Forwarded from BlackBox (Security) Archiv
Signal's TLS Proxy Failed to be Probing Resistant
Signal Post: https://signal.org/blog/help-iran-reconnect/
Their Repository: https://github.com/signalapp/Signal-TLS-Proxy
Our Original Issue: https://github.com/signalapp/Signal-TLS-Proxy/issues/3
⚠️ this can be very emotional, but truth works like that
So I've studied this with @studentmain and found it problematic about 4 hours ago.
We immediately reported this through a GitHub Issue, with PoC and advice attached, without even sleeping (it's about 4:00 am in local time)
But @moxie-signal (@moxie0) from @signalapp just closed our issue, saying this:
https://github.com/net4people/bbs/issues/60
https://community.signalusers.org/t/tls-proxy-server-unable-to-survive-active-probing-from-internet-surveillance-systems/27282
#signal #issue #proxy #thinkabout #NotNiceSignal
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag
Signal Post: https://signal.org/blog/help-iran-reconnect/
Their Repository: https://github.com/signalapp/Signal-TLS-Proxy
Our Original Issue: https://github.com/signalapp/Signal-TLS-Proxy/issues/3
⚠️ this can be very emotional, but truth works like that
So I've studied this with @studentmain and found it problematic about 4 hours ago.
We immediately reported this through a GitHub Issue, with PoC and advice attached, without even sleeping (it's about 4:00 am in local time)
But @moxie-signal (@moxie0) from @signalapp just closed our issue, saying this:
https://github.com/net4people/bbs/issues/60
https://community.signalusers.org/t/tls-proxy-server-unable-to-survive-active-probing-from-internet-surveillance-systems/27282
#signal #issue #proxy #thinkabout #NotNiceSignal
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag
Signal
Help users in Iran reconnect to Signal
Just over a week ago, we announced that Iranian censors had started blocking all Signal traffic in the country. As an interim solution to help people in Iran get connected again, we’ve added support in Signal for a simple TLS proxy that is easy to set up…
Forwarded from IT Security Alerts
image_2021-02-07_18-20-33.png
184.7 KB
Forwarded from IT Security Alerts
⚠️ "Barcode Scanner" app on Android turned evil! Removed from playstore but not from your devices. It had over 10 million installs so there is a good chance that you know someone that has it. Please let them know.
App Name: Barcode Scanner
MD5: A922F91BAF324FA07B3C40846EBBFE30
Package Name: com.qrcodescanner.barcodescanner
Severity: 🔸High
Additional information
https://yt.gl/barcodeevil
#alert #severityHigh #maliciousupdate #barcodescanner #android
➡️ Please forward to your friends and family that could be using this app. Thanks for the report that was sent in.
App Name: Barcode Scanner
MD5: A922F91BAF324FA07B3C40846EBBFE30
Package Name: com.qrcodescanner.barcodescanner
Severity: 🔸High
Additional information
https://yt.gl/barcodeevil
#alert #severityHigh #maliciousupdate #barcodescanner #android
➡️ Please forward to your friends and family that could be using this app. Thanks for the report that was sent in.
Forwarded from Pavel Durov
Telegram became the most downloaded mobile app in the world in January 2021.
For the last 7.5 years, Telegram has steadily climbed the rankings for popular apps. Since its launch in 2013, Telegram’s user base has grown over 40% each year.
What’s our secret? Consistency.
For the last 7.5 years we’ve consistently defended the privacy of our users and regularly improved the quality and feature set of our apps.
Anyone who stays true to their values and regularly applies focused effort over a long period of time is bound to succeed in their area. This is true for any human occupation – sport, blogging, art, coding, business or studying.
For the last 7.5 years, Telegram has steadily climbed the rankings for popular apps. Since its launch in 2013, Telegram’s user base has grown over 40% each year.
What’s our secret? Consistency.
For the last 7.5 years we’ve consistently defended the privacy of our users and regularly improved the quality and feature set of our apps.
Anyone who stays true to their values and regularly applies focused effort over a long period of time is bound to succeed in their area. This is true for any human occupation – sport, blogging, art, coding, business or studying.
Forwarded from Pavel Durov
Why users shouldn’t worry about ads on Telegram
I read an article that cautioned users from switching to Telegram from other apps, because "Telegram is going to introduce ads". This is misleading for at least 3 reasons:
1. There will be no ads in chats on Telegram. Users who rely on Telegram as a messaging app, not a social network, will never see ads. Private chats and group chats are and will always be ad-free. As I outlined in December, ads are being considered only in large one-to-many channels (like this one), which do not exist in any other messaging app. So users ditching older apps for Telegram won’t increase the number of ads in their lives.
2. User data will not be used to target ads. We believe that collecting private data from users to target ads the way WhatsApp-Facebook do is immoral. We like the approach of privacy-conscious services like DuckDuckGo: monetizing services without collecting information about users. So if we introduce ads in one-to-many-channels, they will be contextual – based on the topic of the channel, not targeted based on any user data.
3. We are fixing ads that are already here. In most markets, content creators on Telegram already monetize their content by selling promotional posts in their channels. This is a chaotic market with multiple third-party ad networks pushing intrusive ads that create a negative user experience. We want to fix this situation by offering a privacy-conscious alternative for channel owners.
Users will be able to opt out of ads, but I do think that privacy-conscious ads are a good way for channel owners to monetize their efforts – as an alternative to donations or subscriptions, which we are also working to offer them.
Our end goal is to establish a new class of content creators – one that is financially sustainable and free to choose the strategy that is best for their subscribers. Traditional social networks have exploited users and publishers for far too long with excessive data collection and manipulative algorithms. It’s time to change this.
I read an article that cautioned users from switching to Telegram from other apps, because "Telegram is going to introduce ads". This is misleading for at least 3 reasons:
1. There will be no ads in chats on Telegram. Users who rely on Telegram as a messaging app, not a social network, will never see ads. Private chats and group chats are and will always be ad-free. As I outlined in December, ads are being considered only in large one-to-many channels (like this one), which do not exist in any other messaging app. So users ditching older apps for Telegram won’t increase the number of ads in their lives.
2. User data will not be used to target ads. We believe that collecting private data from users to target ads the way WhatsApp-Facebook do is immoral. We like the approach of privacy-conscious services like DuckDuckGo: monetizing services without collecting information about users. So if we introduce ads in one-to-many-channels, they will be contextual – based on the topic of the channel, not targeted based on any user data.
3. We are fixing ads that are already here. In most markets, content creators on Telegram already monetize their content by selling promotional posts in their channels. This is a chaotic market with multiple third-party ad networks pushing intrusive ads that create a negative user experience. We want to fix this situation by offering a privacy-conscious alternative for channel owners.
Users will be able to opt out of ads, but I do think that privacy-conscious ads are a good way for channel owners to monetize their efforts – as an alternative to donations or subscriptions, which we are also working to offer them.
Our end goal is to establish a new class of content creators – one that is financially sustainable and free to choose the strategy that is best for their subscribers. Traditional social networks have exploited users and publishers for far too long with excessive data collection and manipulative algorithms. It’s time to change this.