What's up, everyone? So today, we're talking about what Signal just rolled out, which was their new secure backup feature, and everyone's kind of celebrating it like they've revolutionized privacy protection or something, and they're actually rolling it out as like an opt-in feature, basically, and it's an encrypted backup archive.
And the free tier basically gets you all your texts plus the last 45 days of media with the paid tier that's like $1.99 or something per month.
That gets you the full text, you know, plus older media up to like 100 gigabytes.
And the first phase is Android beta only, and they're building a kind of centralized repository of user communications.
Mull that over for a moment, like think about that solitary statement, like does that actually sound like a good idea to you?
Now, before I go on, like the tangent, because that's bound to happen here, I love and I use Signal.
And, you know, I have for years, I say years, that's what I mean. I'm not some like, you know, Signal hater.
I also think that Moxie Marlin Spike is kind of a total badass.
And if you know much about him, then you know he in fact very much is when he publishes paper that basically demonstrated SSL strip back, I don't know.
I think he was in 09, probably wrong, but you know, whatever. Like, I was really amazed by that.
I totally did not capture tons of unencrypted usernames and passwords with it back in the day.
That's not a thing that actually happened.
Now, I have another YouTube channel called all hacking cons, which is not monetized and it never will be.
It's just a kind of a pet project that I set up to try to bring education around cybersecurity and information security by putting out other people's talks that are way more intelligent than me.
He definitely qualifies.
But basically, it's an archive of something like 20,000 plus videos currently.
And in it, you know, you'll find his talks, they exist there.
This backup system kind of stores your conversations on signal servers.
And they say it's protected by like the 64 character recovery key that gets generated locally and stays locally according to them.
Signal says that it never actually receives this key and that they can recover it if it gets lost.
And signal claims that the stored backups are directly linked to your actual signal account or your payment records.
And they use zero knowledge, you know, addressing similar to what they have in your with signal groups, metadata protections, basically.
This brings the question, can you back up locally?
And the answer to that is no, you cannot back up locally.
But don't worry, they swear they can't actually access your data without this key.
So that brings up another question.
Should we actually just blindly trust them with this information?
And I think this backup feature all in all is pretty much the point, which I'm going to push back on in regards to a few things here.
And first, let's start with the absolute most basic kind of rudimentary thing that we can.
And that's, you know, who actually made the announcement and pushed for this or made the announcement.
I can't really say that he pushed for it because I don't have access to their internal communications.
They claim to his users who pushed for this, which I have no doubt people said, hey, I want to be able to back up my data.
That makes sense.
Probably those people were assuming that it would be locally implemented first.
Side issue.
If we go back to the basics, the basics are who made the announcement post?
And it came from Jim O'Leary.
You know Jim, right?
Right?
You know Jim.
Comment below if you know Jim or if you don't know Jim.
Now, I personally did not know Jim.
I was not aware of Jim.
And this led me to my next question, which is, you know, who the hell is Jim?
And that led me to look into Jim was and, you know, well Jim is Signals Vice President of Engineering.
And it's not a new position.
He's been there since 2009.
But then I started looking into it and here's what kind of makes his background particularly interesting when we are specifically talking about him.
In the context of this specific post that he actually made.
So Jim spent four years at Twitter from 2011 to 2015.
If you know much about that time that might be concerning to you.
What did Jim do?
Well, he was building account anomaly detection systems, which is essentially behavioral surveillance to track and flag quote unquote unusual user activity.
Seeing that though, you know, kind of as a, hey, that's kind of weird, you know, when I was doing OSINT.
I kept going, right?
So like, oh, maybe that's just like, you know, one off after Twitter.
He didn't go directly to signal, right?
Instead, he kind of meandered around after his time at Twitter, he went straight to Facebook from 2015 to 2019.
What did he do there?
Well, he managed security teams of up to 30 people with a multimillion dollar budget during Facebook's worst privacy scandals.
At Facebook, Jim coordinated something called privacy IMOX.
And I have absolutely zero clue if that's how it's pronounced or if it's supposed to be pronounced something like IMOC's.
But I'm really not sure.
I'm pretty much committed to IMOX at this point.
So that's the term that I'm going to go with.
That term, however, like, however you want to say it is something that stands for privacy incident response teams.
Now, consider the nature and position and think back about, you know, what was actually going on at or around that time on Facebook.
Do you know, like this guy, according to that timeframe, and I want to phrase it like that for different legal reasons.
This was the guy that was literally managing Facebook's damage control teams during things like according to the timeframe, the whole Cambridge Analytica scandal.
And this is, you know, during like congressional hearings about privacy violations and during the VPN spying operation that Apple basically banned from their store.
Every major Facebook privacy breach from 15 to 19, then it would be logical to assume actually went through, you know, Jim's incident response teams,
especially because that was their focus was privacy, right?
So in case you didn't actually catch that, you know, term teams was absolutely plural.
So let's kind of walk through this and I'll try to paint you a more fuller picture here.
Jim wasn't just like some random, you know, low level or high level engineer like this guy legitimately controlled multimillion dollar surveillance budgets at Facebook.
His job included something called MNA security, which stands for mergers and acquisitions,
which means when Facebook wanted to buy WhatsApp or Instagram to eliminate competition, Jim would evaluate how to basically absorb these companies and their user data into Facebook's kind of panopticon of Facebook surveillance
that is basically a massive machine that, you know, continually generates revenue off the backs of its users.
When Facebook ended up buying WhatsApp for like 19 billion in 2014 and spending years integrating it, he was most likely the one that was there making sure that Facebook could properly surveil those two billion new users.
And when they acquired Instagram to control things like photo sharing, it was the same thing.
His job was literally helping Facebook eliminate any kind of alternatives by absorbing them.
Who actually cares about that?
Well, like I said, it gets worse.
Given the timeframe, he also most likely managed the security during Facebook's on of a privacy scandal, which related to a VPN, on of a VPN,
which Facebook basically marketed as protecting users while secretly using it to spy on what apps teenagers were using, tracking competitors like Snapchat and TikTok at the same time.
And when Apple ended up kicking the VPN off the App Store in 2018 for violating privacy rules,
guess who's managing Facebook's privacy and security and compliance teams.
Jim was, according to the timeline, he literally oversaw a fake privacy tool that was actually a surveillance weapon.
Now, let's think hard about this, right?
Does any of that actually sound familiar to you, right?
A privacy tool that's actually surveillance.
It's an interesting question because there's been quite a few of them, but now we see he's building signals secure backups.
And again, this is a guy who spent eight years in total between Twitter and Facebook, the two companies that perfected behavioral surveillance,
arguably, and data monetization before becoming Signals VP of Engineering in October of 2019.
The timing is just absolutely incredible.
He left Facebook right after Zuckerberg's whole privacy focused vision.
Remember that whole deal that he had where he had this complete 180 and was really 180, but you know, you don't know what I'm talking about.
It was this big announcement that was back in March of 2019, which just kind of kicked off this kind of insult to injury thing.
And it was right after the FTC had a record $5 billion fine, right when Facebook was under the maximum amount of privacy scrutiny, basically.
He went from building Twitter's anomaly detection systems to managing Facebook's privacy incident coverups and surveillance acquisitions to running signals engineering.
And you know, the revolving door between surveillance capitalism and privacy organizations really couldn't be any more obvious to anyone paying attention.
So, you know, that's kind of it. It's just it's crazy how there are such crazy parallels to actually uncover out there.
Also, like when I said that said, I wasn't talking about Jim, like, it still gets worse.
He also worked at Microsoft's Health Solutions Group, where he was the first security engineer for health of all where according to them,
they were architecting from scratch how to centralize and store your medical records.
And he built security for medical devices.
Basically the code that runs in devices, monitoring your heartbeat, your blood sugar, you know, you're most like, you know, intimate health data is what he worked on.
And he also found vulnerabilities in these systems after leaving Microsoft in 2011 and 2015.
Meaning he either, you know, had backdoor knowledge or the systems were so broken that external reviews basically revealed flaws.
Now, dude had monitoring users kind of down to a heartbeat, you know, right.
So, look at the pattern that's across his entire career.
At Microsoft from like 04 to 11, he basically built centralized health surveillance during the push for electronic medical records, right.
And at Twitter from 2011 to 2015, he built behavioral anomaly detection during the hour spring when governments were, you know, clamoring
and just desperate to track protesters.
And thanks to the Twitter files, we know a lot about that.
But at Facebook from 2015 to 2019, he managed privacy violations during the Cambridge Analytica GDPR and congressional investigations.
Now, like every single position involved centralizing sensitive data during periods of maximum surveillance expansion.
Jim launched Twitter's bug bounty program, which sounds really good, right, until you actually realize that a lot of times these programs serve to actually privatize vulnerability discovery
and kind of keeps exploits quiet through financial incentives, which a lot of the time makes it so that you just spend money and they don't actually have the fixed stuff.
So you're going to see it as going away versus kind of the immediate public disclosure that I'm more of a fan of.
Which is like, yeah, we know like anyone who was on breach forums probably can be like, yeah, that makes sense.
But at Facebook, he ran their bug bounty, you know, like with a multimillion dollar budget and again, these this huge team of people.
And it's kind of the same playbook with this guy just different surveillance companies, right.
He rewrote Twitter's production login systems that in turn was used to track every authentication event specifically for behavioral analysis.
He managed Facebook's AVVR security for like their metaverse surveillance ambitions, which I'm sure were super creepy like mapping out houses and stuff.
But now he's implementing signals backup authentication system using the same type of architectural principle, which is from, you know, what we see centralized management, right.
Like if you notice in the actual blog post, there's no real concrete technical details.
There's pretty much just, you know, a bunch of trust us bro kind of nonsense BS that links to impart their groups.
That's pretty much it.
You know, for a guy that's been entrenched in the anti privacy scene, by and large, that's kind of what he's a crusader of and so wrapped up in tech companies.
You know, he sure wasn't very technical or descriptive for a VP of engineering.
And again, like real quick, just before I move on, like, I just want to reiterate like I do you signal like, and that's why I'm making this video is because that's why it's an issue.
We as the users, you know, should absolutely voice our opinions on what we believe is a problem or could be a problem or is an issue.
And not only do I use it, but like I like it, I actively like it.
It's something that like I do suggest, especially to, you know, the normies that are out there, because it's better than just plain text messaging.
Obviously, and it's clean, it's got a nice UI, it's got great UX, like, you can just open it up and it's and you're fine with it.
There's no real hard configuration or anything, right.
It's on x amp, right.
You know, something that's that's going to require multiple steps in parallel.
And I think discussions and information like this should be things that we're having and it should be things that are readily available to the public.
These are the kind of discussions that I think we should be having in regards to software companies, whether they're, you know, FOS or whatever.
Like it's not just the code that, you know, we're running, but it's also the people that like are literally overseeing the code.
That also matter in my opinion, in the equation that we look at when we look at these kind of things like and signal is, you know, not without its own issues, though.
And that's, you know, something that we should also touch on, right.
Like so, for example, their desktop database encryption key, right, stored in plain text since 2018, only fixing it later on in July of 2024, after there's a ton of public scrutiny.
And I remember when this was happening, people like, Oh, are you going to make a video on it?
I just I didn't because I had a ton of stuff going on.
But, you know, basically signal at storage or encryption keys in plain text on desktop systems, which was a vulnerability that security researchers had been kind of screaming about for like six years or something.
Like any malware with any kind of like basic file access permissions could absolutely grab these keys and decrypt your entire message history, really without breaking a sweat.
And when confronted about this very issue, you know, the kind of gaping security hole that existed, signal support just kind of said that the database key was never intended to be secret.
And that was a big issue for me because the company that kind of markets itself as the gold standard of secure messaging, you know, admits their encryption keys,
whatever meant to be secure. It's kind of an issue and it's kind of an oxymoron that I really did not like.
Also, aside from all that, you should use simple x like I just want to inject that, you know, go Google it, look it up, start page it, whatever, you know, check it out.
But the vulnerability sat there for six years, while signal collected donations from privacy conscious users who believed their messages were in fact protected.
And this is exactly the kind of thing that blind trust ends up creating, which is why I'm always harping about don't trust verify.
It's the if you get one thing out of this channel, get that from it, you know, don't trust anyone, including me.
Don't trust me either, like, go look this stuff up and prove me wrong.
I love to be proven wrong.
Because at the end of the day, I learned something when that happened.
So I have no issue with it.
Anyways, signal did end up actually shipping the fix.
Immediately following a, we'll call it like a high profile flare up on X that were, you know, basically revived the whole issue and set it on fire with propane.
And it took kind of a billionaire to actually do so in order to get them off their asses to do something about this.
And the signals president Meredith with a taker basically tried to gaslight everyone by claiming that if an attacker has device access that no app can protect your data.
And I found a really kind of condescending and retarded.
Like, it's kind of no different than claiming that viruses are bad or that the sun is bright or that snow is white.
Like, like saying a random fact does not prove a separate point, like, you know, intentionally allowing a severe issue like this to go on for half a decade.
And, you know, you've known about it this whole time and then citing some dumb ass hypothetical access to a hypothetical computer that a hypothetical attacker hypothetically has
is just not a reasonable counter to a real problem that actually exists for millions of people on software that your company makes, right.
And all the while the VP of engineering who should have fixed this years ago was busy implementing new features to centralize data into a subscription model.
Instead of securing existing real world security issues, which I personally would rather see them do.
I would rather see you make your software secure than give us centralized backups by, you know, Mr. Social Media.
Like, and this goes beyond that too, because like we have like commercial forensics that can absolutely decrypt and parse signal databases from, you know, seized or unlocked devices
by basically extracting keys from the iOS keychain and then opening the signal SQL light store.
And that's, you know, also trying to true for other messengers, but basically that's post endpoint compromise, not a break of end to end encryption, which is completely different.
But it shows how easily signals data becomes accessible once a device is in law enforcement hands, which the other side issue is why you should use Graphene OS.
Look it up. And I should do a whole video on that too.
Basically anyone who says that they dislike it, you know, I would do an OS and an investigation on that, because it probably a Fed.
That's a side issue. Academic work has basically shown that, you know, full database media and log decryption on like devices that have been seized.
Any type of, you know, phone really except for for what I've seen a lot of the Graphene OS devices.
That's why I mentioned them earlier is possible via reverse engineering the apps actual crypto workflow.
For example, celebrate announced that they cracked signal.
They weren't actually breaking the was a very important distinction.
Instead, they were kind of just simply copying the unprotected database files that signal leaves accessible.
That's it. So it really wasn't like some amazing thing, but researchers from.