@return2ozma @technology
10 years ago, the Feds wanted backdoors to all of phones so they could read all of our text messages. Now, the Feds want everyone not to use software that has backdoors so the Chinese cannot read our phones. The Feds don't want competition.
this post was submitted on 20 Dec 2024
608 points (98.4% liked)
Technology
73727 readers
3564 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
The backdoors they use are there for freedom and justice, the backdoors the "others" use are tools of evil and security risks!
"They're the same picture"
Why do you hate America’s children?
For real, I bet this guy didn't back the "Definitely Don't Maybe Not Almost Probably Save The Children ACT."
load more comments
(3 replies)
load more comments
(8 replies)
Absolutely. They were so arrogant they never thought it would happen to us. After all, we are in charge of our own networks so why would we expect the enemy to be at the gates? Let's make those gates out of cardboard so it's easier to spy on everyone.
Of course then you have things like CALEA mandating a back door, you have cheap telecom companies that will happily buy cheap lowest bidder Chinese hardware and install it "everywhere* without concern for security (after all, it's not their data being stolen) and now the enemy isn't just at the gates but inside the walls.
A decade ago, making sure the feds could read everyone's mail was the national security priority. Suddenly when the Chinese can read everyone's mail, good security is the national security priority.
It's too bad there was no way to predict this in advance. Oh wait...
Why the hell is this in 4K HDR?
Only the best for the worst hack in history.
load more comments
(1 replies)
NIST has been saying since 2016 not to use SMS for MFA. It's always been horribly insecure.
The problem for me is that most Canadian Banks give you the choice of SMS or their shitty adware filled bank app that relies on Google Play Services and wont implement TOTP so I can use a true MFA app. And Im done with being forced to accept user policies I don't agree with to do shit, and most of all done with Google Play Services on my device 😑
Adding to this that my Canadian bank just updated their app and it doesn't work with my older phone. So my only option is to use online services with SMS/call verification.
It's such a joy to know that my bank, who made $40.670 billion last year, takes care of every customer equally.
This is the main reason I switched to Fidelity here in the US. It's a brokerage, but it does basic bank things, like checks, debit card, etc, and they support SymantecVIP, which works w/o Google Play Services. TOTP support really isn't that hard, I don't understand why banks are so slow in adopting it...
load more comments
(12 replies)
My bank prides itself being the first in the country to support yubikeys for 2fa. I was so happy until i learned it's just for logging in, transactions are still confirmed by SMS or their app. And security experts all say it's better this way, using a regular 2fa solution would be insecure because you wouldn't know what you're confirming.
There really is no hope.
load more comments
(2 replies)
Should be illegal to put ads in something as crucial to day-to-day life as a banking app.
If it's not illegal, then everyone is going to do it and we won't have the "choice" that crapitalists love to tout so much.
load more comments
(1 replies)
load more comments
(7 replies)
Oh man it sure would be nice if the feds had the power to regulate something like this /s
They did. That's the reason for this hack, they wanted Lawful Interception, they got their backdoor. It's what professionals and privacy advocates said all along, if it exists it will be abused.
This isn’t a hack in the way you’re thinking of, nor is it a product of government mandated interception, or a back door. The salt typhoon event you’re referring to is nothing more than the tip of the iceberg of a much bigger problem, which is abuse of the dated SS7 system we’ve known about for decades.
Do you have a source for this claim? I’d like to repeat it elsewhere…
I.e. this article from October: https://www.techradar.com/pro/chinese-hackers-allegedly-hit-us-wiretap-systems-to-hit-broadband-networks
In an all too predictable turn of events, Salt Typhoon, an infamous Chinese state actor, has reportedly hijacked government systems to breach several American broadband providers and gain access to the interception portals required by US law.
Thanks for bringing receipts. In stark contrast to my experience on Reddit, Lemmings usually seem allergic to showing their work for some reason.
Yeah, I don't get it. I go out of my way to provide sources even before being asked.
What's really frustrating is when others users criticize me for providing evidence that could be used to counter my claim. I'm not trying to win arguments, I'm trying to show my work so others can correct me if I missed something. I'm here to learn and educate, in that order, yet so many only seem interested in engaging in discussion that jives w/ their existing opinions. That was a problem on Reddit too, but at least someone would chime in w/ sources much of the time.
load more comments
(2 replies)
Its essentially what the apple vs FBI encryption legal battle was about years ago:
https://en.m.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute
I'm not really a fan of apple, but I was very happy they stood their ground on that one. They were absolutely right to do so.
load more comments
(2 replies)
Been saying that for years. It's about damn time.
SMS spoofing and SIM swapping have been around for ages. It was never secure and that's always been known. The number of companies that rely on it despite sending me a zillion other fucking useless emails is too damn high! Email, or better yet, an authenticator app, are far more secure. Not perfect, but better.
load more comments
(11 replies)
Oh it turns out we needed NSA to do its actual fucking job after all rather than holding onto exploits for the surveillance state.
Now — for the second time — we have an adversarial administration eager to weaponize government departments while Americans are vulnerable. Why? Because America is the good guys and would never abuse its extrajudicial powers (say, by detaining, rendering and torturing Americans with names similar to those of POIs.)
We could have had twenty-four years of robust communications security developments if NSA didnt sell the public out like Judas.
load more comments
(3 replies)
Authentication for my work email: Enter 28 character password, receive sms, enter message, log in
Authentication for my Battle.net account:
-Enter email made before 2000 because they don't let you change email
-Enter password
-Get rejected
-Solve CAPTCHA
-Try backup passwords, get rejected
-Request new password
-Send request to 24 year old email
-Try to log on to 24 year old email, email is suspicious and sends Authentication request to my newer email
-Open newer email, Authenticate older email
-open old email, Put in code to battle.net
-Battle.net requests Authenticator code from Battle.net app
-Open battle.net app (no requests)
-Try manual code, doesn't work
- Realize Battle.net app Authenticator not connected
-Try to connect Battle.net app Authenticator to account
-Realize you cannot connect Authenticator without signing in AND signing in requires Authenticator
-Close Battle.net app
-Open Blizzard Authenticator
-Close warning that this app got depreciated in January
-Enter manual code
-it works
-Attempt to change password to password I first attempted
-Won't let me use same password
-Try logging in using that password
-Still doesn't work - Solve one more CAPTCHA
-Change password to backup password and back to original password - have to solve 2 more Captchas
-Finally works
-Log in
load more comments
(2 replies)
Always has been
Didn't this happen quite awhile ago? I don't see anything new in this article
The novelty is the fact that it's ongoing. They haven't mitigated the hack. The threat actors are still inside the networks, which is why the government is telling people to switch to E2EE apps.
Lovely
Thank god, give me my HMAC hash please.
Nothing more terrifying than losing your phone number these days because of all the accounts tied to it via 2FA.
The end of an era.
Or actually, probably not until we redo whole cellular phone technology works and kick out all the bad actors using SS7 vulnerabilities for stuff like spoofing numbers and stealing messages. We really shouldn't be using a 45 year old system for almost all communications.
Use Telegram.
Not the app, the 200 year old wire radio messaging system based on Morse code, E2EE (Elderly man to Elderly man Enciphered)
load more comments
(2 replies)
load more comments
(1 replies)
Since when was sms ever secure? My understanding is that messages are sent in the clear, meaning your carrier and the recipient's carrier both have the opportunity to intercept messages.
I mean that's the message content, not the authentication, but still, sms is the opposite of secure, always has been.
load more comments
(17 replies)
Hollywood hacking has nothing on real hacking it seems.
id take email Authentication over sms Authentication if there was only them 2 let me use my 2facter app for the love of god plz i hate how banks use sms its like come on man
load more comments
(3 replies)
So many services still don't even offer 2FA at all. Any service that stores payment information and PII without any 2FA options, let alone a secure one, at this point are a disgrace.
load more comments
(1 replies)
Incoming forced 4-factor authentication
Something you know, something you are, something you have, and something you saw in a dream once when you were a kid at summer camp during a feverish Dr Pepper-overdose-driven fitful sleep at age 12.
view more: next ›