The Guardian and Cambridge University's Department of Computer Science unveil new secure technology to protect sources (www.theguardian.com)
from Davriellelouna@lemmy.world to technology@lemmy.world on 23 Jun 20:34
https://lemmy.world/post/31884392

Academic paper: www.cl.cam.ac.uk/techreports/UCAM-CL-TR-999.pdf

#technology

threaded - newest

hera@feddit.uk on 23 Jun 21:02 next collapse

Love seeing open source projects from companies that aren’t specifically tech firms

unexposedhazard@discuss.tchncs.de on 23 Jun 21:03 next collapse

Horrible name sadly

Mynameisallen@lemmy.zip on 23 Jun 23:01 next collapse

I saw the headline and was ready to rage about why they should just use signal instead. Then I read the article and honestly this is a fucking genius use of tech

Ulrich@feddit.org on 24 Jun 03:11 next collapse

I read it and don’t understand. Why is this better than Signal? Or the 500 other secure file/messaging protocols?

Jabber seemed to work perfectly for Snowden…

rosco385@lemmy.wtf on 24 Jun 04:02 next collapse

Because analysing network traffic wouldn’t allow an adversary to see what you’re sending with Signal, but they could still tell you’re sendig a secure message.

What the Guardian is doing is hiding that secure chat traffic inside the Guardian app, so packet sniffing would only show you’re accessing news.

DeathByBigSad@sh.itjust.works on 24 Jun 04:10 next collapse

I downloaded the guardian app and couldn’t find the option.

Ulrich@feddit.org on 24 Jun 04:22 collapse

analysing network traffic wouldn’t allow an adversary to see what you’re sending with Signal

How are they analyzing network traffic with Signal? It’s encrypted. And why does it matter if they know you’re sending a message? Literally everyone using Signal is sending a message.

Natanael@infosec.pub on 24 Jun 04:26 next collapse

Timing of messages. They can’t tell what you send, but can tell when

Ulrich@feddit.org on 24 Jun 04:28 collapse

No they can’t.

E: if someone wants to provide evidence to the contrary instead of just downvoting and moving on, please, go ahead.

Natanael@infosec.pub on 24 Jun 13:46 collapse

It’s called traffic analysis

Ulrich@feddit.org on 24 Jun 14:58 collapse

It’s called encryption

ICastFist@programming.dev on 24 Jun 15:26 next collapse

Packet data has headers that can identify where it’s coming from and where it’s going to. The contents of the packet can be securely encrypted, but destination is not. So long as you know which IPs Signal’s servers use (which is public information), it’s trivial to know when a device is sending/receiving messages with Signal.

This is also why something like Tor manages to circumvent packet sniffing, it’s impossible to know the actual destination because that’s part of the encrypted payload that a different node will decrypt and forward.

Ulrich@feddit.org on 24 Jun 19:34 collapse

Packet data has headers that can identify where it’s coming from and where it’s going to

Wouldn’t you have to have some sort of MITM to be able to inspect that traffic?

This is also why something like Tor manages to circumvent packet sniffing

TOR is what their already-existing tip tool uses.

Cenzorrll@lemmy.world on 24 Jun 19:51 next collapse

Wouldn’t you have to have some sort of MITM to be able to inspect that traffic?

You mean like your workplace wifi that you’re blowing the whistle at?

papertowels@mander.xyz on 24 Jun 23:23 next collapse

Would you? Are the headers encrypted?

Ulrich@feddit.org on 24 Jun 23:25 collapse

Does it matter? How would you get access to such information?

papertowels@mander.xyz on 25 Jun 00:56 collapse

If the header isn’t encrypted it’d be easy to inspect, and thus easy to determine where it goes, which is why it matters.

Based on your questions, it sounds like you’re expecting the network traffic itself to be encrypted, as if there were a VPN. Does signal offer such a feature? My understanding is that the messages themselves are encrypted, but the traffic isn’t, but I could be wrong.

Ulrich@feddit.org on 25 Jun 01:09 collapse

If the header isn’t encrypted it’d be easy to inspect

Easy for whom? How are you getting access to the traffic info?

ICastFist@programming.dev on 24 Jun 23:32 collapse

Wouldn’t you have to have some sort of MITM to be able to inspect that traffic?

That, or a court order telling your ISP or mobile operator to allow the sniffing. Or just the police wanting to snoop your stuff because they can. Not every country cares about individual or human rights, you know

TOR is what their already-existing tip tool uses.

Yes, but tor can be blocked at a firewall level, its packets are easy to identify. “Nations like China, Iran, Belarus, North Korea, and Russia have implemented measures to block or penalize Tor usage”

Natanael@infosec.pub on 24 Jun 15:31 next collapse

I run a cryptography forum

Encryption doesn’t hide data sizes unless you take extra steps

papertowels@mander.xyz on 24 Jun 15:46 next collapse

How exactly do you think encryption prevents the analysis of seeing when an encrypted message is sent? It feels like you’re trying to hand-waive away by saying “encryption means you’re good!”

Cyber security is not my thing, but my understanding is that you’d still see network traffic - you just wouldn’t know what it says.

Roughknite@lemm.ee on 24 Jun 19:28 collapse

How dumb are you? Like someone said the point is they can see the fact that you sent a secured message period. Not with the guardian app though. Pretty easy to comprehend so I am confused why you are acting so stupid.

Ulrich@feddit.org on 24 Jun 19:33 collapse

Like someone said the point is they can see the fact that you sent a secured message period. Not with the guardian app though.

The entire point of the article in the OP is that you can send secured messages with The Guardian app. 🤦‍♂️

Cenzorrll@lemmy.world on 24 Jun 19:59 collapse

Yes, the guardian app allows you to send encrypted messages through their app to their journalists. 100,000 people check the news, one person is whistleblowing. That one person’s messaging traffic is mixed in with the regular news data, so it’s not possible to tell which of those 100,000 people are the source. Signal messages travel through their servers, so anyone inspecting packets can see who is sending messages through signal, just not what the messages contain. Thats a big red arrow pointing to only people sending encrypted messages. With this implementation, those people are mixed in with everyone else just reading news or even just having the app on their device.

Ulrich@feddit.org on 24 Jun 20:36 collapse

100,000 people check the news, one person is whistleblowing.

There are many many more people using Signal to yell at their kids to do the dishes or some shit. Not whistleblowing.

Thats a big red arrow pointing to only people sending encrypted messages.

Everyone is using encrypted messages…

DeathByBigSad@sh.itjust.works on 24 Jun 04:47 next collapse

Using an encrypted messaging app could itself be a red flag, using a news app is normal behavior.

Ulrich@feddit.org on 24 Jun 04:52 collapse

It isn’t.

eronth@lemmy.world on 24 Jun 06:35 next collapse

It’s a red flag to those who think you’re going to share internal info.

Ulrich@feddit.org on 24 Jun 06:45 collapse

Or it’s just a perfectly normal thing that billions of people do every day?

Mynameisallen@lemmy.zip on 24 Jun 11:03 collapse

Except that signal is blocked by many companies Mobile Device Management. The one that don’t can typically see who has the app installed. This provides a new clever way to maybe whistleblow

Ulrich@feddit.org on 24 Jun 14:58 collapse

Use a different device? Use Molly? Use any number of other apps? What’s to stop the MDM from blocking The Guardian app?

Diurnambule@jlai.lu on 24 Jun 18:56 collapse

laquadrature.net/…/criminalization-of-encryption-…

For France, Your a terroriste if you use signal

Ulrich@feddit.org on 24 Jun 19:23 next collapse

Then you’re also a terrorist if you use The Guardian 🤷‍♂️

Diurnambule@jlai.lu on 24 Jun 19:36 collapse

I dont’ know, do you have sources about this ? Or are you imagining thing and deciding it is true ?

Ulrich@feddit.org on 24 Jun 19:39 collapse

Sources for what, exactly? What is “fantasming”? The title of the article you posted is “Criminalization of encryption”. The Guardian is using encryption to send messages, so why would they be exempt? In fact, why would any internet use at all not be criminalized? It’s all encrypted.

Diurnambule@jlai.lu on 24 Jun 19:54 collapse

So you read the title and you know everything. There is a liste of what they are accusing and their is no mention of internet

The elements of the investigation that have been communicated to us are staggering. Here are just some of the practices that are being misused as evidence of terrorist behavior6:

– the use of applications such as Signal, WhatsApp, Wire, Silence or ProtonMail to encrypt communications ;

– using Internet privacy tools such as VPN, Tor or Tails7 ;

– protecting ourselves against the exploitation of our personal data by GAFAM via services such as /e/OS, LineageOS, F-Droid ;

– encrypting digital media;

– organizing and participating in digital hygiene training sessions;

– simple possession of technical documentation.

But continue to invent reality. What are fact if not debatable point of view ? That the end for me. Have a great day.

Ulrich@feddit.org on 24 Jun 20:30 collapse

I don’t know everything. Just because it’s not explicitly listed today doesn’t mean it won’t be tomorrow. This was just created yesterday. And it does the same thing that all of those listed apps do: facilitates private communication.

phoenixz@lemmy.ca on 24 Jun 19:31 collapse

Then you’re a terrorist if you use the internet, period

Nearly all internet traffic if encrypted, and for plain browser traffic it’s probably in the 95+%

You access your bank? Terrorist! Email? Terrorist! Lemmy? Terrorist!

Diurnambule@jlai.lu on 24 Jun 19:35 collapse

I dunno, I am not the French state. I can only see that they think the usage of signal is making you a terrorist.

papertowels@mander.xyz on 24 Jun 18:05 collapse

How are they analyzing network traffic with Signal? It’s encrypted

Not my specialty, but signals end to end encryption is akin to sealing a letter. Nobody but the sender and the recipient can open that letter.

But you still gotta send it through the mail. That’s the network traffic analysis that can be used.

Here’s an example of why that could be bad.

MCasq_qsaCJ_234@lemmy.zip on 24 Jun 07:20 next collapse

Messaging protocols already resemble the frameworks that come out from time to time. And their effectiveness is due to the fact that they require a certain quota of users.

It’s just a secure messaging app with a direct line to Guardian journalists. How to use 911 or special numbers when you’re not feeling well.

Mynameisallen@lemmy.zip on 24 Jun 10:40 collapse

For one, ease of access. Say you’re trying to break a story, who are you going to message with signal? Because you’re going to need to get that contact info somehow right?

Snowden is permanently stranded in Russia. That’s not exactly a great example of an anonymous source.

Ulrich@feddit.org on 24 Jun 14:56 collapse

Say you’re trying to break a story, who are you going to message with signal?

…The Guardian?

Because you’re going to need to get that contact info somehow right?

Use your browser? These are strange questions.

Snowden is permanently stranded in Russia. That’s not exactly a great example of an anonymous source.

Did you notice that I used the past tense?

bathing_in_bismuth@sh.itjust.works on 24 Jun 15:32 collapse

Yeah this is insanely good

fubarx@lemmy.world on 24 Jun 06:11 next collapse

Similar to other apps, CoverDrop only provides limited protection on smartphones that are fully compromised by malware, e.g., Pegasus, which can record the screen content and user actions.

<img alt="" src="https://lemmy.world/pictrs/image/c1cb78ba-e193-4105-a7fe-d047918bb12c.jpeg">

SocialMediaRefugee@lemmy.world on 24 Jun 15:47 collapse

The tech behind the tool conceals the fact that messaging is taking place at all. It makes the communication indistinguishable from data sent to and from the app by our millions of regular users.

Reminds me of how the Germans in WW1 knew they couldn’t trust their diplomatic codes anymore so they just sent the important messages in the normal, innocuous telegraph system and diplomatic pouches. They knew that foreign intelligence would be focused on the bogus secure messages.