Some are quick to promote apps as being safe for your use just because they are encrypted. I will talk about how many of the popular apps that are commonly t...
You (as aggressor) scan all your known mobile numbers agains let’s say Signal and discover that some numbers use Signal. That I understand. But now what? Unless you are the company Signal you would not have access to further data, or ?
Sure you can easily get further data by for example asking the phone companies for cell-tower log-in location and times. This you can then narrow down against your list of Signal using suspects and either remotely infect their phones with a trojan or simply snatch up the hardware at a “random” police check and access the already decrypted messages with identifiable phone-numbers of all the group-members.
Compare that to a messenger that does not use phone numbers at all and even does not transmit network IDs to other group-chat members. Then the police has no idea who to target and no reasonable indication that could be used with a judge to get a search warrant either.
Sure you can easily get further data by for example asking the phone companies for cell-tower log-in location and times. This you can then narrow down against your list of Signal using suspects and either remotely infect their phones with a trojan or simply snatch up the hardware at a “random” police check and access the already decrypted messages with identifiable phone-numbers of all the group-members.
What the fuck? Sure, you could also just being tortured till you tell them everything you know, but fking tracing over cell companies is not a security flaw in an app.
They could also just as well decrypt your self hosted emails that are cached on your device.
What I explained is commonly done by law-enforcement agencies to get search warrants and permission to install trojans on devices of a relatively large number of suspects. Having your phone number registered with Signal, having been near a certain place and at a certain time + being male and 20 something years old is usually sufficient to get permission to do so by a judge as these three metadata points significantly narrow down the number of suspects.
Luckily law-enforcement agencies in most countries don’t go around torturing large amounts of people on very weak indications that they might have been somehow within 5km of a protest or crime.
What does having Signal installed has to do with tracking down and installing a Trojan?
I don’t think that they will track only track you down for using Signal, and if they are they still will install a Trojan even without Signal installed on your phone.
Hence my comment about more detailed explanation. Of course only having Signal installed will not get you on a list of suspects for being targeted for trojan installation by law-enforcement.
But it is a significant metadata point and also further security risk for related persons once you are being targeted, and one that is totally unnecessary as there are equally good messengers that do not require phone-number use at all.
Ok, out of interest, how does this work?
You (as aggressor) scan all your known mobile numbers agains let’s say Signal and discover that some numbers use Signal. That I understand. But now what? Unless you are the company Signal you would not have access to further data, or ?
Sure you can easily get further data by for example asking the phone companies for cell-tower log-in location and times. This you can then narrow down against your list of Signal using suspects and either remotely infect their phones with a trojan or simply snatch up the hardware at a “random” police check and access the already decrypted messages with identifiable phone-numbers of all the group-members.
Compare that to a messenger that does not use phone numbers at all and even does not transmit network IDs to other group-chat members. Then the police has no idea who to target and no reasonable indication that could be used with a judge to get a search warrant either.
What the fuck? Sure, you could also just being tortured till you tell them everything you know, but fking tracing over cell companies is not a security flaw in an app.
They could also just as well decrypt your self hosted emails that are cached on your device.
What I explained is commonly done by law-enforcement agencies to get search warrants and permission to install trojans on devices of a relatively large number of suspects. Having your phone number registered with Signal, having been near a certain place and at a certain time + being male and 20 something years old is usually sufficient to get permission to do so by a judge as these three metadata points significantly narrow down the number of suspects.
Luckily law-enforcement agencies in most countries don’t go around torturing large amounts of people on very weak indications that they might have been somehow within 5km of a protest or crime.
What does having Signal installed has to do with tracking down and installing a Trojan?
I don’t think that they will track only track you down for using Signal, and if they are they still will install a Trojan even without Signal installed on your phone.
Hence my comment about more detailed explanation. Of course only having Signal installed will not get you on a list of suspects for being targeted for trojan installation by law-enforcement.
But it is a significant metadata point and also further security risk for related persons once you are being targeted, and one that is totally unnecessary as there are equally good messengers that do not require phone-number use at all.