News for hackers. Stuff that matters.
Re:Danish military intelligence uses XKEYSCORE to tap cables... by codethief on Sunday November 01, 2020 @08:44PM (#24964190)
> That means that a state-level actor could possibly carry out a targeted attack to replace the Signal app on a given person's phone with a malicious build.

No, they couldn't. They would need the Signal developers' key. Android requires app updates to be signed with the same key as the original app.

Re:Danish military intelligence uses XKEYSCORE to tap cables... by cyphar on Sunday November 01, 2020 @10:09PM (#24964506)
A state-level actor can get the Signal key either covertly or by simply marching into the Signal offices with either a warrant or (if that fails) guns. Now, whether that will actually happen is a secondary issue -- but I submit that you have a mistaken conception of what a "state-level actor" means in a threat model. The fact that Google Inc doesn't hold the necessary keys but Signal LLC does is not a meaningful distinction to a state-level actor.

That isn't to say "all crypto is hopeless", simply that you shouldn't consider Signal to be state-level actor proof.