Technical summary: it seems OK against an observer who can see the network traffic but hasn’t infiltrated the phone of the source or the computer of the news organization.
Any real message is stored locally on the smartphone by the CoverDrop module and sent as the next CoverDrop message, i.e. replacing the dummy message which would otherwise have been sent. Consequently a network observer cannot determine whether any communication is taking place and CoverDrop therefore provides the potential source with plausible deniability.
The CoverNode and each journalist has their own public-private key pair. These keys are published by the news organization and available to the CoverDrop module directly so the user does not need know about them. When the CoverDrop module is used for the first time, it generates a new, random public-private key pair for the user.
All real CoverDrop messages sent by the CoverDrop module to the CoverNode include the text written by the potential source as well as their own public key. The message is first encrypted using the public key of the journalist who will ultimately receive the message, then encrypted a second time using the public key of the CoverNode. All dummy CoverDrop messages are encrypted using the public key of the CoverNode. All messages, real or dummy, are arranged to be the same, fixed length. Encryption and length constraints ensure that only the CoverNode can distinguish between real and dummy messages.
To sum it up even more : this looks like standard end-to-end encryption, but any app user have the same network traffic, completed with fake data if no communication is needed.
If you want to blow the whistle on somebody and wonder if the Guardian is trustworthy I suggest you ask Julian Assange.
The tech behind the tool conceals the fact that messaging is taking place at all. It makes the communication indistinguishable from data sent to and from the app by our millions of regular users.
Reminds me of how the Germans in WW1 knew they couldn’t trust their diplomatic codes anymore so they just sent the important messages in the normal, innocuous telegraph system and diplomatic pouches. They knew that foreign intelligence would be focused on the bogus secure messages.
Similar to other apps, CoverDrop only provides limited protection on smartphones that are fully compromised by malware, e.g., Pegasus, which can record the screen content and user actions.
I saw the headline and was ready to rage about why they should just use signal instead. Then I read the article and honestly this is a fucking genius use of tech
Yeah this is insanely good
I read it and don’t understand. Why is this better than Signal? Or the 500 other secure file/messaging protocols?
Jabber seemed to work perfectly for Snowden…
For one, ease of access. Say you’re trying to break a story, who are you going to message with signal? Because you’re going to need to get that contact info somehow right?
Snowden is permanently stranded in Russia. That’s not exactly a great example of an anonymous source.
Say you’re trying to break a story, who are you going to message with signal?
…The Guardian?
Because you’re going to need to get that contact info somehow right?
Use your browser? These are strange questions.
Snowden is permanently stranded in Russia. That’s not exactly a great example of an anonymous source.
Did you notice that I used the past tense?
Because analysing network traffic wouldn’t allow an adversary to see what you’re sending with Signal, but they could still tell you’re sendig a secure message.
What the Guardian is doing is hiding that secure chat traffic inside the Guardian app, so packet sniffing would only show you’re accessing news.
I downloaded the guardian app and couldn’t find the option.
analysing network traffic wouldn’t allow an adversary to see what you’re sending with Signal
How are they analyzing network traffic with Signal? It’s encrypted. And why does it matter if they know you’re sending a message? Literally everyone using Signal is sending a message.
How are they analyzing network traffic with Signal? It’s encrypted
Not my specialty, but signals end to end encryption is akin to sealing a letter. Nobody but the sender and the recipient can open that letter.
But you still gotta send it through the mail. That’s the network traffic analysis that can be used.
Here’s an example of why that could be bad.
Using an encrypted messaging app could itself be a red flag, using a news app is normal behavior.
It isn’t.
It’s a red flag to those who think you’re going to share internal info.
Or it’s just a perfectly normal thing that billions of people do every day?
https://www.laquadrature.net/en/2023/06/05/criminalization-of-encryption-the-8-december-case/
For France, Your a terroriste if you use signal
Then you’re a terrorist if you use the internet, period
Nearly all internet traffic if encrypted, and for plain browser traffic it’s probably in the 95+%
You access your bank? Terrorist! Email? Terrorist! Lemmy? Terrorist!
Then you’re also a terrorist if you use The Guardian 🤷♂️
Timing of messages. They can’t tell what you send, but can tell when
No they can’t.
E: if someone wants to provide evidence to the contrary instead of just downvoting and moving on, please, go ahead.
Here’s a relevant stack exchange question. Regarding what an ISP can learn. Of note, everybody is ceding that the ISP can tell you’re using signal, and they’ve moved on to whether or not they’d be able to fingerprint your usage patterns.
It’s called traffic analysis
It’s called encryption
Messaging protocols already resemble the frameworks that come out from time to time. And their effectiveness is due to the fact that they require a certain quota of users.
It’s just a secure messaging app with a direct line to Guardian journalists. How to use 911 or special numbers when you’re not feeling well.
Love seeing open source projects from companies that aren’t specifically tech firms
Horrible name sadly
