂̏͆̑͜͝͝ ̶̧̧̳̮̬̤̱̯͚̜̜͔̞̰̠̼̩̘͖̹͕̥͔̰͎͖̩̠͇̭̭̺̮̔͊͛̉͐͗͛͌̓̂͐̇̔̑̓̐̇̀̅̿̿̃͛̈́̔̏͛̓͂̏̕̚̕͜͠͠ͅͅͅͅţ̵͔͂̋͌̋͊͗̇ơ̷̘̱͙̝͖͍̪̗̮̫͉͖̪͉̯͙͛̋̾̑͛̇́̑̒̓͐̀̇̓͒̾͛͆̾͗̒̕̚͘͜͝ ̶̧̡̢̭̥͚̱̲̮͙̠̼͉͖̞̩̞̰̠͍̭̭͖͖̻̜͖͇̬͎̮͙̦͗͌̈̌̍̔̋̔̈́̈́̃̍̓͌͒̉̓͐̓̏̓̃̇̅́̐̃̂̚̕͜͝͝d̸̢̨̢̧̢͔͚̼̩̮͖̭̥̮͓̭͇͖̞̰̞̰̋̓̊̈́̈̐̄̆͊̈͑̓̉͝͠ͅŗ̵̲͓̠̮͉̹͍̰̟̘̄̈́̈́̂̀̆͗̔̓̔̐̀̍̓̄̾̋͋̆̈́̓͐͊͒͋͂̓̽͌̂̊͂̔͋̓͌͐̈́̓͠͝ĩ̴̛̛̝̹͓͚̦̱̰̫̌̋͌̏̒́̇̂̅̎̄͒̏̎̈͊͊̽͘̕͜͝͝͝͠n̴̨̡̡̛͚͖̼̖̦͔̬̩̝̞͔̥͖̫̮͎̻͔̪͍͖̣̻̯͉̝̜͓̐̏̾̋̂͛́̍̄̿̔͛̉̾̏̆̍͋͒̂́̽̆͐̋̈͆̊̈̈́̽̔̏̏̎̕̚͘̚͠k̴̡̭̙̼̻̟͔̏̂ ̵̨͓̺̲͇͔̪͇͓̥̰͈̲͊́̂́͋̊̀̾̌͋̉͑̍̿̆̊͐͆̏̑̑͛̾̀̀̏͆̽́͝͠ỵ̶̡̝̺̙͇̪̮͚̣̓̍̐̄̉̇̀͋̔̀̂͒̾̋͘ǫ̴͇̝̤͕̮̺̦̼̪̯̟̼̳͙̼̃̈́́͗̓̊͑́̾̈́͘̕͜͝͠ͅͅų̷̢̛̭̟̭̖̟͇̪̦̪̳̯̟̬͉̬͉͎̫͎̮̜̠͔̝̜̭̪̤͆̆͋̉̆̓̽̋̀̆̌͝r̵̨̡̳͈̝͈̖͈̻̺̮͖̻͓͓͇̩͖̬̣̪͙̗̥̯̍̍͂͂́̑ͅ ̷̢̧̢̧̛̛̖̹͉̳͚̞̟̻̮̟͙̥̥͓͙̻̩̙̈̓͆͌̈́͊́̈́̎̑͗̑̆̀̈́͆̏ͅƠ̴̛̛̱̰̬̲̼̹̬̰̮͓̜̐̔̈́̾̓͆̔͂̂͂̂̓̏̾͐͌͘̕͘͝͝͝v̴̛̤̝̹͙̩͌̾̾̒͋͐͂̍̽̈́͛̎̆̋̓̔̀́̍͑͌͌͂͆̈̚̚̚͘͜͝͝ͅå̶̡̢̹̻͙͗͒̌̓̑̋̂̉̿̌̋͋̆͋͋̈́̋̎̀͝͝ĺ̶̡̨̨̨̛̻͙̘̖͍̥̝̺͔͙̱̼͙̱̀͌̃̍́͊̉͑̐ͅt̶̡̛͎͕̥͉̙̰̫̲̺̩̘̜̖͔̝̜̤̮͙̳̻̮̠̦́̌͌̍̑̃̿̔͒͗̑̏̎̿̉̀̀͊̽̃̽͌͆̏͗͗̋̈́̔̉́̒͗̑̊͜͝ͅį̴̡̢̡̪̥͉̩̯͎̩̤̺̙̩̳̘͓̣̮̰͔̯̘̰̖̪̻͉̣̖̬̩͉̦̃̂̍͜ͅͅņ̵̡̢̧̢̯̠͍͖͔̬̜̥̗̜͈̮͖̗̺̳̱̣̟̦̗͉̮̥̏̿͒̏͆̔̀͐̉̀͗͋͐͌͒̀́̿́͗͂́̏̂͊̑̅͝͝͝͝ȩ̶̨̡̨̫͉̱͉̦̫͇̪̼̰̺̩̘̼̬̝̘̥͖͎̬̺̀̓͋̄̂̉͝͝

Thanks I thought from reading this maybe Salt Typhoon was the codename for the next version of windows.

I mean, clearly not the SAME people.

We've long had NSA slides that showed Tor and e2ee solutions as "disastrous" to their visibility.

Att won't make money off that unless they offer it as a paid service. No reason to give that away for free and the other cell carriers can just pay off (bribe with campaign contributions) legislators to understand encryption is "too costly to implement at such a scale"

You mean RCS?

I'll raise you one better: use Signal (or simplex.chat if you're cool). Google and Apple control RCS, and carriers can still sniff metadata. Cut both groups out with a proper messenger.

the safest perspective to have is this -

every single thing you send online is going to be there forever. "the cloud" is someone's server and constitutes online. even end to end encryption isn't necessarily going to save you.

for example iCloud backup is encrypted. but Apple in the past has kept a copy of your encryption key on your iCloud. why? because consumers who choose to encrypt and lose their passwords are gonna freak out when all their data is effectively gone forever.

so when FBI comes a'knocking to Apple with a subpoena.. once they get access to that encryption key it doesn't matter if you have the strongest encryption in the world

my advice

never ever ever write something online that you do not want everybody in the world seeing.

to put on my tin foil hat, i believe government probably has access to methods that break modern encryptions. in theory with quantum computers it shouldn't be difficult

just wanted to add that deleting an app will not result in deletion of your data stored in the cloud (e.g. your emails)

That depends on the privacy protections where you live and the policies of each service:

• most places in the US - they already have your data and aren't obligated to delete it
• outside the EU - probably the same as the US
• the EU or select states (e.g. CA) - you have some protections and a legal obligation to honor delete requests

For the first two, I wouldn't bother. I personally poisoned my data with Reddit before leaving, because I've heard of then reversing deletions. For the third, deleting may make sense.

But in general, I'd keep your other accounts open until you fully transition to the new one.

Below is information when considering a replacement service.

Anything where data is stored on a server you don't directly control can be leaked or subpoenad from the org that owns that server. Any unencrypted communication can be intercepted, and any regular encryption (HTTPS) can be logged by that server (e.g. under court order without notifying the customer).

Even "secure" services can be ordered to keep logs. Here's an example from Proton mai, and here's one involving Tutanota.

So it depends on your threat model, or in other words, who you're trying to keep away from your data. Just think about how screwed you might be if:

• a hacker dumps the servers data
• a police agency secretly orders recording of data and metadata
• someone steals your device
• the police confiscate your device

The answers to the above should help you decide which to type of service you'd feel comfortable with, and what tradeoffs you're willing to make.

Wiping old stuff won't hurt, but they might not actually delete it.

Do what the Germans did in ww1 when they knew their diplomatic code was broken but couldn't change it. They put the important stuff in plain sight and treated it like junk mail and encoded the boring stuff.

You & others might be interested in this:
https://insights.sei.cmu.edu/library/field-stripping-a-weapons-system-building-a-trustworthy-computer-video/
and maybe this:
https://en.wikipedia.org/wiki/Intel_Management_Engine

Poe's law?

I vaguely recall Bruce Schneier saying that there is good evidence that the NSA cannot crack certain encryption methods. At the time, RSA was on the list. Maybe common methods mean roll-your-own corporate encryption, but it's my understanding that GNUpg and similar software are safe.