all 8 comments

sorted by: hot top controversial new old
[–] 37 points 1 year ago (7 children)

Ok, so it's an encrypted, open source whistle-blowing feature in their app / system.

The article is light on technical details but if it makes whistleblowing easier and safer than for example emailing their editors that's probably a good thing.

  • source
  • hideshow 7 child comments
  • [–] 6 points 1 year ago (6 children)

    But like the ice tracker, wouldn't download and use the app expose the potential user lists to surface if local authority can ask for such information?

  • source
  • parent
  • hideshow 6 child comments
  • [–] 12 points 1 year ago (5 children)

    I think they are bundling this into their regular app, so they'd have to put every guardian read on the list😅

  • source
  • parent
  • hideshow 5 child comments
  • [–] 5 points 1 year ago (4 children)

    Yep, that's the point described in the linked paper - traffic goes via the same domains used for their app, and the messenger is embedded in their app

  • source
  • parent
  • hideshow 4 child comments
  • [–] 11 points 1 year ago (3 children)

    Not only that, but every app will constantly appear to be sending messages, so real messages are greatly obfuscated. That's honestly the real innovative part of the product IMHO.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    that's really cool. Does the message part work as regular p2p message app?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    No it's a bit complex. The transmissions are sent constantly at regular intervals and are a very specific size and are then combined later. So it's not "instant" messaging. It's closer to email.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    So encrypted, periodical interval to mask out any incoming/out going variance in traffic I wonder how they mitigate the backend part as there might be a ton of wasted traffic to hide the actual traffic. since they obviously need a lot of users to hide the whistle blower, but that also mean their backend needs to be pretty smart to handle lots of traffic and still consume energy to decrypt and then throw away the "noise" data.

  • source
  • parent
  • 8 comments in c/technology@lemmy.world view that post
    [–] 51 points 1 year ago

    Love seeing open source projects from companies that aren't specifically tech firms

  • source
  • [–] 47 points 1 year ago (1 child)

    I saw the headline and was ready to rage about why they should just use signal instead. Then I read the article and honestly this is a fucking genius use of tech

  • source
  • hideshow 1 child comment
  • [–] 24 points 1 year ago

    Similar to other apps, CoverDrop only provides limited protection on smartphones that are fully compromised by malware, e.g., Pegasus, which can record the screen content and user actions.

  • source
  • [–] 11 points 1 year ago

    The tech behind the tool conceals the fact that messaging is taking place at all. It makes the communication indistinguishable from data sent to and from the app by our millions of regular users.

    Reminds me of how the Germans in WW1 knew they couldn't trust their diplomatic codes anymore so they just sent the important messages in the normal, innocuous telegraph system and diplomatic pouches. They knew that foreign intelligence would be focused on the bogus secure messages.

  • source
  • [+] 5 points 1 year ago* (1 child)
  • [–] 6 points 1 year ago

    To sum it up even more : this looks like standard end-to-end encryption, but any app user have the same network traffic, completed with fake data if no communication is needed.

  • source
  • parent
  • Horrible name sadly

  • source
  • 2 comments in c/opensource@programming.dev view that post
    [–] 2 points 1 year ago

    what's the point if the only way to use it as a consumer is through their closed source app?

    if they're gonna market it for whistleblowers they could've at least made a dedicated app with an entirely open stack?

  • source
  • [–] 1 point 1 year ago

    It does kind of feel like they could just set up a Signal account?

  • source