827
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 04 May 2025
827 points (99.8% liked)
politics
31086 readers
1788 users here now
Welcome to the discussion of US Politics!
Rules:
- Post only links to articles. Title must fairly describe link contents. If your title differs from the site’s, it should only be to add context or be more descriptive. Do not post entire articles in the body or in the comments.
Links must be to the original source, not an aggregator like Google Amp, MSN, or Yahoo.
Example:
- Articles must be relevant to US politics and contain quality and original content. Social Media adjacent hosts like Substack are allowed, but ONLY if they tie back to a company/subsidiary. No personal or friend group blogs and no self-promotion. Articles should be worth reading. Clickbait, stub articles, and re-hosted or stolen content are not allowed. Check your source for Reliability and Bias here.
- Be civil, No violations of TOS. It’s OK to say the subject of an article is behaving like a (pejorative, pejorative). It’s NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing other users of being bots or paid actors.
- No memes, trolling, misinformation, or low-effort posts/comments (including reposts). If you see posts like this that anger you, do not engage. Report, block, and live a happier life than they do. Any slap-fight is subject to comment removals. Fights full of rule violations will result in temporary bans to cool off.
- No manipulating votes via bots or alt accounts; this will result in permanent bans. Vote based on comment quality, not agreement. This community aims to foster discussion; please reward people for putting effort into articulating their viewpoint, even if you disagree with it.
- No hate speech, slurs, celebrating death, advocating violence, or abusive language. This will result in an account ban. Usernames containing racist, or inappropriate slurs will be permanently banned.
We ask that the users report any comment or post that violate the rules and use critical thinking when reading, posting, and commenting. Users that repeatedly have comments or posts removed, weaponize reports, or violate the code of conduct, will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users. The reason(s) behind moderator action(s) are publicly available through the Modlog.
That's all the rules!
Civic Links
• Congressional Awards Program
• Library of Congress Legislative Resources
• U.S. House of Representatives
Partnered Communities:
• News
founded 3 years ago
MODERATORS
Actually, I'm more surprised people continue to believe the 'end to end' claims of these companies.
Signal makes it believable by providing source code and reproducible builds. It doesn't rule out the possibility that they've done something clever with the random number generator, or have the app store you use give you a compromised app, or provide any protection against endpoint compromise, but it's about as good as you can get.
Third party apps derived from theirs, which explicitly promise to log all your messages to a server somewhere, like TeleMessage, are, for obvious reasons, far less trustworthy.
Question: how can they even claim it’s e2ee if they also claim to log all the messages? Or is the claim that they log the messages in encrypted form? In which case any client(s) with the only copy of the keys could delete them, making the logs useless.
Who are the various "they"s in that question?
Signal claims that if you use the Signal app, it's end-to-end encrypted. The Trump admin was using an unofficial Signal-compatible app TM SGNL which probably didn't make those claims. And, Signal definitely never claimed that TM SGNL was end-to-end encrypted. In fact, it's likely TeleMessage violated the copyrights and trademarks belonging to Signal with their app.
But, in the end, the messages were still technically end-to-end encrypted. It's just that as soon as the messages arrived at one of those ends, they were sent to TeleMessage who archived them unencrypted in AWS. It's still end-to-end encrypted, it's just that one of those ends is incredibly leaky.
oh... mygod.
Yeah. The level of incompetence is impressive. Full data and metadata for all customers all dumped together in one datastore, stored in the clear in AWS.
"The data includes apparent message contents; the names and contact information for government officials; usernames and passwords for TeleMessage’s backend panel; and indications of what agencies and companies might be TeleMessage customers."
...
"The server that the hacker compromised is hosted on Amazon AWS’s cloud infrastructure in Northern Virginia."
...
"“If I could have found this in less than 30 minutes then anybody else could too. And who knows how long it’s been vulnerable?” the hacker said. "
"I'll just put this together as proof of concept. I'll look at security later.
Okay great, it works, now no need to ever touch it again."
I don't know how they claim that would work. But it's important to note that only telemessage makes that claim, not signal.
Even with e2e security there is 2 e's that can get compromised, their use of a altered version of the app on one end is enough to cancel out the whole encryption part it, also on the other end.
But in this case it's like they have a lock for their garage door that is different from the lock on their car so they can't steal the car when somebody steals the key to the garage door, but then think they can leave the keys in the lock because there is a lock (encryption) on the doors.
Signal? Why wouldn't they? Why would they want to claim E2EE, then steal people's chats, and try really hard to make it completely invisible? Which would probably fail since it's FOSS. Not everything is a conspiracy. Sure, they will sell user's metadata eventually (if they aren't doing it already) or become a paid app, maybe even add advertisments, who knows (nothing is safe from enshittification).
TeleMessage is a different thing altogether. Their "claim" is pretty much the opposite: take a known E2EE app and make it completely transparent.