[marosgrego]

Threema messages of Marian Kočner, a contorversial Slovak businessman who allegedly ordered a murder of a local journalist, were somehow obtained with the help of Europol. [0] The part of his trial where a security expert explained how the police got the messages was purposely not made public.

[0] https://spectator.sme.sk/c/22216551/threema-saga-kocner-repo...

[guerrilla]

Is there some reason that's interesting? What they do here is just hack the phones, so get access to all the texting apps from the client side... Was there some implication they did otherwise in that case?

[godelski]

There is always some trust with private communication apps. No way one can get a completely trustless system. Signal tries to build trust by being open source and by publishing the same documents it sends in subpoenas[0] (i.e. transparency in how they respond to government requests). The lack of understanding how the information was obtained is worthy of increased suspicion albeit not abandonment. There is added suspicion in that I cannot find an official response by the Threema team. We do not know if the encryption was broken or if there was access (physical or remote) to the phone. Do note that Threema is open sourced[1]. But there can still be concern if access to the phone was gained through other means and then access to the app was gained. There's a brush off of "if physical access is gained, not our problem" but that's not nearly enough (it still shouldn't be trivial). Assuming user error first is not a good methodology in response to these types of attacks (which there is some brushing off in this manner in Threema's response to this thread's link). People are still probing a black box at the end of the day.

[0] https://signal.org/bigbrother/

[1] https://threema.ch/en/open-source

[tptacek]

The Threema server isn't open source, is it?

[dustyharddrive]

You can’t verify the binaries it’s actually running and the protocol shouldn’t rely on a trustworthy server anyway.

IMO the biggest problem with any of these E2EE apps is using them with iOS users. Apple makes it impossible to extract and inspect the packages without jailbreaking, so most projects don’t bother with reproducible iOS builds.

[tptacek]

As the paper demonstrates, you did in fact need to trust the Threema server in some respects.

[dustyharddrive]

Yeah :(

but that’s why I said “shouldn’t” instead of “doesn’t”.

[godelski]

I don't think it is, which is disappointing. But even with Signal's open sourced server I think we still need to trust that they are running said server. Unless you know a way to verify it.

[tptacek]

That was true of Threema, too!