British man acquitted over London-Spain flight bomb hoax | …SnapChat leaking messages to security services & supporting KOSA? Not a good combo for user privacy | HT @rebeccamkern

SnapChat must* be surveilling their non-encrypted chats (i.e. all of them, but they travel over HTTPS for privacy) & triggering on sensitive words, either on-server or on-client, reporting to law enforcement who then over-react … PLUS they announced support for the illiberal & misconceived KidsOnlineSafetyAct.

The two, combined, are not a great indicator for how they view user privacy.

A Spanish court has cleared a British man of public disorder, after he joked to friends about blowing up a flight from London Gatwick to Menorca […] A key question in the case was how the message got out, considering Snapchat is an encrypted app. One theory, raised in the trial, was that it could have been intercepted via Gatwick’s Wi-Fi network. But a spokesperson for the airport told BBC News that its network “does not have that capability”. In the judge’s resolution, cited by the Europa Press news agency, it was said that the message, “for unknown reasons, was captured by the security mechanisms of England when the plane was flying over French airspace”. The message was made “in a strictly private environment between the accused and his friends with whom he flew, through a private group to which only they have access, so the accused could not even remotely assume… that the joke he played on his friends could be intercepted or detected by the British services, nor by third parties other than his friends who received the message,” the judgement added. It was not immediately clear how UK authorities were alerted to the message, with the judge noting “they were not the subject of evidence in this trial”.

https://www.bbc.co.uk/news/world-europe-68099669

[*] if the cause is not Snap themselves then their transport security is broken and that’s an even bigger story, being either being a weakness in the app or an undocumented man-in-the-middle HTTPS backdoor implemented by authorities in airport wireless transportation


Previously

Comments

6 responses to “British man acquitted over London-Spain flight bomb hoax | …SnapChat leaking messages to security services & supporting KOSA? Not a good combo for user privacy | HT @rebeccamkern”

  1. @alecm To be fair to them, they are quite open about it:

    “We also work to proactively escalate to law enforcement any content appearing to involve imminent threats to life, such as school shooting threats, bomb threats…”

    https://values.snap.com/en-GB/news/second-leo-summit

  2. The story is that it is a group of his mates and therefore that seems deeply unlikely

  3. @alecm pretty stupid of the authorities to bring the case, probably obvious that the message was not a threat. Now everybody knows that SnapChat is being watched. Should have kept quiet and waited, possibly catch a real threat.

  4. @alecm End to end encryption pretty much* requires 1:1 (for bi-directional). Group chats can either encrypt and send multiple copies out from a device to each of the recipients, encrypting with their keys or do the destination encryption at the server level. @signalapp takes the bandwidth expensive route of sending individual messages to everyone in the chat. I have a guess as to what Snapchat chooses to do since it doesn’t appear they’ve posted any crypto whitepapers or posts detailing what is used. In 2014, it was discovered they had a single key for every communication everywhere, which is the opposite of secure.

    *There are non-point-to-point solutions, such as having a single key for the group, which is less secure. Whatsapp has an interesting implementation, so there’s progress there.

    1. Indeed. And in fact, they use an end to end algorithm for the images and leave the chat in plain text

  5. mark

    and now microsoft have endorsed KOSA, great (sarcasm) what a great way to prevent yourself being affected https://twitter.com/AriCohn/status/1752438643971514384

Leave a Reply

Your email address will not be published. Required fields are marked *