The Trump Administration Accidentally Texted Me Its War Plans U.S. national-security leaders included me in a group chat about upcoming military strikes in Yemen. I didn’t think it could be real. Then the bombs started falling.
By Jeffrey Goldberg
The Trump Administration Accidentally Texted Me Its War Plans U.S. national-security leaders included me in a group chat about upcoming military strikes in Yemen. I didn’t think it could be real. Then the bombs started falling.
By Jeffrey Goldberg
Just a reminder that they chose to use Signal for a reason, and those are also reasons we normal citizens should use Signal too! At least try and talk your closest relatives into dumping WhatsApp for it.
Yeah, this article was truly a fascinating read! The one thing that surprised me from Goldberg though, was that he continually questioned their use of signal. I mean, why wouldn’t they use it?
They could try to develop their own secure messaging app, but what would be the point of that when another already exists and they can verify the code is air tight because it’s open source. And, developing their own app would mean the possibility of relying on software that could contain unknown bugs or vulnerabilities.
The only safe cryptographic systems are open source ones.
Because they did so to avoid official channels which get log and recorded. And yes, the Pentagon has their own apps, what do you think? Yes, using signal is INSANE
Yes, they have some secure communications systems, but none that are safe to use on a mobile device. Signal is literally more advanced than what they’re using. It’s far from insane.
It is absolutely insane, considering they have SCIF devices / rooms but also the option of “not using off the shelf” shit like Signal and using a phone number. But here they are.
Hell, they could even use something like Briar / Matrix / whatever that is decentralised/does not require a phone number unlike Signal but instead they sent emotes, and classified information detrimental to US citizens over a centralised (third party) platform. Literally, insane.
Signal is not safe for them to use. The pentagon issued a warning last year that Signal was not safe for non-public communications. Google also put out a threat alert about it more than a month ago.
One of the means used by Russia is crafting special QR codes, that take advantage of the Connected Devices feature, and sending them to users. If the user is tricked into scanning the code, then the hacker’s device will then be copied in on all of that user’s Signal messages. I wouldn’t trust any one of these people to be smart enough to recognize a phishing attempt like that. I would be surprised if one or more foreign powers weren’t also copied in on all these messages too.
It is beyond stupid for these people to be using an app like this for confidential or secret communications.
Your logic is valid for a small business - yes a SME doesn’t need to create their own messaging app, but this is the US government, they have the resources and need for their own. Further, commercial products controlled by outsiders can be compromised, and for state level targets it’s an issue to not control the communication through its whole journey.
“Rolling your own” cryptographic system is rarely a good idea. There are countless examples of companies and governments deciding to ignore existing tested and verified standard industry tools on the basis they’re more vulnerable because they’re more well known, but that decision tends to bite them in the end because the solution they come up with has some critical vulnerabilities they didn’t notice in time. These things are easy to miss when there isn’t a whole global community of security professionals looking at the code.
Now I’ll admit that the US government could absolutely create a comparable or even superior solution if they put the right people and enough funding behind the project, no doubt. There is the question of whether or not it’s worth doing, worth the investment. If budgets are tight (because conservatives are so concerned about govt spending 🙄), I’d certainly rather they use signal than they decide to dedicate almost enough funding and develop something that almost works; that could also be disastrous.
Honestly, the best move for the government is probably to make their own app utilizing existing standards. The signal protocol is perfectly open and free, they just need their own clients. Well, that and some identity verification in the account creation process. But yeah, If they had their own app, they could design it to do some useful things, like verify all members in a group have appropriate security clearance. That might have come in handy…
So yeah, I don’t really disagree with you, they should probably be using their own system. But I think it’s easy to think that any bespoke system would inherently be superior, and that very much isn’t the case. And with that in mind I’d say it’s truly not a crazy or negligent choice to use the existing best-of-class systems off the shelf. It’s maybe not the best choice, but it’s not a bad one.
Are we missing an /s here? Signal is headquartered in the US, and here’s me pondering if they were actually using Telegram instead. Which would’ve been pretty apt.
I think at this point I’d be better off trying to use WeChat…
edit: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger - archive
For a bit of clarity some are not seeing. Google, sanctioned too. Crazy times.
The headquarters are irrelevant. Signal is open source. Its academically dishonest to say they are insecure without pointing to why in the source.
Eh, I think that in the context handling classified information, it’s fair to say Signal is “insecure”, purely because anyone with a phone number can have an account, and can be accidentally added to sensitive conversations.
You know, like the exact thing that happened in this article.
Not that that’s Signal’s fault. But the fact that it’s even possible makes Singnal unusable for handling classified information.
Fair, but that is not what the comment I am replying to is saying. They are saying Signal is compromised for being based in the US.
Russia has been sending out specially crafted QR code in phishing attempts. The codes use the Linked Devices feature of Signal. If they can get one of these idiots to scan the code, the hacker’s device will be copied in on all the user’s messages. Now, given how stupid the people in this administration are, how hard do you think it will be, or more likely, how hard it was to to get them to scan such a code?
Okay, but what does that have to do with Signal being headquartered in the US?
Is it?
Is that why people trying to protect their privacy use VPN’s/DNS resolvers outside of the US jurisdiction such as Mullvad/Quad9 etc?
And as stated by someone else if you’re using a personal device with a phone number to share classified information outside of a SCIF, you’ve got to ask yourself if there’s a modicum of “sensibility” in the administration here.
If the data you transmit is properly encrypted it does not matter where it passed and where it is.
That is independent of what I am saying about Signal
It does when you’re sharing nationally classified information with what is a third party, not sanctioned by the administration itself?