- cross-posted to:
- technology@hexbear.net
- cross-posted to:
- technology@hexbear.net
cross-posted from : https://lemmy.zip/post/71321898
Netzpoltik details that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance
They are a bit vague on this but I suspect all of these attack vectors start with LEOs having physical access to the unlocked phone. They then set up a trusted desktop without the phone owners knowing.
Which is clever, to be fair. Whether or not that’s legal is already a court case. The law is so frightfully grey.
Its also a failure of the user’s access control and operating security.
Once a third party has access to the secure environment, that environment is and will always be compromised.
Is the user made aware of this by the operator (signal, telegram, et al)?
If not, it’s a big haul to get to competency. The operator should be educating users on how to limit compromise.
i just logged into signal on my desktop app about 4 hours ago, and about 90 minutes after that i got a message from signal to my phone to inform me about this.
What exactly did they tell you?
“hey, somebody logged into your signal account on desktop about an hour ago. might want to check that that was actually you”