[electic]

How is it misleading if it is accurate? They bypassed it by compromising the phone. No encryption is going to save you in that situation and their targets were WhatsApp, Telegram, etc. So that part is accurate as well. It is a headline, I think what you are expecting is they put all the facts into the headline and there isn't enough space.

[Certhas]

It's misleading by omission. Until I read the article I was under the impression that they had found a flaw or something exploitable in the OWS protocol.

If the problem was with Signal or Whatsapp, as the headline suggested to me, switching to another messaging service is the natural reaction. If people understand that the problem is with the platform, and that all platforms are compromised that solution doesn't work, and using signal is still better than SMS because it still protects against other forms of surveillance.

[r3bl]

Well, why singling out the two services in the headline when this applies to basically every application ever?

Luckily, they've realized the mistake and apparently changed the headline.

[BrailleHunting]

"CIA bypassed secure apps on Android" would've been nice. Sure, there are hacks/implants for other platforms too.

[nostrademons]

They bypassed it by compromising Android phones. There is a clear action item here if you want to be secure: switch to an iPhone, which is what tptacek has been saying here all along.

[mschuster91]

Have you read the announcement? iPhones are wide open for the 3-letter-agencies, too.

[FabHK]

While the Wikileaks announcement explicitly mentions the iPhone (zero-days to "control, infest, and exfiltrate data"), the NY Times article mentions only Android in the context of bypassing Signal, WhatsApp.

[lvh]

I don't think that's a fair description of the information. Comments GP refers to include e.g. SEP -- iOS' threat model includes kernel-level 0days.