109
Secret documents show German police don't need to break the encryption of chat apps, they have been systematically adding their own device to the messenger accounts of people under investigation. (netzpolitik.org)
submitted 2 months ago by to c/technology@lemmy.world
4 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 month ago (2 children)

So again by linking accounts to a device operated by police or customs in this case. Which for SMS confirmations, I understand can be intercepted and confirmed by authorities, but the QR exploit seems farther fetched (because who in their right mind would open a messenger and scan a random QR?); and of course if you have access to a target's unlocked device, it becomes trivial.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 3 points 1 month ago (1 child)

    Who says a random QR though? Intercept mail and replace legit QR codes with the malicious ones. It's a common tactic for criminals to put them on payment gateways such as parking meters. And cops are criminals anyway.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    At least for WhatsApp and Signal, it appears the user is required to open the messenger app, navigate to the linking setting, authenticate themselves, and scan the QR code on the device that is to be linked (or one that corresponds to it, but hiding in a malicious e-mail). I can't find any flow that allows for a QR code to link directly to the authentication mechanism, and provide the authentication code to it, while bypassing user authentication.

  • permalink
  • fedilink
  • source
  • parent