The Guardian and the University of Cambridge Computer Science Department unveil new technology to protect journalists

Comments

• perestroika@lemm.ee ⁨8⁩ ⁨months⁩ ago

  Technical summary: it seems OK against an observer who can see the network traffic but hasn’t infiltrated the phone of the source or the computer of the news organization.

  Any real message is stored locally on the smartphone by the CoverDrop module and sent as the next CoverDrop message, i.e. replacing the dummy message which would otherwise have been sent. Consequently a network observer cannot determine whether any communication is taking place and CoverDrop therefore provides the potential source with plausible deniability.

  The CoverNode and each journalist has their own public-private key pair. These keys are published by the news organization and available to the CoverDrop module directly so the user does not need know about them. When the CoverDrop module is used for the first time, it generates a new, random public-private key pair for the user.

  All real CoverDrop messages sent by the CoverDrop module to the CoverNode include the text written by the potential source as well as their own public key. The message is first encrypted using the public key of the journalist who will ultimately receive the message, then encrypted a second time using the public key of the CoverNode. All dummy CoverDrop messages are encrypted using the public key of the CoverNode. All messages, real or dummy, are arranged to be the same, fixed length. Encryption and length constraints ensure that only the CoverNode can distinguish between real and dummy messages.

  source

  • Bogasse@lemmy.ml ⁨8⁩ ⁨months⁩ ago

    To sum it up even more : this looks like standard end-to-end encryption, but any app user have the same network traffic, completed with fake data if no communication is needed.

    source
• Don_alForno@feddit.org ⁨8⁩ ⁨months⁩ ago

  If you want to blow the whistle on somebody and wonder if the Guardian is trustworthy I suggest you ask Julian Asssange.

  source
• SocialMediaRefugee@lemmy.world ⁨9⁩ ⁨months⁩ ago

  The tech behind the tool conceals the fact that messaging is taking place at all. It makes the communication indistinguishable from data sent to and from the app by our millions of regular users.

  Reminds me of how the Germans in WW1 knew they couldn’t trust their diplomatic codes anymore so they just sent the important messages in the normal, innocuous telegraph system and diplomatic pouches. They knew that foreign intelligence would be focused on the bogus secure messages.

  source
• fubarx@lemmy.world ⁨9⁩ ⁨months⁩ ago

  Similar to other apps, CoverDrop only provides limited protection on smartphones that are fully compromised by malware, e.g., Pegasus, which can record the screen content and user actions.

  Image

  source
• Mynameisallen@lemmy.zip ⁨9⁩ ⁨months⁩ ago

  I saw the headline and was ready to rage about why they should just use signal instead. Then I read the article and honestly this is a fucking genius use of tech

  source

  • bathing_in_bismuth@sh.itjust.works ⁨9⁩ ⁨months⁩ ago

    Yeah this is insanely good

    source
  • Ulrich@feddit.org ⁨9⁩ ⁨months⁩ ago

    I read it and don’t understand. Why is this better than Signal?

    source

    • Mynameisallen@lemmy.zip ⁨9⁩ ⁨months⁩ ago

      For one, ease of access. Say you’re trying to break a story, who are you going to message with signal? Because you’re going to need to get that contact info somehow right?

      Snowden is permanently stranded in Russia. That’s not exactly a great example of an anonymous source.

      source

      • -> View More Comments
    • MCasq_qsaCJ_234@lemmy.zip ⁨9⁩ ⁨months⁩ ago

      Messaging protocols already resemble the frameworks that come out from time to time. And their effectiveness is due to the fact that they require a certain quota of users.

      It’s just a secure messaging app with a direct line to Guardian journalists. How to use 911 or special numbers when you’re not feeling well.

      source
    • rosco385@lemmy.wtf ⁨9⁩ ⁨months⁩ ago

      Because analysing network traffic wouldn’t allow an adversary to see what you’re sending with Signal, but they could still tell you’re sendig a secure message.

      What the Guardian is doing is hiding that secure chat traffic inside the Guardian app, so packet sniffing would only show you’re accessing news.

      source

      • -> View More Comments
• unexposedhazard@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago

  Horrible name sadly

  source
• hera@feddit.uk ⁨9⁩ ⁨months⁩ ago

  Love seeing open source projects from companies that aren’t specifically tech firms

  source