[laurowyn]

So then you just sideload the messaging app instead of using the official build that complies with the legal system. Just like many crime groups do already - look at the EncroChat phones that gangs were using.

This just isn't enforceable. Yet more laws made by people that don't understand the technology.

[rfd4sgmk8u]

EncroChat was literally taken over by law enforcement, backdoored and the entire network was compromised. Not a good example :-)

[laurowyn]

So we just gonna ignore the years it was used and unbroken? Now EncroChat is gone, I'm sure there's a few new ones out there in its place.

[VWWHFSfQ]

yeah that whole app and network was an FBI plant from the beginning...

[willvarfar]

The app created by the FBI was more recent and was called ANOM.

See “similar cases” section of https://en.m.wikipedia.org/wiki/EncroChat for links to anom and other infiltrated apps.

[laurowyn]

Conspiracy theories aren't helpful.

[VWWHFSfQ]

is it a conspiracy theory?

[laurowyn]

With no proof, yes it's a conspiracy theory. As others have stated, there is another app linked in the wiki article about EncroChat which was developed by the FBI, with evidence to back that up.

[VWWHFSfQ]

Ah OK yeah I had the app name mixed up. I was thinking of the ANOM app that was developed by the FBI.

[csmpltn]

> "So then you just sideload the messaging app instead of using the official build that complies with the legal system"

That's not how computers work.

The scanning would take place at the lowest possible layer (ie. keyboard input, or kernel-mode input driver, etc), such that the user-mode software itself wouldn't be able to bypass the scan. It could also happen at the hardware layer.

You'll need to bring your own hardware/software to ensure you're not being monitored.

[raspyberr]

Like I replied above. Having your own hardware is pointless if the people you're talking to are having their devices scanned.

[laurowyn]

But... That's exactly how computers work.

If you had a look at EncroChat at all, you'd see that they were running a custom Android OS with a bunch of their own apps on it.

Yes, we can take it to hardware level, however, that's not what was being discussed. The idea of mandating app developers to use the scanning tech can be trivially circumvented. i.e. Law makers not understanding the technology.

Mandating a hardware implant to achieve the same goals is a better understanding of the technology involved, but that ends badly for everyone. At least with software, a vulnerability can be fixed. In hardware, you're stuck with buying a new device or living with the vulnerability. Not to mention it's an open statement that the law makers want to spy on you.

[rjzzleep]

How is that going to help you? Googles recent android version are also making sure you can't change the default camera app for in app photos. So you'd have to run a bunch of third party apps in conjunction.

It's possible, just really inconvenient. Except for the "few" people running their custom rom android phones.

[TheGirondin]

So anyone who is acting nefariously can circumvent with bit of work, and the rest of us are subject to another vector of mass surveillance.

[laurowyn]

So roll back to a previous version and start there. Android is open source. No reason a community couldn't fork it, maintain it and do what they want with it.

Jailbreaking is also a thing. Modifying the OS enough to break through vendor imposed restrictions. Why is that implausible for this example?

I'm not saying it's easy. There are certainly limitations due to the secure boot process of Android devices. But what if there was a way to change the root keys? Then it's an open game. Black market for devices with modified keys, unique per device, sign the image loaded on them to ensure the same level of security, and then load whatever you want.

This idea that our corporate overlords define what we are able to do is the only thing stopping us from proving otherwise. If someone says something is impossible, you ask for proof, question them, check their work. You don't accept and move on. This is a foundation of security research - any business claiming their product is "hack proof" is just asking to be hacked. Same goes here - if the vendor says you're not allowed to do something, you find a way around it.

[raspyberr]

Doesn't have to be enforceable. If the people whom you're talking to have their messages scanned, then your messages get seen also.