Open source FIDO2 keys, KeePassXC, and Aegis.

SMS 2fa has always been a bad deal

I’ll never understand why people accept SMS 2FA as any kind of security. Might as well put it as an ad in a newspaper. 🤦🏻‍♂️

Because many services only have SMS as 2FA option. Especially government services.

Also it is impossible to use google without enabling the SMS 2FA option. No matter what, with only 2FA authenticator app or email, they will lock down the account by saying “unable to verify”.

I never set a phone number on two of my google accounts and they still work fine. Those accounts are old. Google didn’t ask for a phone number to sign up back then.

I recall seeing something about them planning to get rid of SMS 2FA last year. It looks like it’s still an option though.

Watch out, if those accounts are ever “locked”, you will get permanently locked out of the accounts. Happened to me because a data breach revealed my email address and some idiot tried brute forcing my password. Didn’t work but it broke the account. Secondary recovery email address and correct password wasn’t good enough. Support basically told me to give up and make a new account (???).

I guess in this case they block the account if it has no 2FA set up. If the account has TOTP set up it may be enough to avoid being blocked, even under brute forcing and without phone number.

You can have a Google account without 2FA, but you need to create it using a factory-reset old Android phone (Android 8 or so).

Why are people even complaining about this then?!

Because it’s an obscure / niche / loophole way. Not sure if it works on later Android, for example. Or in all regions.

You can remove SMS 2FA from a Google account if you have passkeys or hardware security keys registered

Does it also include TOTP 2FA?

Not sure. You need att least one form registrerad. I do recommend using multiple.

But with a always on VPN they constantly ask to verify our identity, even with passkey or phone number.

Even when I successfully verify my passkey, they will still sent a SMS code to my recovery number. It’s almost impossible to bypass that step and try another method button redirect again to the same phone verification page. If I didn’t give my number, then this message appears, “there is not enough information to prove this is your account. try again later.”

Maybe VPN is a factor that triggering their security system.

Signal doesn’t offer anything except sms 2fa and requires a phone number. It’s a terrible choice considering LEO can do what they did here and just get legal access to MITM your sms messages, spoof the 2fa, and take over your account, impersonating you. The other ones aren’t encrypted. So none of these they broke into are great choices for truly secure messaging.

They can only impersonate you that way if your contacts dismiss the warning about your safety number changing. If you’re being directly targeted by the government of a wealthy country, using a specific app isn’t enough to prevent surveillance; you’ll need some actual opsec.

The other ones aren’t encrypted.

Whatsapp is encrypted as far as I know. But then again, it’s Meta, so my trust in that is near zero.

Telegram secret chats are too, but regular ones are not and you can’t have a secret group chat.

Signal offers direct key verification (which you need to do out of band) or transparency log key verification (your device can check that senders who you add by number hasn’t had their key change)

The attack here was getting an unlocked device in hand and using the internal sync feature without the user’s knowledge, and the solution to that is always to check your phone after an untrusted person handled it unlocked (or with Cellebrite type devices) - or to simply not offer access to the Signal app while unlocked (perhaps even uninstalling it first).

There is no app which is fully secure against an untrusted third party getting physical access to your unlocked phone, especially not if you have a weak PIN or just fingerprint unlock

Telegram and whatsapp never had encryption. Also - they just give your messages on law enforcement request, always have.

Signal - how does it work with signal again?

You don’t ask too many questions about signal cos the answers don’t make you any more confident.

WhatsApp uses signal protocol

But that does not prevent Meta from accessing your messages.

How?

WhatsApp is owned by meta

Signal protocol is end to end encrypted

Yes. How does that happen? You open the app you type a message you hit send. In that process WhatsApp has access to your clear text message that they get from the keyboard. They can do whatever they want with that. They could encrypt your message with your key and also one of their keys. They could send those together so that they look like one message but at their servers split their copy off.

Damn

Telegram has shitty 1-to-1 encryption but no group encryption.

WhatsApp claims to use the same encryption algorithms as Signal, but you can’t audit it.

There have been too many of these types of events related to signal. And it has so many red flags. You are required to have a phone number which is essentially ur real identity. They used to federate with 3rd party servers but they killed that and all but wiped it from the internet. They try to shut down 3rd party clients. They don’t provide reproducible builds so we can’t trust the source. They received their initial funding from In-Q-Tel the CIA venture capital firm.

Every time someone tries to raise any of these issues they are immediately shut down and told that its all for a good reason and that we should trust it.

At minimum they have a full social graph of real identities with time-stamped message events. Sealed sender doesn’t negate this as signal knows ur ip address when u give them a message. They also know the destination of that message as that isn’t sealed. This is sufficient information to link sender and recipient and timestamp. That’s assuming the unreproducible builds don’t have backdoors.

It’s all got a slightly fishy smell to it.

Tldr: If u want actual secure messaging u should consider SimpleX

There are all of these stories about signal because it is notable when someone gets around it

That there’s anything approaching secure communication on a cell-phone dominated Internet whose.operating systems are either “snobbish walled garden” or “ad agency living in the corpse of a search engine” is astonishing. In the same way that a gun safety that keeps a toddler from shooting themselves with an otherwise loaded gun is astonishing.

can’t get around simplex encryption unless you have physical access to the device or have been physically invited by a member.

Ok so no better than Signal?

You can do all the same things and use Tor, allow Sealed sender, and rotate username with phone number hidden.

Why does Simplex want investors?

what company doesn’t want to grow or maintain services? they host the primary servers that everyone uses, that costs money.

you could host your own though. can you do that with signal?

If I only want to talk to my own group of people registered on my server yes

github.com/signalapp/Signal-Server

as I pointed out in your other comment. signal uses a database, fails to explain why a database is required, and doesn’t even make a mention of it in their technical information.

why use a database at all? that just introduces more attack surface area and complexity for attackers to leverage.

Yeah precisely you didn’t check what it’s for. It doesn’t hold conversation data or even metadata.

what 👏 is 👏 it 👏 used 👏 for

WHAT DO YOU THINK IT’S USED FOR

they have 45 day store-and-forward of encrypted attachments, and the handle registration thing, and that’s it

Do you think they would want to go to federal jail for lying to federal agents when they insist they have no metadata about you?

Messages persist in memory or in a database until they cross a threshold of time, typically on the order of days.

github.com/simplex-chat/…/overview-tjr.md

Hypocrite

I’m about to block you because you’re just spamming the same argument in two different threads.

simplex has a more secure and robust architecture when compared to signal. simplex router can literally run on a raspberry pi zero with 2gb of storage.

nothing is written to storage for simplex unless you configure it otherwise.

the defaults for signal selfhosting promotes convenience over security and does not appropriately protect admins from search and seizures.

signal is good, if all you want is to share memes with your friends, but if you want to build a network of trusted individuals for purposes that are actively targeted by corrupt governments, simplex wins hands down.

Liar

By the way the Simplex CEO supports nazis

You… didn’t read the article did you… that’s literally what happened here lol

lol

either through physical access to someone’s phone OR by intercepting verification codes via a state-sanctioned phishing attack OR intercepting SMS messages via telephone surveillance

it’s literally a quote in the post. physical access was only one way they accessed messages.

That’s not the point I was trying to make. You are acting like simplex is better than signal because it requires physical access… that’s how it works for signal as well…that was the point…

breaking the encryption is hard , but getting around the encryption is entirely doable without physical access if you allow SMS or on-device sharing.

Not to quote myself but:

Every time someone tries to raise any of these issues they are immediately shut down and told that its all for a good reason and that we should trust it.

You should trust signal tree the same way you trust a front door lock that has never been broken or picked despite repeated attempts to do both.

.Just remember that police only go through the door when it’s easier than breaking a window or tearing through a wall.

The US government has openly stated they killed people because of metadata and ur comfortable just giving that all away? U also didn’t address any of my precise exact points you simply made a vague deflection.

Signal doesn’t reveal that kind of metadata.

All ur messages have a recipient address. All ur messages go though signal servers. You have an IP address that u communicate to said servers with. They know when and who you are messaging.

Signal supports Tor.

They have features like Sealed Sender, which is at least on par with the multiple server behavior of Simplex as it behaves the same (message passing multiple servers, carrying no sender origin data in plaintext)

Simplex knows the same thing. The pairwise identifiers is a sham - all your different identifiers point to the same Android/iOS notification server API key so they know the recipient is the same person, they can tell which exact phone receives a notification when somebody sends you a message (unless the devs use anonymized fetch on a polling schedule, which they don’t)

And because they don’t hide those sender stamps, Simplex leak more info than Signal with Sealed sender

SimpleX looks neat, I will be watching this one.

Thanks!

This was not an “event” for signal.

Interesting they highlight Signal again as though this is a vulnerability.

If someone else has access to a linked device… that’s you fucking up access controls.

It’s a vulnerability precisely because people always swarm to defend Signal in stories like this, as though using Signal means the authorities (or other bad actors) can’t read your messages. Seems like every six months there’s some story involving Signal users getting hacked, and every time there’s a rush of wellacshuallys explaining why it wasn’t really Signal’s fault. (that last one is particularly egregious because I remember people defending it as “it wasn’t Signal, it was their partner who they subcontracted and gave your personal data to”, which is crazy levels of mental gymnastics.)

Security is more than just encryption. If you flag something up as “hey use this if you want to hide from the Government” and have a personal phone number attached to it, that’s like a red rag to a bull.

(edit: LOL, it’s hilarious how many people think they’re making great rebuttals in the replies when all they’re doing is proving my point. One child even flew directly into screaming at me. Signal fanbois are even worse than Apple supporters)

IT DOESN’T ADVERTISE ITSELF AS A SECURE PLATFORM!!!

It says PRIVACY. If you are dancing ass naked inside your house but you have your windows open… guess what?

lol, the block caps three exclamation marks aren’t doing much to dispel the “rabid fanboi” image of Signal supporters

A rabid fan of a message application? Just for trying to point out that if the police get your unlocked phone then they have compromised your messages?

A lot of these types use ‘perfect being the enemy of good’ as their attack vector. If it’s not private and anonymous why bother? If you can’t cut out all big tech companies, if you can’t stop buying any American goods, if you can’t feed all the poor or house all the homeless, etc. It’s an effective way to attack progression by making people believe they should just stop fighting, they’ll never win. You nailed it, Signal is private, it doesn’t claim to be anything else.

You just pointed something out there that I haven’t really considered. But its also the difference between abolitionists and reformists too- namely, abolition should be the goal, but don’t let that stop you from making reforms too.

as though using Signal means the authorities can’t read your messages.

Nobody who understands the topic thinks this.

Signal exists to prevent the contents from being read off the wire and from having the capability of compelling Signal’s parent company from turning over stored messages.

It doesn’t exist to hand hold you so you don’t get phished, or prevent you from running it on a vendor phone full of spyware. You’re responsible for making sure your hardware is secure and that you’re not socially engineered.

Nobody who understands the topic thinks this.

Yes, and articles like this are important so people who DON’T understand don’t think this.

You don’t think the tens of millions of people who use signal all understand that just because everyone says it’s super secure, doesn’t mean they can’t be hacked or phished, right?

They even inform you in the app about spying vectors like keyboard apps…

…signal.org/…/360055276112-Incognito-Keyboard

Yeah most people click through warnings like that lol

Why are you lying about what security guarantees Signal say they offer?

…signal.org/…/9932632052378-How-to-protect-yourse…

…signal.org/…/9932566320410-Staying-Safe-from-Phi…

Even your example of the Twilio hack is far less relevant now since they added transparency logs, which means it is much harder to impersonate you without detection even if the hacker can control the telco

…signal.org/…/10223569377562-Automatic-Key-Verifi…

Lying? Wow, Signal fanbois are weird

I want a version of Signal that doesn’t allow linked devices. Linking devices is a clear vulnerability.

Im going to go out on a limb here and suggest something that should be obvious - you don’t have to link devices

But “Law enforcement” can do it by spoofing sms. I want one account, one device.

Signal does not use SMS.

The vulnerability they call out in the article is a phishing attack. A phishing attack requires the user’s input. There is no defense, no security, no techniques or technology to prevent you from handing the key to your safe to someone else.

Signal failed to prevent soneone from accessing my unlocked phone and starting Signal! Everything was right there!

On iOS you can set an app to require additional credentials to open, to prevent this situation. I’d imagine Android had something similar. I did it for all my important apps, just in case. Don’t want someone able to access my bank account or nudes.

Just poked around. As far as I can tell there aren’t any options to require additional credentials to open an app on android. Im on a pixel 10 running android 17. However there is a locked “app drawer” that hides the apps from your home screen/ main app drawer that you need to have an additional password to access.

There’s Private Space, but that’s not ideal for a general-purpose messaging app because notifications are suspended when the space is locked. Signal also has the option to require the same authentication method as your screen lock in order to access the app.

All of this is great, but there’s literally nothing stopping the next article from saying “user who left their phone unlocked with signal also unlocked ‘got hacked’”

User who installed App in Phone found to have App data in Phone! More at eleven.

It s litteraly on the signal option “Require acces code to open signal”

Yes, but that’s a signal option, not an android option. The original commenters said ios had a feature to require additional credentials and was wondering about android, not a specific app that happens to be on android

Some Android devices has app lock build in.

I have App Locker in settings iy let’s me use a fingerprint unlock on any apps I want, I assume it’s a stock Android feature.

fingerprint

guess what.

You can lock Signal. It’s in it’s privacy settings.

If someone can get unlocked access to your phone, your security practices are already insufficient.

Real life isn’t that clean. Security is about layers and making things as difficult as possible; there is never a single step which will fully protect you from everything

Doesn’t help a whole lot if you hand the unlocked phone with the unlocked app to a police officer.

Because if you do, you just got Cellebrite’d. Your entire phone is compromised, now and going forward.

Some android custom UIs have this. Signal has this built in though.

you know what would solve this? simplex.

“Just get everyone in your life to move to ______ and that will solve all your problems”

A suggestion as old as time

it’s one of the most secure message apps available.

messages are signed, encrypted and passed through servers, never left on the server. unless you were the intended recipient you will not decrypt it.

it’s the truecrypt of instant messaging.

Signal does all that already

signal has a closed source server that can’t be audited.

github.com/signalapp/Signal-Server

That changed

what does it need a database for?

simplex is literally a message broker. no data remains on the server.

Because sometimes, people are not online 24/7 and messages still need to reach them when possible.

Signal doesn’t keep messages either. Do you know what they can serve FBI every time they ask? Nothing but number at first seen date. They don’t have your metadata.

then why does it have a database?

Here’s what he documentation says;

Messages persist in memory or in a database until they cross a threshold of time, typically on the order of days.

… Or wait…

Oops, that was from Simplex, who has a database, that didn’t come from Signal’s documentation

github.com/simplex-chat/…/overview-tjr.md

cherry picking.

By default, routers do not retain access logs, and permanently delete messages and queues when requested. Messages persist in memory or in a database until they cross a threshold of time, typically on the order of days.[0] There is still a risk that a router maliciously records all queues and messages (even though encrypted) sent via the same transport connection to gain a partial knowledge of the user’s communications graph and other meta-data.

what this means is don’t blindly trust a random public router.

if you host your own router, you can set the threshold to hours or seconds. you can also ensure that your router isn’t maliciously storing records.

simplex uses an in-memory queue to store messages for delivery. if the server was extracted for legal measures, this means the messages are erased and difficult if not impossible to collect.

for signal, they are written to disk. this means there is evidence of communications between users. even if you host your own signal server, it will be there.

Liar

You’re claiming Signal does these things when it doesn’t, and claim Simplex doesn’t do what’s in the documentation

By the way, the Simplex CEO supports nazis

Oh really? Simplex would block someone from accessing your phone and thus Simplex' data?

give me a list of messaging apps that stop attacks that leverage physical access.

use a better os that has encryption and kill codes if that’s your concern.

give me a list of messaging apps that stop attacks that leverage physical access.

you know what would solve this? simplex.

um...

either through physical access to someone’s phone OR by intercepting verification codes via a state-sanctioned phishing attack OR intercepting SMS messages via telephone surveillance

why are you so against people using a more secure way to communicate?

the only time they mention signal is when they explain they used linked devices to obtain signal messages. not SMS! if you lose your phone or whatever, and log in on a new device, your messages won’t magically reappear, they are lost, and all your contacts get a warning that your safety numbers have changed.

simplex messages stay on your phone. you can’t switch phones and have them follow you because there’s no way to sign in because there’s no account for you to sign in with.

simplex doesn’t require a phone number or email. the trust is made between users, keeping users safer because it requires physical access between users. sure you can share your code over SMS or otherwise, but that’s a user issue that breaks usage policy, not a problem with the software.

simplex messages stay on your phone

I think that’s what I said with signal too. the exception is you can have your messages follow you, if you still have the old phone, because the app supports transferring the data.

if it can transfer the data, there’s more opportunity to successfully steal it.

convenience will always negate security.

I have bad news for you, simplex also has this “security flaw”: simplex.chat/docs/guide/managing-data.html

cool.

so then signal is just as good as simplex.

Intercepting a verification code with signal does not allow reading messages.

Signal in this was clickbait they literally just say oh well if someone can link in their device they can see 45 days of message history

What’s described in the article is the same method Russia was using to compromise Ukrainian Signal accounts. It’s just phishing.

I think you’re the only person here so far who read the linked article.

I also found the netzpolitik article that was referenced but not linked to in the original article.

This describes police adding a linked device to a person’s WhatsApp account while gathering evidence (translated with Google Translate).

On January 12, 2020, Mr. and Mrs. P. were questioned. During the questioning, they voluntarily handed over the mobile phones they were carrying to the interviewing officers for a brief period so that messages from their daughter contained on the devices could be viewed and, among other things, photographed.

While the photographs were being taken, the computer-based application WhatsApp Web was covertly activated via a website made available online by the Federal Criminal Police Office (BKA), allowing the messages to be read on a BKA computer (sic!). This did not involve any intrusion via a Trojan horse or similar software.

The only link to Signal here is the nation state campaign which used social engineering via a phishing message from ‘Signal Support’.

This nation state campaign was originally reported by a researcher at Citizen Lab.

I did notice some comments that may be from people who did not read and understand the article. These attacks are not sophisticated or hard to defend against, which is probably why the German police want to limit public awareness.

I find their view shortsighted/narrow; the attacks they’re using (including SIM swapping) are also widely used by criminals for fraud and identity theft. Police agencies should not discourage the public from being more cybersecurity-aware.

A problem many aren’t aware of, in an area that shares telecommunications info, two people within that area can be identified by the state sending encrypted messages by seeing when one person sends and another instantly receives a message. It could be easy enough to obscure that I would think by working differing lag times in.

I think it was in the intercept a few years back. I think this is it.

https://theintercept.com/2024/05/22/whatsapp-security-vulnerability-meta-israel-palestine/

Remailer (Mixmaster) were meant to address that problem back when E-Mails were more popular.

Seems like signal could send a notification 24 hours after any new device is added to remind the user that it was done. Make it so it has to be dismissed on each device so dismissing it on one doesn’t make it vanish on the rest.

doesn’t help if you’re in custody and your device is in a lab

The headline makes people think signal is somehow broken.

It’s not. Just be careful and monitor your account. And don’t let anyone gain physical control of your device.

To me, this proves that the police can still get the information they need without us handing over our encryption keys and requiring ‘service providers’ to MITM for them.

for signal, that is still required. if you look, they used linked devices to get the messages

That’s not MITM done by the signal foundation.

I meant us handing over our encryption keys. ofc MITM does not work here

Except they had to get the keys, at least for Signal, as described in the article. Only you can allow a new device. If you get a notification for a new device and you go “sure, let me flash that code for you”, you’re giving the key. And a moron.

Can’t say about the other services.

Yeah, what I’m saying is that this proves there’s no need for chat control. Law enforcement can already get what they want by being sneaky.

There’s also no need for chat control because there is almost always enough information anyway, but the police doesn’t act on it. Their incompetency and lack of resources won’t be helped by adding even more information to sift through.

Yes, I agree. I’m saying that the article posted here provides actual evidence that they already have the tools they need, therefore…

Is everyone here really whining about social engineering? It’s basic comp sec, weakest link are the people.

It goes above that.

or intercepting SMS messages via telephone surveillance.

Read the fucking article before commenting.

The burglar broke in by knocking on the door and waiting for someone to come to the door and open it and then asking if they could come in and were let in and asked if they could just take stuff and the person said sure go nuts.

Almost. More like they asked to use the bathroom then unlatched the bathroom window, left, and returned later through that window when the homeowner wasn’t paying attention

Heck the state

The article also mentions using linked device access. Clever. Fuck the police, though.