• whodrankarnoldpalmer@startrek.website
    link
    fedilink
    English
    arrow-up
    205
    ·
    edit-2
    3 days ago

    It’s almost as if they never actually cared about the server but rather were just using it to score points. Not at all like, you know, absolutely everything else.

  • BigBenis@lemmy.world
    link
    fedilink
    arrow-up
    17
    ·
    2 days ago

    It’s almost like that party has no values and sees everything only through the lens of political leverage.

  • ShittyBeatlesFCPres@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    6
    ·
    3 days ago

    I don’t run a magazine so I couldn’t report it but I was included on a top secret Signal group chat where administration officials talked about how long you should wait after Trump or Elon absolutely explodes a White House bathroom. A friend at OSHA accidentally added me.

    The younger staffers were given a map of nearby Starbucks locations because sometimes, it would take hours for the West Wing loos to be re-certified as a safe workplace environment. And if the inspector forgot his Geiger counter, forget it. Bathrooms were off limits that day.

    • 4am@lemm.ee
      link
      fedilink
      arrow-up
      7
      ·
      3 days ago

      The app is likely secure.

      The personal phones they installed this app on, however…

  • rottingleaf@lemmy.world
    link
    fedilink
    arrow-up
    1
    arrow-down
    15
    ·
    3 days ago

    They accidentally added a random guy to a Signal group. Not quite the same as classified documents on a self-hosted email server. I’ve heard US military uses Signal quite officially.

    This should, of course, raise concerns that if they like Signal - they might want to self-host it, the client and the server are FOSS. They might even consider paying Signal the company to help them.

  • BarqsHasBite@lemmy.world
    link
    fedilink
    arrow-up
    34
    ·
    3 days ago

    Conservative hypocrisy knows no bounds. They will only be outraged at what their talking heads tell them to be outraged at.

  • HubertManne@piefed.social
    link
    fedilink
    English
    arrow-up
    37
    arrow-down
    1
    ·
    3 days ago

    Wasn’t the server an actual private server she had setup whereas this is a corporate app that is supposedly private if they are not lying and accessing the data. I mean this is way wore unless they put up a server to run the chat software.

    • Pacattack57@lemmy.world
      link
      fedilink
      arrow-up
      14
      ·
      3 days ago

      It doesn’t matter what kind of server you’re using. Highly classified information has rules and regulations. Some stuff can only be talked about in certain buildings because the buildings were built to block listening devices.

      This is a major fuck up that could have gotten American soldiers killed. Everyone involved should be in prison.

      • Knock_Knock_Lemmy_In@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        2 days ago

        Everyone involved should be in prison.

        I’m not sure we could prove this was knowing and willful. The Russian recipient of the messages is the most suspicious angle of attack.

            • Pacattack57@lemmy.world
              link
              fedilink
              arrow-up
              1
              ·
              1 day ago

              The first message may have been by mistake. Every single message after that was knowing and willful. This isn’t a message between friends. These were highly classified communications between top admin officials. They are aware of the law and policies regarding classified information and willfully engaged in communications on an unsecured platform. Any person could have stopped it after the first message.

              • Knock_Knock_Lemmy_In@lemmy.world
                link
                fedilink
                arrow-up
                1
                ·
                1 day ago

                The law requires people to knowingly and willfully release confidential information.

                Just using unsecured platforms for communications is not illegal (otherwise Hillary would have been prosecuted).

        • Arcka@midwest.social
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 days ago

          Are you suggesting they didn’t know Signal wasn’t an approved platform for sensitive government communication and willfully used it anyway?

          • Knock_Knock_Lemmy_In@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            2 days ago

            Is approval of a communications platform legally required, or just best practice? You can guess what the Republicans will argue.

            Hillary got off for not knowingly leaking documents, so will these guys.

    • running_ragged@lemmy.world
      link
      fedilink
      arrow-up
      19
      ·
      3 days ago

      Also, while using the app, there is zero accountability for who told who to do what within the government. FOIA is useless for any conversation happening within that app, self hosted or not.

      • bassomitron@lemmy.world
        link
        fedilink
        English
        arrow-up
        15
        ·
        3 days ago

        Yep, OPSEC is definitely a major issue here. But the other problem is like you mention, zero accountability. Additionally, if they delete the chat, there is no way to reobtain the data for historical archive purposes, which is another law violation.

      • HubertManne@piefed.social
        link
        fedilink
        English
        arrow-up
        8
        ·
        3 days ago

        I don’t think anything can be proven unless you have admin rights to the server at all times. signals are encrypted every time they are sent encrypted. can it be turned off with a flag? does it run in dev without it for troubleshooting and if so is it impossible to enable in prod.

        • icmpecho@lemmy.ml
          link
          fedilink
          English
          arrow-up
          11
          arrow-down
          1
          ·
          edit-2
          3 days ago

          okay, so self host it if that is part of your concern/threat model. the Signal server code is open to the public, you can see and download it here.

          • HubertManne@piefed.social
            link
            fedilink
            English
            arrow-up
            6
            arrow-down
            1
            ·
            3 days ago

            exactly. if they had self hosted then it would be closer to equivalent to hilaries email but if it was using signal as written but then there is the foia issue which was still possible with hilarys email server, but not under a self hosted signal if not altered.

        • GreyBeard@lemmy.one
          link
          fedilink
          arrow-up
          2
          ·
          3 days ago

          The server can’t decrypt it if it doesn’t have the keys to do so. It can be proven that private keys never leave the local device. It can also be proven that the proper public keys are being provided, and that the local device alerts on public key changes with a partner are announced.

          Of course, nobody as part of the linked article did any of that verification, but still, a server doesn’t need to be trusted to be functional.

            • GreyBeard@lemmy.one
              link
              fedilink
              arrow-up
              2
              ·
              2 days ago

              In the case of signal, it is provable that it cannot. They do not hold the keys to decrypt. The closest risk is the server injecting a new public key into the conversation, which the Signal app will warn about.

                • GreyBeard@lemmy.one
                  link
                  fedilink
                  arrow-up
                  2
                  ·
                  2 days ago

                  Signal does hold the public keys for every user. But having the public key doesn’t let you decrypt anything. You need the private key to decrypt data encrypted with the public key. So in a chat example, if you and I exchange public keys, I can encrypt the message using your public key, but only you can decrypt it, using your private key.

                  Signal does run the key exchange, which means they could hand a user the wrong public key, a public key which they have the private key for, instead of the other person’s. That is a threat model for this type of communications, however, signal users can see the key thumbprints of their fellow chat participants and verify them manually. And once a chat has begun, any changes to that key alerts all parties in the chat so they know a change has happened. The new key wont have access to any previous or pending messages, only new ones after the change took place.

          • Gawdsausage@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            2 days ago

            Doesn’t matter. Signal desktop app can sync messages and be installed on compromised computers. One of the guys in the chat was in Russia visiting Putin. It would be trivial to sync the account to the app installed on compromised machines and basically become an invisible backdoor into every secure communication for that user. I have no doubt one of the users in the chat is setup like this.

            • GreyBeard@lemmy.one
              link
              fedilink
              arrow-up
              1
              ·
              2 days ago

              Oh, I’m not defending these dumb-asses doing illegal things to avoid systems setup to safeguard American and its people. They absolutely could have synced things to compromised devices. Just that Signal, themselves, couldn’t do that.

  • Grizzlyboy@lemm.ee
    link
    fedilink
    English
    arrow-up
    12
    arrow-down
    1
    ·
    3 days ago

    I’m so tired of America letting the worst pieces of shit get away with anything. One side breaks the speed limit by 2mph and they’re euthanized. The other side rapes and kills all of Asia, and nothing happens.

    • Coreidan@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      3
      ·
      3 days ago

      The two sides you’re talking about is the rich vs the poor.

      The rich get to do what they want because no one holds them accountable. The people that should be holding them accountable are corrupted by the endless money that the rich have.

      The “people” could change this over night but the rich have us all divided.

      If you want real change stop hating your neighbor and start banding together. That will never happen tho because the rich are winning this war.

      • Cryophilia@lemmy.world
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        2 days ago

        Are you seriously trying to convince us that these fucking Nazis are our allies? If I were in a room with Bill Gates and a dirt poor Nazi and had a gun with one bullet, I’d shoot the Nazi.

        No class solidarity with bigots. They do not get a seat at the table.