Here’s what data the FBI can get from WhatsApp, iMessage, Signal, Telegram, and more

[MaxosBanklogs]

No. You shouldn't trust any instant messenger, period.

Pidgin with OTR with proper op sec on both sides, they'll collect nothing.

 

[DeadPrezi700]

No. You shouldn't trust any instant messenger, period.

This article is referring to text message only.

 

[AndrewTateTrack1n2]

This article is referring to text message only.

Tribe Seuss has a good Tek in the Tripipedia Section written up on installing Pidgin with OTR and OMEMO for Whonix and Tails -
Pidgin alone only supports OTR which is out dated now, adding updated OMEMO gives even that much more, It is hard to find a safe app that supports both.

 

[DeadPrezi700]

More than agreed! I only PGP... The problem isn't very the messenger itself... The problem is coming from the keyboard we found out that the message in fact are definitely encrypted and the FBI were not be able to "see the message" but instead they were able to see where your fingers touch the keyboard of your phone... That how they mostly get your messages tho day...
Your phone isn't secure you are right

 

[AndrewTateTrack1n2]

Proton already has the private half of your PGP keypair -- you cannot just upload a public key half -- I've tried that, and it doesn't work. What is very likely to happen is what happened to a number of clueless Hushmail users almost 15 years ago. There are so many parallels between Hush and Proton that I just cannot understand how people can take Proton's purported security at face value, given what happened with Hushmail.
Here is what happened, in a nutshell: there were a large number of steroid vendors, customers, and bulk powdered steroid suppliers from China, many of whom were using Hushmail. All of them believed Hushmail's propaganda:
Q. Does HushMail have a "back door" that can be accessed by government agencies?
A. No. Email, which includes attachments, sent between Hush users is completely encrypted.
Q. What if my message is subpoenaed?
A. Hush will answer valid, court-issued subpoenas. However, if the mail is fully encrypted, the subpoenaed version will not resemble the original text version.
From Hushmail's FAQ in 2002 -- note the change in wording to make their claims more explicit:
Q. Does HushMail have a "back door" that can be accessed by government agencies?
A. No. Email, which includes attachments, sent between Hush users is completely encrypted.
Q. What if my message is subpoenaed?
A. Hush, like any company or individual, is legally bound to respond to court-issued subpoenas. However, because not even Hush can access the encryption keys of individual users, in the case of a subpoena Hush would only be able to provide the encrypted (coded) version of the transmitted email.
The way I read it at the time (and still do now), Hush was virtually guaranteeing that their service was subpoena-proof. It was reliance on that promised guarantee that attracted scores of customers to Hushmail's services. Hush's promise was premised on two conditions:
1) Hush was headquartered in Canada, and as such, advertised that subpoenas or court documents from foreign courts (e.g. U.S.) would not be honored, as they would be of no force or effect. They claimed they would only honor warrants or subpoenas from the Supreme Court of British Columbia. You can see the parallel here with Proton, which touts its' advantages being in Switzerland:
Swiss Privacy - Data Security and Neutrality - ProtonMail is incorporated in Switzerland and all our servers are located in Switzerland. This means all user data is protected by strict Swiss privacy laws.
As we have recently seen in the case of the French activist, requests made under MLAT render all their claims null and void.
2) As you can see from the above Q&A, Hush virtually guaranteed that they could not decrypt their users' emails. Here is what Proton has to say on the same subject: End-to-End Encryption - Automatic Email Security - We use end-to-end encryption and zero access encryption to secure emails. This means even we cannot decrypt and read your emails. As a result, your encrypted emails cannot be shared with third parties.
I trust you can see the parallels between Hush's claims to be unable to decrypt, and ProtonMail's. I suspect that the latter's claims will be equally as worthless.
At the time of the original incident (September 2007) I had never even heard of Mutual Legal Assistance Treaties (MLATs). This was my first introduction to these, and I suspect it was also the first introduction to the Hush management team and legal counsel. As such, I do not believe they were necessarily being disingenuous when they originally made the statements reproduced in the Q&A above.
When the Canadian Minister of Justice received the U.S. State Department's Mutual Legal Assistance request, he ordered the Supreme Court of British Columbia to issue a warrant to Hush demanding the information requested by the Americans. Doubtless the request issued to Hush included a demand for the emails to be provided in plaintext (i.e decrypted). Hush management was then faced with a quandry -- they had to find a way to comply with the warrant, or face proceedings for contempt of court. The courts are not particularly receptive to claims that, "It can't be done." Their attitude is usually, "Do as we have ordered, or face the consequences."
So, Hush had to find a way to capture the passwords of the targeted accounts. Every time a user logs into their Hush (or Proton) account, an applet is downloaded to the user's device, where it is executed to provide the necessary functionality. This, plus the fact that both services store both public and private halves of the PGP keypair, are what make it possible to use the service on a new device that has never used a Hushmail account before. You just simply navigate to their website, login with your username and password, and you're in!
Both services claim that all cryptographic operations take place in the users' browser, so that they never have access to the password, or the decrypted private key. That was thoroughly disproven in 2007, when Hush sent the targeted users 'poisoned' applets to capture the users' passphrase and sent it back to Hush. There is no reason that the same technique would not work on ProtonMail as well.

 

[DeadPrezi700]

Proton already has the private half of your PGP keypair -- you cannot just upload a public key half -- I've tried that, and it doesn't work. What is very likely to happen is what happened to a number of clueless Hushmail users almost 15 years ago. There are so many parallels between Hush and Proton that I just cannot understand how people can take Proton's purported security at face value, given what happened with Hushmail.
Here is what happened, in a nutshell: there were a large number of steroid vendors, customers, and bulk powdered steroid suppliers from China, many of whom were using Hushmail. All of them believed Hushmail's propaganda:
Q. Does HushMail have a "back door" that can be accessed by government agencies?
A. No. Email, which includes attachments, sent between Hush users is completely encrypted.
Q. What if my message is subpoenaed?
A. Hush will answer valid, court-issued subpoenas. However, if the mail is fully encrypted, the subpoenaed version will not resemble the original text version.
From Hushmail's FAQ in 2002 -- note the change in wording to make their claims more explicit:
Q. Does HushMail have a "back door" that can be accessed by government agencies?
A. No. Email, which includes attachments, sent between Hush users is completely encrypted.
Q. What if my message is subpoenaed?
A. Hush, like any company or individual, is legally bound to respond to court-issued subpoenas. However, because not even Hush can access the encryption keys of individual users, in the case of a subpoena Hush would only be able to provide the encrypted (coded) version of the transmitted email.
The way I read it at the time (and still do now), Hush was virtually guaranteeing that their service was subpoena-proof. It was reliance on that promised guarantee that attracted scores of customers to Hushmail's services. Hush's promise was premised on two conditions:
1) Hush was headquartered in Canada, and as such, advertised that subpoenas or court documents from foreign courts (e.g. U.S.) would not be honored, as they would be of no force or effect. They claimed they would only honor warrants or subpoenas from the Supreme Court of British Columbia. You can see the parallel here with Proton, which touts its' advantages being in Switzerland:
Swiss Privacy - Data Security and Neutrality - ProtonMail is incorporated in Switzerland and all our servers are located in Switzerland. This means all user data is protected by strict Swiss privacy laws.
As we have recently seen in the case of the French activist, requests made under MLAT render all their claims null and void.
2) As you can see from the above Q&A, Hush virtually guaranteed that they could not decrypt their users' emails. Here is what Proton has to say on the same subject: End-to-End Encryption - Automatic Email Security - We use end-to-end encryption and zero access encryption to secure emails. This means even we cannot decrypt and read your emails. As a result, your encrypted emails cannot be shared with third parties.
I trust you can see the parallels between Hush's claims to be unable to decrypt, and ProtonMail's. I suspect that the latter's claims will be equally as worthless.
At the time of the original incident (September 2007) I had never even heard of Mutual Legal Assistance Treaties (MLATs). This was my first introduction to these, and I suspect it was also the first introduction to the Hush management team and legal counsel. As such, I do not believe they were necessarily being disingenuous when they originally made the statements reproduced in the Q&A above.
When the Canadian Minister of Justice received the U.S. State Department's Mutual Legal Assistance request, he ordered the Supreme Court of British Columbia to issue a warrant to Hush demanding the information requested by the Americans. Doubtless the request issued to Hush included a demand for the emails to be provided in plaintext (i.e decrypted). Hush management was then faced with a quandry -- they had to find a way to comply with the warrant, or face proceedings for contempt of court. The courts are not particularly receptive to claims that, "It can't be done." Their attitude is usually, "Do as we have ordered, or face the consequences."
So, Hush had to find a way to capture the passwords of the targeted accounts. Every time a user logs into their Hush (or Proton) account, an applet is downloaded to the user's device, where it is executed to provide the necessary functionality. This, plus the fact that both services store both public and private halves of the PGP keypair, are what make it possible to use the service on a new device that has never used a Hushmail account before. You just simply navigate to their website, login with your username and password, and you're in!
Both services claim that all cryptographic operations take place in the users' browser, so that they never have access to the password, or the decrypted private key. That was thoroughly disproven in 2007, when Hush sent the targeted users 'poisoned' applets to capture the users' passphrase and sent it back to Hush. There is no reason that the same technique would not work on ProtonMail as well.

What I find 'dubious' about Protonmail is the exact same thing that I found dubious about other similar services in the past, e.g. Hushmail. The entire foundation upon which public-key cryptography is constructed lies in the absolute separation of public and private halves of the keypairs. Like Hushmail before it, Protonmail requires that both public and private halves of the PGP keypairs be stored on their servers. I am of the opinion that the only place where the private half of my keypair(s) should reside is on hardware that is under my direct ownership and control.
There is a lot of hand-waving about the keys being generated using javascript in one's browser, therefore Proton/Hush never has access to the private half of the keypair; color me skeptical about this one. Hush made almost identical claims, which came crashing down, when Hush was ordered by the Canadian courts to turn over in excess of 100,000 decrypted emails to the DEA in September 2007. In a similar manner, we have seen claims that Protonmail never collects IP addresses -- until they were required to do so by the Swiss authorities -- resulting in the arrest of a French activist.
It's the same pattern: making bold statements, and then when push comes to shove, being forced to backtrack, when the authorities force their hands. Now, it hasn't yet reached the point where the Swiss authorities have ordered Proton to produce the plaintext copies of emails, as happened with Hush, but I see it as only a matter of time. It will be interesting to see how Proton handles the mandatory e-Privacy derogation and scanning regulations expected to come into force in the coming year.
To sum up, I am going to quote Proton's CEO, Andy Yen:
Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we're required by Swiss law to answer requests from Swiss authorities.
— Andy Yen (@andyyen) September 5, 2021
From my perspective, any privacy protections that can be "suspended" at the whim of the authorities are simply not worth having.
The laws of mathematics are not amenable to suspension when officialdom issues a decree that this be so. Again, this is why it is so important to keep your private key(s) out of the hands of the service providers, whether it be Proton, Hush, or what have you.

 

[MaxosBanklogs]

What I find 'dubious' about Protonmail is the exact same thing that I found dubious about other similar services in the past, e.g. Hushmail. The entire foundation upon which public-key cryptography is constructed lies in the absolute separation of public and private halves of the keypairs. Like Hushmail before it, Protonmail requires that both public and private halves of the PGP keypairs be stored on their servers. I am of the opinion that the only place where the private half of my keypair(s) should reside is on hardware that is under my direct ownership and control.
There is a lot of hand-waving about the keys being generated using javascript in one's browser, therefore Proton/Hush never has access to the private half of the keypair; color me skeptical about this one. Hush made almost identical claims, which came crashing down, when Hush was ordered by the Canadian courts to turn over in excess of 100,000 decrypted emails to the DEA in September 2007. In a similar manner, we have seen claims that Protonmail never collects IP addresses -- until they were required to do so by the Swiss authorities -- resulting in the arrest of a French activist.
It's the same pattern: making bold statements, and then when push comes to shove, being forced to backtrack, when the authorities force their hands. Now, it hasn't yet reached the point where the Swiss authorities have ordered Proton to produce the plaintext copies of emails, as happened with Hush, but I see it as only a matter of time. It will be interesting to see how Proton handles the mandatory e-Privacy derogation and scanning regulations expected to come into force in the coming year.
To sum up, I am going to quote Proton's CEO, Andy Yen:
Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we're required by Swiss law to answer requests from Swiss authorities.
— Andy Yen (@andyyen) September 5, 2021
From my perspective, any privacy protections that can be "suspended" at the whim of the authorities are simply not worth having.
The laws of mathematics are not amenable to suspension when officialdom issues a decree that this be so. Again, this is why it is so important to keep your private key(s) out of the hands of the service providers, whether it be Proton, Hush, or what have you.

I'm not sure to follow you regarding the « absolute separation ». My private and public keys are always on the same machine, or USB key, not in the same file/keyring, but definitely on the same host or device. As for ProtonMail's position, let's imagine they let the private key on your computer, for instance how will users read or send their emails from their mobile ? Sure the user could copy the key and set up everything, each time a new key is added. In the end, ProtonMail is not intended for geeks or computer whiz only but also journalists and other people without necessarily a technical background. It's more a «security for everyone» product than a «hardcore security tool for specialists». There has been a few « attacks » about their security but as far as I can say, many of them were misinformed at best and the other ones helped to improve the product.

Regarding IP address collection, are you referring to ProtonMail or to ProtonVPN service ? Because for ProtonMail you also have a Tor hidden service, the IP stored is not your original IP address, as you know. So in this case, and in my opinion, the French activist is more to blame for poor OpSec than ProtonMail or PGP. Again, it's clearly written in ProtonMail's terms and conditions that they will legally comply if someone can prove that you engaged in unlawful or prohibited activities. I do not know the technology behind HushMail but I'm not surprised that the courts ordered to get the decrypted emails. However it would be more interesting to know if they did really get the decrypted emails. Just have a look at the exchanges between the Signal Foundation and the American courts you'll see that a judge can request a lot of user data, and in the end, get nothing more than what the Signal Foundation can technically provide, which isn't much. My point is : what is asked counts for less than what is given.

You're right, it will be interesting to see how Swiss and ProtonMail handle the new regulations. As for the private key, it is stored encrypted with the passphrase on the server. They never get your password in clear form so I do not see how they could provide LE with decrypted e-mails. By the way, their code is available on ProtonMail's github repository. And it still provide a better security than people who don't care to protect their private key thinking it's safe on the computer. In which case nothing can save you when your computer get seized.

Given your perspective, if I follow correctly, you'd prefer to trust with your money (or buy a service from) a company who will openly declare that they have the best privacy protection, up to the point that they will not comply with authorities when a crime is committed ? Well, I for one, wouldn't find that very clever. And good luck finding one, because unless it's financed by a billionaire, no bank will lend any money to such a company. And even if there was one, it wouldn't be running for very long. I prefer to rely on technology, facts and OpSec rather than laws, regulations and declarations. If the product is good, then it doesn't matter at all that the company comply. Look at Signal, they comply with government requests, and yet, LE does not get message contents. I'm not saying ProtonMail is the best solution for everyone but it's definitely a step forward in the right direction for «non-technical users» and by extension, for all, nothing dubious about that ;o)

 

[AndrewTateTrack1n2]

I'm not sure to follow you regarding the « absolute separation ». My private and public keys are always on the same machine, or USB key, not in the same file/keyring, but definitely on the same host or device. As for ProtonMail's position, let's imagine they let the private key on your computer, for instance how will users read or send their emails from their mobile ? Sure the user could copy the key and set up everything, each time a new key is added. In the end, ProtonMail is not intended for geeks or computer whiz only but also journalists and other people without necessarily a technical background. It's more a «security for everyone» product than a «hardcore security tool for specialists». There has been a few « attacks » about their security but as far as I can say, many of them were misinformed at best and the other ones helped to improve the product.

Regarding IP address collection, are you referring to ProtonMail or to ProtonVPN service ? Because for ProtonMail you also have a Tor hidden service, the IP stored is not your original IP address, as you know. So in this case, and in my opinion, the French activist is more to blame for poor OpSec than ProtonMail or PGP. Again, it's clearly written in ProtonMail's terms and conditions that they will legally comply if someone can prove that you engaged in unlawful or prohibited activities. I do not know the technology behind HushMail but I'm not surprised that the courts ordered to get the decrypted emails. However it would be more interesting to know if they did really get the decrypted emails. Just have a look at the exchanges between the Signal Foundation and the American courts you'll see that a judge can request a lot of user data, and in the end, get nothing more than what the Signal Foundation can technically provide, which isn't much. My point is : what is asked counts for less than what is given.

You're right, it will be interesting to see how Swiss and ProtonMail handle the new regulations. As for the private key, it is stored encrypted with the passphrase on the server. They never get your password in clear form so I do not see how they could provide LE with decrypted e-mails. By the way, their code is available on ProtonMail's github repository. And it still provide a better security than people who don't care to protect their private key thinking it's safe on the computer. In which case nothing can save you when your computer get seized.

Given your perspective, if I follow correctly, you'd prefer to trust with your money (or buy a service from) a company who will openly declare that they have the best privacy protection, up to the point that they will not comply with authorities when a crime is committed ? Well, I for one, wouldn't find that very clever. And good luck finding one, because unless it's financed by a billionaire, no bank will lend any money to such a company. And even if there was one, it wouldn't be running for very long. I prefer to rely on technology, facts and OpSec rather than laws, regulations and declarations. If the product is good, then it doesn't matter at all that the company comply. Look at Signal, they comply with government requests, and yet, LE does not get message contents. I'm not saying ProtonMail is the best solution for everyone but it's definitely a step forward in the right direction for «non-technical users» and by extension, for all, nothing dubious about that ;o)

Part 1 of 2
> /u/sgrbh - I'm not sure to follow you regarding the « absolute separation ».
My private key(s) do not exist anywhere in the cloud -- they live only on hardware that I personally own and control, and nowhere else. I wouldn't have it any other way.
> As for ProtonMail's position, let's imagine they let the private key on your computer, for instance how will users read or send
> their emails from their mobile?
The private halves of any PGP keys should NOT exist on any server or device in such a manner that a service like ProtonMail can access them. Because ProtonMail/Hushmail are not designed this way, I flatly refuse to use them. Users shouldn't be using mobile phones, period. You're either serious about your security, or you're not, and you're not serious about your security if you're using a mobile phone.
> Sure the user could copy the key and set up everything, each time a new key is added. In the end, ProtonMail is not intended
> for geeks or computer whiz only but also journalists and other people without necessarily a technical background. It's more a
> «security for everyone» product than a «hardcore security tool for specialists».
I don't deny that the service is dumbed-down -- in fact, that is why I don't particularly like ProtonMail and similar services, because they provide the illusion of security, as opposed to the reality. Real security would be a situation where ProtonMail/Hushmail doesn't possess your private key, so therefore they cannot be compelled to decrypt your encrypted traffic. That is why I quoted Andy Yen's statement:
>> "Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we're
>> required by Swiss law to answer >> requests from Swiss authorities."
Like I said earlier, privacy protections that can be "suspended" at the whim of the authorities are simply not worth having. The laws of mathematics are not amenable to suspension when officialdom issues a decree that this be so. Again, this is why it is so important to keep your private key(s) out of the hands of the service providers, whether it be Proton, Hush, or what have you.
> Regarding IP address collection, are you referring to ProtonMail or to ProtonVPN service ? Because for ProtonMail you also
> have a Tor hidden service, the IP stored is not your original IP address, as you know.
Sure, ProtonMail have a Tor hidden service, but they also require javascript to be enabled. I do not discount the possibility that they could be compelled to collect IP addresses that way, their hidden service notwithstanding. I am a skeptic with respect to these types of services, and my skepticism is backed-up by experience over the decades.
> So in this case, and in my opinion, the French activist is more to blame for poor OpSec than ProtonMail or PGP.
Unless I'm mistaken, the guy used a mobile phone -- if true, he was a idiot.
Now, that said, giving him the benefit of the doubt for a minute, the French police charged him with some type of 'terrorism' offense -- I think I can excuse a guy who is involved in building occupations (or squatting), for not expecting to be hit with terrorism charges, and having those used as the basis for going after his communications. (The skeptic in me says he should have used a service that didn't have ProtonMail's vulnerabilities).
> Again, it's clearly written in ProtonMail's terms and conditions that they will legally comply if someone can prove that you
> engaged in unlawful or prohibited activities. I do not know the technology behind HushMail but I'm not surprised that the courts
> ordered to get the decrypted emails.
If Hushmail had been designed properly NO court order would have been able to compel the operator to decrypt PGP-encrypted messages for which he does not possess the private half (and passphrase).
I find it risible that you bring up the issue of 'legality' here on Dread -- a site which is choc-a-bloc with drug users / drug dealers / fraudsters.
The technology used by Hushmail is little different from that used by ProtonMail, in that they store both halves of the PGP key on their servers. I have little doubt whatsoever that, at some point, ProtonMail is going to be compelled to decrypt email for some of their users.

 

[AndrewTateTrack1n2]

I'm not sure to follow you regarding the « absolute separation ». My private and public keys are always on the same machine, or USB key, not in the same file/keyring, but definitely on the same host or device. As for ProtonMail's position, let's imagine they let the private key on your computer, for instance how will users read or send their emails from their mobile ? Sure the user could copy the key and set up everything, each time a new key is added. In the end, ProtonMail is not intended for geeks or computer whiz only but also journalists and other people without necessarily a technical background. It's more a «security for everyone» product than a «hardcore security tool for specialists». There has been a few « attacks » about their security but as far as I can say, many of them were misinformed at best and the other ones helped to improve the product.

Regarding IP address collection, are you referring to ProtonMail or to ProtonVPN service ? Because for ProtonMail you also have a Tor hidden service, the IP stored is not your original IP address, as you know. So in this case, and in my opinion, the French activist is more to blame for poor OpSec than ProtonMail or PGP. Again, it's clearly written in ProtonMail's terms and conditions that they will legally comply if someone can prove that you engaged in unlawful or prohibited activities. I do not know the technology behind HushMail but I'm not surprised that the courts ordered to get the decrypted emails. However it would be more interesting to know if they did really get the decrypted emails. Just have a look at the exchanges between the Signal Foundation and the American courts you'll see that a judge can request a lot of user data, and in the end, get nothing more than what the Signal Foundation can technically provide, which isn't much. My point is : what is asked counts for less than what is given.

You're right, it will be interesting to see how Swiss and ProtonMail handle the new regulations. As for the private key, it is stored encrypted with the passphrase on the server. They never get your password in clear form so I do not see how they could provide LE with decrypted e-mails. By the way, their code is available on ProtonMail's github repository. And it still provide a better security than people who don't care to protect their private key thinking it's safe on the computer. In which case nothing can save you when your computer get seized.

Given your perspective, if I follow correctly, you'd prefer to trust with your money (or buy a service from) a company who will openly declare that they have the best privacy protection, up to the point that they will not comply with authorities when a crime is committed ? Well, I for one, wouldn't find that very clever. And good luck finding one, because unless it's financed by a billionaire, no bank will lend any money to such a company. And even if there was one, it wouldn't be running for very long. I prefer to rely on technology, facts and OpSec rather than laws, regulations and declarations. If the product is good, then it doesn't matter at all that the company comply. Look at Signal, they comply with government requests, and yet, LE does not get message contents. I'm not saying ProtonMail is the best solution for everyone but it's definitely a step forward in the right direction for «non-technical users» and by extension, for all, nothing dubious about that ;o)

Part 2 of 2
> However it would be more interesting to know if they did really get the decrypted emails. Just have a look at the exchanges
> between the Signal Foundation and the American courts you'll see that a judge can request a lot of user data, and in the end,
> get nothing more than what the Signal Foundation can technically provide, which isn't much. My point is : what is asked counts
> for less than what is given.
It is a matter of record that Hushmail was compelled to turn over 100K+ decrypted emails to the DEA. That is not in dispute. The courts can ask for whatever they want from Signal; the issue is that Signal does NOT store the information, so there is nothing to hand over. Hushmail/Protonmail are quite different -- there is a world of information for them to turn over if they are ordered to do so.
> You're right, it will be interesting to see how Swiss and ProtonMail handle the new regulations.
2022 is going to be interesting, no doubt about it.
> As for the private key, it is stored encrypted with the passphrase on the server. They never get your password in clear form so I do not see how they could provide LE with decrypted e-mails.
What part of this has already been done, do you not appear to understand? Hush and ProtonMail both use Javascript based systems; both store the public and private halves of the key on their servers. All that is necessary for them to decrypt your mail, is for them to capture your passphrase. In the case of Hush, this was done with a 'poisoned' applet that was fed to users whose account names were mentioned on a warrant. These 'poisoned' applets served to capture the users' passphrase and forward it onto Hush. With the users' passphrase and private key-half, their email was trivially decrypted.
I believe ProtonMail users are at the same risk.
> By the way, their code is available on ProtonMail's github repository.
So what? Hushmail also published their source code -- the only way anyone could ever determine that anything had gone wrong would be to verify the downloaded copy versus the github copy. If a user has that sort of skill, why are they depending on a service like Hush/ProtonMail to handle their encryption in the first place?
> And it still provide a better security than people who don't care to protect their private key thinking it's safe on the computer.
We'll have to agree to disagree on this one.
> In which case nothing can save you when your computer get seized.
That depends. If Ross Ulbricht had closed the lid of his laptop in the Glen Park public library, the Feds would likely never have gotten to the data on his laptop.
> Given your perspective, if I follow correctly, you'd prefer to trust with your money (or buy a service from) a company who will
> openly declare that they have the best privacy protection, up to the point that they will not comply with authorities when a crime
> is committed ?
I would much rather prefer to deal with a company that has designed their systems such that they have nothing to hand over to the authorities. Just look at Signal.
> Well, I for one, wouldn't find that very clever. And good luck finding one, because unless it's financed by a billionaire, no bank will
> lend any money to such a company. And even if there was one, it wouldn't be running for very long.
Believe it or not, there are services that do run in such a manner, and they have been in existence for decades.
> I prefer to rely on technology, facts and OpSec rather than laws, regulations and declarations. If the product is good, then it
> doesn't matter at all that the company comply. Look at Signal, they comply with government requests, and yet, LE does not get
> message contents.
Every service complies with government requests; the operators do not particularly wish to wind up in prison. That said (like Signal) if the system is designed properly in such a manner so as to not collect information or permit the authorities to decrypt, there is not much the authorities can do about it.
> I'm not saying ProtonMail is the best solution for everyone but it's definitely a step forward in the right direction for «non-
> technical users» and by extension, for all, nothing dubious about that ;o)
We'll have to agree to disagree on that one.

 

[MaxosBanklogs]

Part 2 of 2
> However it would be more interesting to know if they did really get the decrypted emails. Just have a look at the exchanges
> between the Signal Foundation and the American courts you'll see that a judge can request a lot of user data, and in the end,
> get nothing more than what the Signal Foundation can technically provide, which isn't much. My point is : what is asked counts
> for less than what is given.
It is a matter of record that Hushmail was compelled to turn over 100K+ decrypted emails to the DEA. That is not in dispute. The courts can ask for whatever they want from Signal; the issue is that Signal does NOT store the information, so there is nothing to hand over. Hushmail/Protonmail are quite different -- there is a world of information for them to turn over if they are ordered to do so.
> You're right, it will be interesting to see how Swiss and ProtonMail handle the new regulations.
2022 is going to be interesting, no doubt about it.
> As for the private key, it is stored encrypted with the passphrase on the server. They never get your password in clear form so I do not see how they could provide LE with decrypted e-mails.
What part of this has already been done, do you not appear to understand? Hush and ProtonMail both use Javascript based systems; both store the public and private halves of the key on their servers. All that is necessary for them to decrypt your mail, is for them to capture your passphrase. In the case of Hush, this was done with a 'poisoned' applet that was fed to users whose account names were mentioned on a warrant. These 'poisoned' applets served to capture the users' passphrase and forward it onto Hush. With the users' passphrase and private key-half, their email was trivially decrypted.
I believe ProtonMail users are at the same risk.
> By the way, their code is available on ProtonMail's github repository.
So what? Hushmail also published their source code -- the only way anyone could ever determine that anything had gone wrong would be to verify the downloaded copy versus the github copy. If a user has that sort of skill, why are they depending on a service like Hush/ProtonMail to handle their encryption in the first place?
> And it still provide a better security than people who don't care to protect their private key thinking it's safe on the computer.
We'll have to agree to disagree on this one.
> In which case nothing can save you when your computer get seized.
That depends. If Ross Ulbricht had closed the lid of his laptop in the Glen Park public library, the Feds would likely never have gotten to the data on his laptop.
> Given your perspective, if I follow correctly, you'd prefer to trust with your money (or buy a service from) a company who will
> openly declare that they have the best privacy protection, up to the point that they will not comply with authorities when a crime
> is committed ?
I would much rather prefer to deal with a company that has designed their systems such that they have nothing to hand over to the authorities. Just look at Signal.
> Well, I for one, wouldn't find that very clever. And good luck finding one, because unless it's financed by a billionaire, no bank will
> lend any money to such a company. And even if there was one, it wouldn't be running for very long.
Believe it or not, there are services that do run in such a manner, and they have been in existence for decades.
> I prefer to rely on technology, facts and OpSec rather than laws, regulations and declarations. If the product is good, then it
> doesn't matter at all that the company comply. Look at Signal, they comply with government requests, and yet, LE does not get
> message contents.
Every service complies with government requests; the operators do not particularly wish to wind up in prison. That said (like Signal) if the system is designed properly in such a manner so as to not collect information or permit the authorities to decrypt, there is not much the authorities can do about it.
> I'm not saying ProtonMail is the best solution for everyone but it's definitely a step forward in the right direction for «non-
> technical users» and by extension, for all, nothing dubious about that ;o)
We'll have to agree to disagree on that one.

> The private halves of any PGP keys should NOT exist on any server or device in such a manner that a service like ProtonMail can access them. Because ProtonMail/Hushmail are not designed this way, I
> flatly refuse to use them. Users shouldn't be using mobile phones, period. You're either serious about your security, or you're not, and you're not serious about your security if you're using a mobile phone.

Not my point, replace "phone" by "other computer" if you prefer and you'll get what I mean. In a professional context, it's a frequent need to access to your emails, sometimes on other machines. And nowadays, many people with access to very sensitive materials are using smartphones to write e-mails, your president and ministers for instance, S&P 500 companies CEOs/CFOs/CTOs. Do you think they all master the CLI and use gpg everyday ? Probably not, what is good for you is not always good for everyone, everywhere. And well, most of them also have pretty good security with real experts at their service, they pay top dollars for it.

> The private halves of any PGP keys should NOT exist on any server or device in such a manner that a service like ProtonMail can access them. Because ProtonMail/Hushmail are not designed this way, I
> flatly refuse to use them. Users shouldn't be using mobile phones, period. You're either serious about your security, or you're not, and you're not serious about your security if you're using a mobile phone.

Rightly so, but it's not the full unencrypted private key that is stored on their server, if that was the case then they could restore your access to older e-mails in case you lost/forgot your password but I know for a fact it's not possible. I doubt they would deny a feature to all of their paying clients, just to allow the same feature only to LE in a few rare cases. Would that be true and come to be known (like any other «secret» would) the company is finished.

> Now, that said, giving him the benefit of the doubt for a minute, the French police charged him with some type of 'terrorism' offense -- I think I can excuse a guy who is involved in building occupations (or
> squatting), for not expecting to be hit with terrorism charges, and having those used as the basis for going after his communications. (The skeptic in me says he should have used a service that didn't have
> ProtonMail's vulnerabilities).

Well, unfortunately «terrorism charges» these days allow pretty much anything so it's always convenient. And even your top-notch security product cannot do much for you if someone installs a hardware keylogger between your keyboard and motherboard, or a well-placed webcam, all of that being possible when terrorism is «officially suspected».

> If Hushmail had been designed properly NO court order would have been able to compel the operator to decrypt PGP-encrypted messages for which he does not possess the private half (and passphrase).

Well, provided they had access to the user's passphrase in clear, of course the security was at fault. But again, not the case of ProtonMail. It's not because two companies have the same service with pretty much the same technology (which by the way is the same technology you are defending, just a different implementation of it to cover needs you don't have but others do) that they have the same flaws.

> If Hushmail had been designed properly NO court order would have been able to compel the operator to decrypt PGP-encrypted messages for which he does not possess the private half (and passphrase).

Well, people make mistakes, and that's often how you get to improve something. All the more reasons for ProtonMail not to reproduce exactly a model know to be faulty.

> I find it risible that you bring up the issue of 'legality' here on Dread -- a site which is choc-a-bloc with drug users / drug dealers / fraudsters.

Maybe I wasn't clear enough but the point was merely about reading terms and conditions instead of blindly accepting or worse, ignoring them, and then complain about «snitches» and «evil companies». Drug users / drug dealers / fraudsters and the like are all humans, there are clever people amongst us, and stupid ones. How can someone expect to be protected by a company when said company clearly stated they would not ? I take it you've never seen the inside of a prison, either you're too smart for that, or you have the luxury to find it risible because you never interested them enough.

> The technology used by Hushmail is little different from that used by ProtonMail, in that they store both halves of the PGP key on their servers. I have little doubt whatsoever that, at some point, ProtonMail
> is going to be compelled to decrypt email for some of their users.

That's pure speculation, again if you loose your password, you loose access to all the previous communications. But if your PC is under some form of monitoring and LE got access to your password, then ProtonMail will provide your encrypted emails (as you've been warned) that LE would then easily be able to decrypt with your involuntary help. Does that mean ProtonMail is evil or their product not good enough ?

 

[DeadPrezi700]

> The private halves of any PGP keys should NOT exist on any server or device in such a manner that a service like ProtonMail can access them. Because ProtonMail/Hushmail are not designed this way, I
> flatly refuse to use them. Users shouldn't be using mobile phones, period. You're either serious about your security, or you're not, and you're not serious about your security if you're using a mobile phone.

Not my point, replace "phone" by "other computer" if you prefer and you'll get what I mean. In a professional context, it's a frequent need to access to your emails, sometimes on other machines. And nowadays, many people with access to very sensitive materials are using smartphones to write e-mails, your president and ministers for instance, S&P 500 companies CEOs/CFOs/CTOs. Do you think they all master the CLI and use gpg everyday ? Probably not, what is good for you is not always good for everyone, everywhere. And well, most of them also have pretty good security with real experts at their service, they pay top dollars for it.

> The private halves of any PGP keys should NOT exist on any server or device in such a manner that a service like ProtonMail can access them. Because ProtonMail/Hushmail are not designed this way, I
> flatly refuse to use them. Users shouldn't be using mobile phones, period. You're either serious about your security, or you're not, and you're not serious about your security if you're using a mobile phone.

Rightly so, but it's not the full unencrypted private key that is stored on their server, if that was the case then they could restore your access to older e-mails in case you lost/forgot your password but I know for a fact it's not possible. I doubt they would deny a feature to all of their paying clients, just to allow the same feature only to LE in a few rare cases. Would that be true and come to be known (like any other «secret» would) the company is finished.

> Now, that said, giving him the benefit of the doubt for a minute, the French police charged him with some type of 'terrorism' offense -- I think I can excuse a guy who is involved in building occupations (or
> squatting), for not expecting to be hit with terrorism charges, and having those used as the basis for going after his communications. (The skeptic in me says he should have used a service that didn't have
> ProtonMail's vulnerabilities).

Well, unfortunately «terrorism charges» these days allow pretty much anything so it's always convenient. And even your top-notch security product cannot do much for you if someone installs a hardware keylogger between your keyboard and motherboard, or a well-placed webcam, all of that being possible when terrorism is «officially suspected».

> If Hushmail had been designed properly NO court order would have been able to compel the operator to decrypt PGP-encrypted messages for which he does not possess the private half (and passphrase).

Well, provided they had access to the user's passphrase in clear, of course the security was at fault. But again, not the case of ProtonMail. It's not because two companies have the same service with pretty much the same technology (which by the way is the same technology you are defending, just a different implementation of it to cover needs you don't have but others do) that they have the same flaws.

> If Hushmail had been designed properly NO court order would have been able to compel the operator to decrypt PGP-encrypted messages for which he does not possess the private half (and passphrase).

Well, people make mistakes, and that's often how you get to improve something. All the more reasons for ProtonMail not to reproduce exactly a model know to be faulty.

> I find it risible that you bring up the issue of 'legality' here on Dread -- a site which is choc-a-bloc with drug users / drug dealers / fraudsters.

Maybe I wasn't clear enough but the point was merely about reading terms and conditions instead of blindly accepting or worse, ignoring them, and then complain about «snitches» and «evil companies». Drug users / drug dealers / fraudsters and the like are all humans, there are clever people amongst us, and stupid ones. How can someone expect to be protected by a company when said company clearly stated they would not ? I take it you've never seen the inside of a prison, either you're too smart for that, or you have the luxury to find it risible because you never interested them enough.

> The technology used by Hushmail is little different from that used by ProtonMail, in that they store both halves of the PGP key on their servers. I have little doubt whatsoever that, at some point, ProtonMail
> is going to be compelled to decrypt email for some of their users.

That's pure speculation, again if you loose your password, you loose access to all the previous communications. But if your PC is under some form of monitoring and LE got access to your password, then ProtonMail will provide your encrypted emails (as you've been warned) that LE would then easily be able to decrypt with your involuntary help. Does that mean ProtonMail is evil or their product not good enough ?

> Both services claim that all cryptographic operations take place in the users' browser, so that they never have access to the password, or the decrypted private key. That was thoroughly disproven in 2007,
> when Hush sent the targeted users 'poisoned' applets to capture the users' passphrase and sent it back to Hush. There is no reason that the same technique would not work on ProtonMail as well.
Then, for the sake of demonstration, let me prove to you how neither Hushmail, nor ProtonMail can give access to your clear e-mails, it's very simple, you just need not to give them that. I thought it was clear but apparently not. It's not so much that smartphones are inherently insecure, and some other software «very secure». It's that kind of simplistic thinking that leads to mistakes due to a false sense of security. Smartphones are a tool, ProtonMail is a tool, both may be used wisely, and both may be used «the dumb way». Apparently it's not obvious to you, but if ProtonMail gets its hands on your «unencrypted e-mails» and could give them to LE, it would be only because you gave them access to your «unencrypted emails». So again, instead of complaining about snitches, it's never forbidden to use your brain. Let's say that ProtonMail stores your password and your private key in clear form, then who can prevent you to encrypt/decrypt your messages locally (with *your* "private" key pair and your recipient's "private" key pair) and simply use ProtonMail as a «transport mean» with the added benefit of hiding your IP and transparently handle the first layer of encrypted communication ? Even in the remote possibility that LE can decrypt the first layer, they wouldn't have access to the content of your emails in clear form, would they ? And that's only a basic example to show that it's always possible to leverage a feature to your advantage and mitigate a potential weakness, instead of reasoning in terms of secure/insecure tools and making others responsible for your lack of creativity. It's not called snitching when you're warned beforehand.
The same applies to mobile phones, you can complain that mobile operators are snitching and giving away the listing of all your contacts. But what relation could they establish between your number and your identity or your relations as long as you use one SIM card for one recipient only, or better yet, for one call only. Sure it's expensive, but some would say much less than 10 years in prison, though. And again, you can wait for the perfect security product to hit the market, or use your brain and make do with what you have. The perfect tool, or the perfect software, is yet to be invented.
As you can see, it's possible to leverage ProtonMail benefit, without compromising your communications. And the beauty of it is that you could have done just the same with Hushmail and would not have given any information to cops. And again, complaining that ProtonMail is delivering e-mails when they're given proof that you are involved in some kind of criminal activity is looking at the wrong culprit. If you gave LE such proof then you made a mistake earlier, you should own up to it (and fix it when possible) instead of relying on others to protect your freedom. As far as I know and for the time being, ProtonMail does not give away everybody's emails, but only those they are complied to. There are many more people involved in criminal activities than people who get caught, it's a fact. Just my opinion, but to me talented criminals/hackers/fraudsters are not those who refuse to learn or play by the rules, but instead those who know perfectly the rules and are able to turn them to their advantage.

 

[MaxosBanklogs]

> Both services claim that all cryptographic operations take place in the users' browser, so that they never have access to the password, or the decrypted private key. That was thoroughly disproven in 2007,
> when Hush sent the targeted users 'poisoned' applets to capture the users' passphrase and sent it back to Hush. There is no reason that the same technique would not work on ProtonMail as well.
Then, for the sake of demonstration, let me prove to you how neither Hushmail, nor ProtonMail can give access to your clear e-mails, it's very simple, you just need not to give them that. I thought it was clear but apparently not. It's not so much that smartphones are inherently insecure, and some other software «very secure». It's that kind of simplistic thinking that leads to mistakes due to a false sense of security. Smartphones are a tool, ProtonMail is a tool, both may be used wisely, and both may be used «the dumb way». Apparently it's not obvious to you, but if ProtonMail gets its hands on your «unencrypted e-mails» and could give them to LE, it would be only because you gave them access to your «unencrypted emails». So again, instead of complaining about snitches, it's never forbidden to use your brain. Let's say that ProtonMail stores your password and your private key in clear form, then who can prevent you to encrypt/decrypt your messages locally (with *your* "private" key pair and your recipient's "private" key pair) and simply use ProtonMail as a «transport mean» with the added benefit of hiding your IP and transparently handle the first layer of encrypted communication ? Even in the remote possibility that LE can decrypt the first layer, they wouldn't have access to the content of your emails in clear form, would they ? And that's only a basic example to show that it's always possible to leverage a feature to your advantage and mitigate a potential weakness, instead of reasoning in terms of secure/insecure tools and making others responsible for your lack of creativity. It's not called snitching when you're warned beforehand.
The same applies to mobile phones, you can complain that mobile operators are snitching and giving away the listing of all your contacts. But what relation could they establish between your number and your identity or your relations as long as you use one SIM card for one recipient only, or better yet, for one call only. Sure it's expensive, but some would say much less than 10 years in prison, though. And again, you can wait for the perfect security product to hit the market, or use your brain and make do with what you have. The perfect tool, or the perfect software, is yet to be invented.
As you can see, it's possible to leverage ProtonMail benefit, without compromising your communications. And the beauty of it is that you could have done just the same with Hushmail and would not have given any information to cops. And again, complaining that ProtonMail is delivering e-mails when they're given proof that you are involved in some kind of criminal activity is looking at the wrong culprit. If you gave LE such proof then you made a mistake earlier, you should own up to it (and fix it when possible) instead of relying on others to protect your freedom. As far as I know and for the time being, ProtonMail does not give away everybody's emails, but only those they are complied to. There are many more people involved in criminal activities than people who get caught, it's a fact. Just my opinion, but to me talented criminals/hackers/fraudsters are not those who refuse to learn or play by the rules, but instead those who know perfectly the rules and are able to turn them to their advantage.

Your last comment was a bit over my head :/
Is my Protonmail account that I created in Whonix and have never accessed via mobile or clearnet secure? I have accessed it via Tor on Windows.
Thanks for the lesson

 

[Cipher Soul]

Not every secure messaging app is as safe as it would like us to think. And some are safer than others.


A recently disclosed FBI training document [dated January 7, 2021] shows how much access to the content of encrypted messages from secure messaging services US law enforcement can gain and what they can learn about your usage of the apps.


The infographic shows details about iMessage, Line, Signal, Telegram, Threema, Viber, WeChat, WhatsApp, and Wickr. All of them are messaging apps that promise end-to-end encryption for their users. And while the FBI document does not say this isn’t true, it reveals what type of information law enforcement will be able to unearth from each of the listed services.


Note: A pen register is an electronic tool that can be used to capture data regarding all telephone numbers that are dialed from a specific phone line. So if you see that mentioned below it refers to the FBI’s ability to find out who you have been communicating with.


iMessage
iMessage is Apple’s instant messaging service. It works across Macs, iPhones, and iPads. Using it on Android is hard because Apple uses a special end-to-end encryption system in iMessage that secures the messages from the device they’re sent on, through Apple’s servers, to the device receiving them. Because the messages are encrypted, the iMessage network is only usable by devices that know how to decrypt the messages. Here’s what the document says it can access for iMessage:
* Message content limited.
* Subpoena: Can render basic subscriber information.
* 18 USC §2703(d): Can render 25 days of iMessage lookups and from a target number.
* Pen Register: No capability.
* Search Warrant: Can render backups of a target device; if target uses iCloud backup, the encryption keys should also be
provided with content return. Can also acquire iMessages from iCloud returns if target has enabled Messages in iCloud.
Line
Line is a freeware app for instant communications on electronic devices such as smartphones, tablets, and personal computers. In July 2016, Line Corporation turned on end-to-end encryption by default for all Line users, after it had earlier been available as an opt-in feature since October 2015. The document notes on Line:
* Message content limited.
* Suspect’s and/or victim’s registered information (profile image, display name, email address, phone number, LINE ID, date of
registration, etc.)

* Information on usage.

* Maximum of seven days’ worth of specified users’ text chats (Only when end-to-end encryption has not been elected and
applied and only when receiving an effective warrant; however, video, picture, files, location, phone call audio and other such
data will not be disclosed).


Signal
Signal is a cross-platform centralized encrypted instant messaging service. Users can send one-to-one and group messages, which can include files, voice notes, images and videos. Signal uses standard cellular telephone numbers as identifiers and secures all communications to other Signal users with end-to-end encryption. The apps include mechanisms by which users can independently verify the identity of their contacts and the integrity of the data channel. The document notes about Signal:
* No message content.
* Date and time a user registered.
* Last date of a user’s connectivity to the service.
This seems to be consistent with Signal’s claims.


Telegram
Telegram is a freeware, cross-platform, cloud-based instant messaging (IM) system. The service also provides end-to-end encrypted video calling, VoIP, file sharing and several other features. There are also two official Telegram web twin apps—WebK and WebZ—and numerous unofficial clients that make use of Telegram’s protocol. The FBI document says about Telegram:
* No message content.
* No contact information provided for law enforcement to pursue a court order. As per Telegram’s privacy statement, for
confirmed terrorist investigations, Telegram may disclose IP and phone number to relevant authorities.


Threema
Threema is an end-to-end encrypted mobile messaging app. Unlike other apps, it doesn’t require you to enter an email address or phone number to create an account. A user’s contacts and messages are stored locally, on each user’s device, instead of on the server. Likewise, your public keys reside on devices instead of the central servers. Threema uses the open-source library NaCl for encryption. The FBI document says it can access:
* No message content.
* Hash of phone number and email address, if provided by user.
* Push Token, if push service is used.
* Public Key
* Date (no time) of Threema ID creation.
* Date (no time) of last login.


Viber
Viber is a cross-platform messaging app that lets you send text messages, and make phone and video calls. Viber’s core features are secured with end-to-end encryption: calls, one-on-one messages, group messages, media sharing and secondary devices. This means that the encryption keys are stored only on the clients themselves and no one, not even Viber itself, has access to them. The FBI notes:
* No message content.
* Provides account (i.e. phone number)) registration data and IP address at time of creation.
* Message history: time, date, source number, and destination number.


WeChat
WeChat is a Chinese multi-purpose instant messaging, social media and mobile payment app. User activity on WeChat has been known to be analyzed, tracked and shared with Chinese authorities upon request as part of the mass surveillance network in China. WeChat uses symmetric AES encryption but does not use end-to-end encryption to encrypt users messages. The FBI has less access than the Chinese authorities and can access:
* No message content.
* Accepts account preservation letters and subpoenas, but cannot provide records for accounts created in China.
* For non-China accounts, they can provide basic information (name, phone number, email, IP address), which is retained for as
long as the account is active.


WhatsApp
WhatsApp, is an American, freeware, cross-platform centralized instant messaging and VoIP service owned by Meta Platforms.[ formerly FaceBook] It allows users to send text messages and voice messages, make voice and video calls, and share images, documents, user locations, and other content. WhatsApp’s end-to-end encryption is used when you message another person using WhatsApp Messenger. The FBI notes:
* Message content limited.
* Subpoena: Can render basic subscriber records.
* Court order: Subpoena return as well as information like blocked users.
* Search warrant: Provides address book contacts and WhatsApp users who have the target in their address book contacts.
* Pen register: Sent every 15 minutes, provides source and destination for each message.
* If target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message
content.


Wickr
Wickr has developed several secure messaging apps based on different customer needs: Wickr Me, Wickr Pro, Wickr RAM, and Wickr Enterprise. The Wickr instant messaging apps allow users to exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file attachments. Wickr was founded in 2012 by a group of security experts and privacy advocates but was acquired by Amazon Web Services. The FBI notes:
* No message content.
* Date and time account created.
* Type of device(s) app installed on.
* Date of last use.
* Number of messages.
* Number of external IDs (email addresses and phone numbers) connected to the account, bot not to plaintext external IDs
themselves.
* Avatar image.
* Limited records of recent changes to account setting such as adding or suspending a device (does not include message
content or routing and delivery information).
* Wickr version number.


Conclusion
If there is one thing clear from the information in this document it’s that most, if not all, of your messages are safe from prying eyes in these apps, unless you’re using WeChat in China. Based on the descriptions, you can check out which apps are available on your favorite platform and which of the bullet points are relevant to you, to decide which app is a good choice for you.


The safest way however is to make sure the FBI doesn’t consider you a person of interest. In those cases even using a special encrypted device can pose some risks.
Stay safe, everyone!

Here's what data the FBI can get from WhatsApp, iMessage, Signal, Telegram, and more

A disclosed FBI training document reveals what information can be revealed about your usage of an end to end encrypted instant messaging app.

blog.malwarebytes.com

Thank you for sharing this information. It's always beneficial to stay a few steps ahead.

- Cipher