Signal Group Chat
-
@tim_g said in Signal Group Chat:
So if I'm registered on Signal with my phone number, as I am now, how is someone going to use my phone number to intercept my messages? Would they have to hack in to T-Mobile reroute things?
I feel like I can trust that more than the security of my email account.
That's not what I said.
-
@tim_g said in Signal Group Chat:
So if I'm registered on Signal with my phone number, as I am now, how is someone going to use my phone number to intercept my messages? Would they have to hack in to T-Mobile reroute things?
What if they get your SIM card? And, sorry, but I worked a job where they intercepted all phone calls and texts both for employees and the employees of GE who shared the building. Phone calls are not secured, nor are phone accounts. It's "whoever has physical access to the SIM card or the cellular node."
In the real world, I've known thousands of people with their phone calls and texts intercepted most of the time, and that was just the parts we knew about. It's now public that the police intercept that, too.
There is no need to hack T-Mobile or do anything crazy. Phones simply don't have that security to need to work around.
-
@scottalanmiller said in Signal Group Chat:
@tim_g said in Signal Group Chat:
So if I'm registered on Signal with my phone number, as I am now, how is someone going to use my phone number to intercept my messages? Would they have to hack in to T-Mobile reroute things?
What if they get your SIM card? And, sorry, but I worked a job where they intercepted all phone calls and texts both for employees and the employees of GE who shared the building. Phone calls are not secured, nor are phone accounts. It's "whoever has physical access to the SIM card or the cellular node."
In the real world, I've known thousands of people with their phone calls and texts intercepted most of the time, and that was just the parts we knew about. It's now public that the police intercept that, too.
There is no need to hack T-Mobile or do anything crazy. Phones simply don't have that security to need to work around.
Safety numbers are generated with every contact and of this happens it alerts you to the change...
-
At least they notify you - I thought I heard somewhere that they didn't notify of number changes unless you enabled that feature.
-
The main reason for me not liking the use of phone number validation is that phone number validation can be intercepted without the knowledge of the person in any way. Email compromise generally require the user to mess up on some way - i.e. being phished or the email vendor being hacked.
-
Regarding the use of phone numbers, they idea behind whisper system products was always to provider security on top of telco networks.
So TextSecure integrated with google to encrypt and decrypt actual text messages. RedPhone did the same for calls.
Signal goes beyond that. But it provides an entirely integrated diaper experience if you turn it on.
There is also an option you can enable if you are in a country and need to circumvent government censorship.
-
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Not thrilled they are bootstrapping connections via phone numbers!
As scott has mentioned before.. phone numbers are entirely to easy to spoof, they can change because of moves or any reason (granted number mobility has reduced this a lot).
I would have much rather seen this use email addresses.
Email addresses are just as easy to “spoof”. I don’t see a difference in that area.
eh? How do you spoof an email? unless you have the credentials for the email account, you can't gain access to that. But the phone system has shown how easily SS7 can be broken to intercept phone calls and text messages intended for the true person, but instead come to an attacker. That's why 2FA should not use SMS messages as a factor.
Sure if you're not using VoIP. However I'd argue that the work it takes to leverage that is the same amount of work it takes to gain access to an email address. It also prevents things like generic bots from creating accounts.
My issue is that in much of the world, phone numbers change hands all the time. So using it for security is a fundamental problem. You might get a new phone number every time you cross a border. It's tied to a physical SIM card, often with zero security.
You can change your number just like telegram. That has nothing to do with a 2FA code.
-
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@jaredbusch said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Hey, If I'm misunderstanding something, please correct me.
Exactly how hard is to to get someone’s email Fred’s versus hacking the phone network?
I couldn't tell you - but when NIST goes so far as to tell people to stop using SMS for 2FA, that tells you just how bad it must be.
You can receive a phone call. It doesn't have to be SMS.
yeah yeah - you guys are saying that since this is a near real time setup, it's less of an issue... sure, there is that, but from a pure security situation, it's still not good.
I'm saying it's just as bad either way. Email accounts are attacked ALL of the time.
That's totally different. It requires hacking. You don't even need to hack phone numbers to have an issue. Phone numbers change hands as part of the INTENDED use case. Emails identify a person, phone numbers identify a device. It's a fundamentally flawed system akin to using social security numbers as identification - it's simply not an identifying item.
Again you can change your number. What Dash is talking about is exactly the same because he is talking about hacking SS7.
-
In my original signal project we used DNS instead of phone numbers.
andy.signal.org was my handle and you could call or text me there for example.
Also @Dashrender there was email support sometime ago for Signal setup and I’m not sure why it went away.
If you let Signal do so it will integrate with your phone like hangouts or iMessage/FaceTime - on it encrypts everything.
-
@bigbear said in Signal Group Chat:
Signal goes beyond that. But it provides an entirely integrated diaper experience if you turn it on.
Did you really mean to say diaper? If so, I have no idea what that means in this context.
-
@scottalanmiller said in Signal Group Chat:
@bigbear said in Signal Group Chat:
Signal goes beyond that. But it provides an entirely integrated diaper experience if you turn it on.
Did you really mean to say diaper? If so, I have no idea what that means in this context.
Dialer
No coffee here yet
I don’t have a problem with a telegram. I just know that it is not as secure as Signal...
-
@stacksofplates said in Signal Group Chat:
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Not thrilled they are bootstrapping connections via phone numbers!
As scott has mentioned before.. phone numbers are entirely to easy to spoof, they can change because of moves or any reason (granted number mobility has reduced this a lot).
I would have much rather seen this use email addresses.
Email addresses are just as easy to “spoof”. I don’t see a difference in that area.
eh? How do you spoof an email? unless you have the credentials for the email account, you can't gain access to that. But the phone system has shown how easily SS7 can be broken to intercept phone calls and text messages intended for the true person, but instead come to an attacker. That's why 2FA should not use SMS messages as a factor.
Sure if you're not using VoIP. However I'd argue that the work it takes to leverage that is the same amount of work it takes to gain access to an email address. It also prevents things like generic bots from creating accounts.
My issue is that in much of the world, phone numbers change hands all the time. So using it for security is a fundamental problem. You might get a new phone number every time you cross a border. It's tied to a physical SIM card, often with zero security.
You can change your number just like telegram. That has nothing to do with a 2FA code.
It does if you're using SMS or phone calls as your 2FA - like one of our local hospitals is now... Doc logs into a computer system, the system calls them, the doc answers and presses # to confirm it was them.
-
A caveat to group chat on Signal is that so far we all can see each other’s number.
There’s no group admin and anyone can add someone else - but if someone new joins who is it in my contacts it is a phone number.
As @Dashrender says it’s not great on privacy. Unimpeachable encryption, but that part kinda sucks...
-
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Not thrilled they are bootstrapping connections via phone numbers!
As scott has mentioned before.. phone numbers are entirely to easy to spoof, they can change because of moves or any reason (granted number mobility has reduced this a lot).
I would have much rather seen this use email addresses.
Email addresses are just as easy to “spoof”. I don’t see a difference in that area.
eh? How do you spoof an email? unless you have the credentials for the email account, you can't gain access to that. But the phone system has shown how easily SS7 can be broken to intercept phone calls and text messages intended for the true person, but instead come to an attacker. That's why 2FA should not use SMS messages as a factor.
Sure if you're not using VoIP. However I'd argue that the work it takes to leverage that is the same amount of work it takes to gain access to an email address. It also prevents things like generic bots from creating accounts.
My issue is that in much of the world, phone numbers change hands all the time. So using it for security is a fundamental problem. You might get a new phone number every time you cross a border. It's tied to a physical SIM card, often with zero security.
You can change your number just like telegram. That has nothing to do with a 2FA code.
It does if you're using SMS or phone calls as your 2FA - like one of our local hospitals is now... Doc logs into a computer system, the system calls them, the doc answers and presses # to confirm it was them.
Huh?
What does that have to do with this? Scott was talking about moving locations and getting a new number. All I said was you can change your number for the app which sends a new 2FA code to the new number. Not sure what you are getting at here?
-
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Not thrilled they are bootstrapping connections via phone numbers!
As scott has mentioned before.. phone numbers are entirely to easy to spoof, they can change because of moves or any reason (granted number mobility has reduced this a lot).
I would have much rather seen this use email addresses.
Email addresses are just as easy to “spoof”. I don’t see a difference in that area.
eh? How do you spoof an email? unless you have the credentials for the email account, you can't gain access to that. But the phone system has shown how easily SS7 can be broken to intercept phone calls and text messages intended for the true person, but instead come to an attacker. That's why 2FA should not use SMS messages as a factor.
Sure if you're not using VoIP. However I'd argue that the work it takes to leverage that is the same amount of work it takes to gain access to an email address. It also prevents things like generic bots from creating accounts.
My issue is that in much of the world, phone numbers change hands all the time. So using it for security is a fundamental problem. You might get a new phone number every time you cross a border. It's tied to a physical SIM card, often with zero security.
You can change your number just like telegram. That has nothing to do with a 2FA code.
It does if you're using SMS or phone calls as your 2FA - like one of our local hospitals is now... Doc logs into a computer system, the system calls them, the doc answers and presses # to confirm it was them.
Huh?
What does that have to do with this? Scott was talking about moving locations and getting a new number. All I said was you can change your number for the app which sends a new 2FA code to the new number. Not sure what you are getting at here?
sure you could change, inside telegram, the listed phone number... but that's only good when you do it. If you're phone is stole (or SIM card cloned) you're screwed until you DO change it.
-
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
@dashrender said in Signal Group Chat:
Not thrilled they are bootstrapping connections via phone numbers!
As scott has mentioned before.. phone numbers are entirely to easy to spoof, they can change because of moves or any reason (granted number mobility has reduced this a lot).
I would have much rather seen this use email addresses.
Email addresses are just as easy to “spoof”. I don’t see a difference in that area.
eh? How do you spoof an email? unless you have the credentials for the email account, you can't gain access to that. But the phone system has shown how easily SS7 can be broken to intercept phone calls and text messages intended for the true person, but instead come to an attacker. That's why 2FA should not use SMS messages as a factor.
Sure if you're not using VoIP. However I'd argue that the work it takes to leverage that is the same amount of work it takes to gain access to an email address. It also prevents things like generic bots from creating accounts.
My issue is that in much of the world, phone numbers change hands all the time. So using it for security is a fundamental problem. You might get a new phone number every time you cross a border. It's tied to a physical SIM card, often with zero security.
You can change your number just like telegram. That has nothing to do with a 2FA code.
It does if you're using SMS or phone calls as your 2FA - like one of our local hospitals is now... Doc logs into a computer system, the system calls them, the doc answers and presses # to confirm it was them.
Huh?
What does that have to do with this? Scott was talking about moving locations and getting a new number. All I said was you can change your number for the app which sends a new 2FA code to the new number. Not sure what you are getting at here?
sure you could change, inside telegram, the listed phone number... but that's only good when you do it. If you're phone is stole (or SIM card cloned) you're screwed until you DO change it.
So still don’t know what this has to do with your doctor example. If someone steals your phone, yes you do have a problem? They steal your phone and then use Telegram and pretend to be you? I still do not get at what you are saying?
I never argued with the fact that it might be nice to use a difference registration method then a phone number. I only ever argued that it’s the same amount of work to hack 2FA either via phone or email.
-
@stacksofplates said in Signal Group Chat:
I only ever argued that it’s the same amount of work to hack 2FA either via phone or email.
This is what I don't agree with. Texts and SIMs aren't identifying services, but email is. So it's a different degree to hack because one doesn't require hacking, and the other does.
-
@scottalanmiller said in Signal Group Chat:
@stacksofplates said in Signal Group Chat:
I only ever argued that it’s the same amount of work to hack 2FA either via phone or email.
This is what I don't agree with. Texts and SIMs aren't identifying services, but email is. So it's a different degree to hack because one doesn't require hacking, and the other does.
It’s not a long term identification but it is if the number is tied to the device at the time of the 2FA code send.
Both of course require hacking. How do you intercept a 2FA code without hacking?
-
@stacksofplates said in Signal Group Chat:
Both of course require hacking. How do you intercept a 2FA code without hacking?
By getting the SIM card, being assigned the number, or being in a place like where I worked that all calls and texts going through a third party that reads them first.
-
Yes the window of time to take advantage of SMS based 2FA might be small, but it's definitely no so small that a bank account couldn't be drained by a bot in 1/2 second.
