Yes, nothing special - if someone else has your phone, it's not your phone anymore.

To be fair, Apple and Google both put a lot of effort into making exploiting a phone as difficult as they can even in the case of an attacker having physical possession.

I’d much rather have potential “evidence” against me on my phone, than on my laptop.

The stakes are very high though, and the attackers very motivated and well resourced, and I suspect there’s enough political pressure on them both to do only “a good enough job to make it look like they’re succeeding”. If anybody thinks the NSA isn’t several steps ahead of both Apple/Google and NSO/GreyKey, wtheyre fooling themselves...

Does Signal not encrypt its DBs when not in use and upon shutdown?

Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778

Generally: If someone has physical access to a device, you can probably assume they control it.

The iPhone's terrible battery life isn't a bug, it's a privacy feature! I wonder if the FBI's evidence protocol involves immediately plugging in an iPhone to maintain the vulnerable state:

> That latter acronym stands for “after first unlock” and describes an iPhone in a certain state: an iPhone that is locked but that has been unlocked once and not turned off. An iPhone in this state is more susceptible to having data inside extracted because encryption keys are stored in memory.

I do wish Apple would add "restart" as one of the system actions in the Shortcuts app.

One thing they did do: if you bring up the power off screen (by holding power, or power+volume up, depending on model) then it disables biometric unlock, even if you don't power it off. Bringing up the power off slider screen is sufficient to force a passcode-only unlock.

You can also disable biometrics by spamming the lock button.

On the latest iOS, on the latest/largest iPhone, this does not appear to be true any longer.

It does; five rapid clicks to the side button will trigger an alarm and require a passcode to unlock.

Unable to reproduce on iPhone 12 Pro Max on 14.4.

Do you have ‘Call with Side Button’ enabled?

Do people still think iPhones have bad battery life? Mine lasts for days.

Thet probably have the contact tracing feature enabled - that thing eats through the battery pretty quickly.

I have contact tracing enabled on my iPhone. Charge it nightly, usually sits around 70%-80% when i plug it in again the following evening.

Then again, i've been spending most of last year in my home, and i live in a rural area, so not much activity besides my wife and kids. I can only assume that the busier your surroundings, the more power is being drawn for contact tracing.

This should bring into question even more Signal's implementation of using real phone numbers for accounts. It is NOT privacy focused.

Even if this 'hackability' is an issue only with the security of the phone/hardware - able to be hacked and thus reach the decrypted signal messages - That also means, that person's Signal contacts also have their real identities exposed. (Where they wouldn't be if the account names/ids could be arbitrary like eg. wickr)

> It is NOT privacy focused.

It’s not anonymity focused.

If I want to have private conversations with friends, family or colleagues signal is fine.

Privacy encapsulates anonymity. Who you are talking to should be just as private as the contents of the message. Anonymity aids privacy.

Not sure I agree.

We expect heads of state to be able to have “private” discussions while knowing the other heads of state they may be communicating with. I can have “private” conversations with my partner, even though people know who that is.

You can also choose to anonymously communicate with no privacy, Reddit or 4chan style...

They may not be totally orthogonal, but I don’t think either privacy nor anonymity are encapsulated by each other.

You're just describing levels of privacy. Head's of state can of course have private discussions, where only the contents of conversation is private - but the fact the conversations took place are not private. Compare that to AnonA talked to AnonB - We're still aware two people communicated, but it's even more private as we can't infer their relationship (And probabilities about what might have been discussed - from other metadata of the conversation time,place,duration,frequency). And finally, perfect privacy nobody knows that a conversation took place in the first place and the contents are unknown too.

There is also still privacy in public communications when done anonymously, as you can't tie the information disclosed to the real identity (necessarily). -- Hence why for privacy purposes advertising data is often anonymized. (But again, less private of course, if ie I said I was a 2 fingered man in Poland and there is only 5 people fitting that description)

So I'd still say, perfect privacy cannot occur without anonymity.

Soon we will have an article about "If you use Signal to talk to your mother, FBI can see your messages if your mother send them to them"

Seems like this is partially Signal's fault to me. Why doesn't Signal independently encrypt the message db when not in use? It's well known at this point that iPhone is easily cracked, and thus Signal provides no security for a stolen phone.

Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778

> Why doesn't Signal independently encrypt the message db when not in use?

To what end?

If there's no additional authentication required to open the app and just view the messages normally, it's useless because they can just open the app and view the messages.

If they use their existing PINs as key material then, given an OS-level exploit grants access to the underlying database, it can be cracked offline in... basically no time at all.

If they allow you to create a long, secure password for opening the app, basically nobody uses it because nobody wants to type a 30 character password on a phone touchscreen every time they want to check/send a message.

Pretty much any solution that doesn't absolutely destroy usability still relies on the OS performing some sort of authentication first. (As in the current solution where the encryption keys are stored in the OS-level key store.)

If you're that concerned about your security, just go disable FaceID/TouchID so the iPhone never leaves keys in memory when it's locked.

Of course.

All these articles and "criticisms" of Signal started popping up right after the recent WhatsApp mini exodus. What a coincidence.

Maybe your assumption that something dubious is going on can be eliminated by Occam's razor? Because: any business that gains in popularity will automatically also see higher press coverage.

Occam's razor is good in theory but when you have powerful actors that can collude against people's best interest it's very harmful.

Where is the data that “women specifically in tech have more unfortunate encounters with men” than other industries?

Isn't it the case not just in tech, but literally in any field that is male-dominated? I strongly doubt that the problem you describe is any less prevalent in finance or academia, for example. Not a comprehensive list, of course, those were just two off the top of my head.

Yes obviously any male dominated industries was the point

If you raise Signal's profile then I think you can expect some half-informed tech journalists to start writing about it without fully understanding it.

I mean it makes sense. People are concerned about data privacy on WhatsApp so they move to signal. Then the people who have always said “signal isn’t perfectly secure” must reiterate to the masses what that have said many times before.

Alternatively - you're only because you're noticing it now because of the WhatsApp drama

Thomas Brewster has been on the encrypted messaging apps and law enforcement beat for a very long time and puts these stories out with regularity

WhatsApp is even worse, let us not even go there. If anything, I would go with Briar.