@Alter_Mann Wir sollten als Gesellschaft akzeptieren, dass es nicht für jedes Problem eine technische Lösung gibt.
Nicht, weil Informatiker_innen dumm, faul und von der Industrie gekauft sind, sondern weil es nicht geht. #Altersverifikation ist ein Beispiel davon, #LawfulInterception Backdoors und elektronisches Wählen sind ebenfalls auf der Liste. Vielleicht wär's gut, wenn das ginge. Geht aber nicht.

https://www.theregister.com/2026/03/08/fbi_investigates_wiretap_system_breach/

"And while the FBI declined to provide any additional information, it's worth noting that China's Salt Typhoon previously compromised wiretapping systems used by law enforcement.

Salt Typhoon is the PRC-backed crew that famously hacked major US telecommunications firms and stole information belonging to nearly every American."

Still a very bad idea.

#wiretapping #security #privacy #fbi #lawfulinterception

FBI is investigating breach that may have hit its wiretapping tools

Infosec In Brief: PLUS: Europol takes down two crime gangs; LastPass users phished (again); Crooks increase crypto hauls; And more

The Register

@vfrmedia @gettie In fact, many places will literally note that down in their #LawfulInterception system (i.e. in Germany).

  • I.e. not only are providers banned from listing designated crisis helplines`(that are 0800 numbers) but if police try to query call records from someone with *"confidentiality privilegues" like lawyer, psychologist, doctor, psychatrist, notary, rehab clinic, addiction help center, etc. they get a BIG ASS RED WARNING BOX when they check for that number that said line is subject to said privilegues and that they cannot monitor it without warrant and have to file that with the request.
    • So even if they ever looked up why half a dozen devices are there, they'd quickly came to the conclusion that you are a known bona fide user and the other devices are too.

Tho for most stochastic surveillance the number of SIMs and devices isn't that high that you'd cause suspicion, given a lot of #IoT garbage has at least a #4G or #5G - modem in it to send telemetry and that 7 devices can also be assumed 1 fro the #eCall of the car and 3 people with 1 #DualSIM phone or a regular phone + laptop with WWAN modem each.

@vfrmedia @gettie Point is that #Telco regulations stems from #Telegraphy and #Postal operations, and whilst there are legitimate reasons for #regulators to disconnect phone lines (otherwise #robocalling and #SMS-#Spam would be even more rampant than #eMail-#Spamming!)

  • Which OFC also intertwines with "#LawfulInterception" and the means of Governments to exercise control.
    • So anything claiming #security must inherently acknowledge the unfixable #insecurity of the #PSTN and completely cease using it and it's per-design compromised Infrastructure as a matter of principle.

That's why any "#secure communications" treats it as a hostile network and not to be trusted!

  • And that's not even scratching the surface that countries try to outlaw #anonymity - starting with #Prepaid - #SIM - Cards.
    • Because those traditionally had no reason for "#KYC" as there was no means for a customer to incur #debt or commit #fraud against the telco that provided said services, so there was [and IMHO still is] no "legitimate interest" in demanding any #ID for those, as any crime committed would be investigated with the existing #Govware inside the networks and thus found out.

@Soeren_loeg the fact that @signalapp not only does "#KYC with extra steps" by mandating a #PhoneNumber to this day as well as being solely under #CloudAct whilst basically being a #centralized, #proprietary, #SingleVendor & #SingleProvider solution makes them the ideal candidate for a longterm #HoneyPot like #ANØM aka. #OperationIronside aka. #OperationTrøjanShield.

Not to mention #Signal ticks way too many "#sus" boxes…

Kevin Karhan :verified: (@[email protected])

My [reservations](https://infosec.space/@kkarhan/114234551915193036) and [criticism](https://infosec.space/@kkarhan/114862595629371002) re: #Signal are not just valid, but the reality is *even worse than I thought*: - The fact that @[email protected] requires not only their shitty #Android #App, and a #PhoneNumber but literally won't allow people to use their shitty #Desktop-App unless they have an Android device with a camera pointed at it makes it utterly unuseable for certain users *who don't have a fucking #camera in their Android*… Seriously, do they expect folks to deal with that shit? - It's already worse in terms of #UX than #telegram and #discord and that too makes #XMPP+#OMEMO clients like @[email protected] / #monoclesChat & @[email protected] / #gajim easier and faster to onboard #TechIlliterates onto. - Whichever asshole decided that a *replacement for #SMS* should mandate #PII like a #PhoneNumber & not be natively cross-platform should be banned from doing any #tech in their life. Trying to circumvent this shit and helping folks with it makes me so fucking angry that I'm now explicitly refusing to support it! FIX THAT SHIT, @[email protected], and if it means you need to kick some devs in their crouch then consider this a necessary *"investment"*… #sarcasm #TechSupport #TalesFromTechSupport #Enshittification #SignalSucks #TelegramSucks #Messengers

Infosec.Space

Ireland plans legislation to formally permit law enforcement use of spyware, with court authorization and stated safeguards.

The move reflects a wider trend of governments updating interception laws to match modern technology, while attempting to preserve oversight and proportionality.

How should security professionals evaluate such frameworks from a risk and governance perspective?

Source: https://therecord.media/ireland-plans-law-enforcement-spyware

Share your view and follow @technadu for neutral cybersecurity and policy insights.

#InfoSec #CyberPolicy #Surveillance #PrivacyEngineering #DigitalGovernance #LawfulInterception

@lucasmz @fdroidorg @torproject

Let's just say @signalapp / #Signal is so good, it scratches that part of my mind that doesn't allow good to exist without precondition...

But maybe that's just me flexing life experience and the fact that my paranoia always turned out to be justified.

Given they offer their Services to people in #Russia, #Cuba and #Iran, thus being in clonflict with #ITAR, I'm pretty much convinced they had to have a deal with the U.S. Government to get that done.

So yeah, there will be some #LawfulInterception doodat and even if it's not within Signal's infrastructure, I'd call the #NSA "criminally stupid" if they didn't intercept all the "Verification #SMS" and all the data from and to Signal's Systems routinely to #BULLRUN against it...

Elliot Hacks A Pedophile | Mr. Robot

YouTube
@osxreverser or #Cisco for integrating "#LawfulInterception" #Backdoors or every vendor implementing #DUAL_EC_DRBG or equipping the #NSA?

@adisonverlice even if an #MVNO isn't demanding any #KYC whatsoever (i.e. #prepaid are offered OTC in most juristictions) it's NOT "#Anonymous" but merely #pseudonymous as it's trivial for governments to utilize existing and mandtory "#LawfulInterception" appliances to create that #PII chain.

#PhoneNumber <=> #ICCID (#SIMcard) <=> #IMSI (SIM profile) <=> #IMEI (Phone/...).

So if #Anonymity is important, NONE of these details have to be linked somehow even circumstantial.

  • Bought/paid for the phone/SIM/ a single top-up with ec/CC/PayPal/SEPA/… = busted due to circumstantial connection.

  • Use the SIM in any device? Consider them circumstantially connected forever: #ICCID <=> #IMEI.

  • Same applies to #eSIM|s: #EID <=> #ICCID <=> #IMEI.

Add to the fact that most places have #CCTV, and assume that they'll keep recordings for the maximum permissible duration if not longer and oftentimes even use questionable cloud services and you get the picture.

  • I.e. in Germany the maximum permissible storage duration is 72 hours (if nothing hapoens that warrants a longer storage i.e. burglary/theft/robbery/arson/...) so anonymous top-ups would necessitate paying cash at a place one's not been known at (i.e. some kiosk) and waiting at least >72 hours (and checking on the purchase location) before redeeming the top-up code (i.e. dialing *104*1234567890123456# )...

So any #privacy-based service should never ever & under no circumstances demand a Phone Number!

  • Instead any privacy-focussed service should use #OnionServices, host their own #OnionService or at least #DontBlockTor and allow users to use it via @torproject / #Tor to use and signup. (But don't forget circumstantial connections there either!)

  • Also the less details they want or store and the least traffic they generate the harder it is to correlate traffic & users.

@thygrrr @PallasRiot every provider WILL SNITCH if provided with a duely issued warrant.

  • Not even @mullvadnet will refuse to comply, because investigators will only ask nice once, then they won't and instead kick in doors, start pointing guns with funswitches at staff and rip out hardware for evidence collection!

Granted #mullvad at least goes out of their way to minimize having any data they could hand over in the first place, but still: They too have #LawfulInterception boxes in place to isolate clients' and log their traffic.

  • I've yet to hear of a juristiction with actual internet connectivity that doesn't mandate that #Govware in the form of appliances.

And yes, I worked for an ISP in the past and had to deal with said #logging and #monitoring infrastructure as in keeping it up and running...