Conversation

Notices

1. float13@hackers.town's status on Thursday, 24-Feb-2022 04:01:38 UTC float13

   I want to dunk on these commercials for whatsapp :burning_poop: more but I realize I lack the understanding to do so sufficiently -

   What is the threat model/who is in a position to sniff plain-old SMS in transit?

   • Santa Claes 🇸🇪🇭🇰🎅 (clacke@libranet.de)'s status on Thursday, 24-Feb-2022 04:01:37 UTC Santa Claes 🇸🇪🇭🇰🎅

     in reply to
     I haven't seen the ad but: Anyone with a radio receiver and decoder in the right frequency band?
     
     GSM provides for terminal-to-tower encryption, but I think most countries require it turned off?
     
     Otherwise: Anyone with a Stingray device that MITMs the tower and turns off terminal-to-tower encryption.
   • kravietz 🦇 (kravietz@agora.echelon.pl)'s status on Thursday, 24-Feb-2022 04:01:37 UTC kravietz 🦇

     in reply to

     • Santa Claes 🇸🇪🇭🇰🎅
     @clacke
     
     BTW IMSI catcher doesn't disable encryption over the air — it just offers stronger signal than legitimate BTS, so your device sends encrypted GSM traffic to the catcher which captures its contents and then reencrypts and sends again encrypted to the true BTS.
     
     @float13
     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • Digital Mark λ 📚 🕹 💾 🥃 (mdhughes@appdot.net)'s status on Thursday, 24-Feb-2022 04:06:03 UTC Digital Mark λ 📚 🕹 💾 🥃

     in reply to

     • Santa Claes 🇸🇪🇭🇰🎅

     @float13 As @clacke notes, anyone. But the annoying part is WhatsApp is compromised by Facebook^W Meta, and the user has to dig into settings to get full encryption.

     Everyone should be using iMessage, Signal, maybe LINE, Telegram, Matrix? Never SMS.

     Santa Claes 🇸🇪🇭🇰🎅 likes this.