Don’t look up

[dada_dave]

Vinoth (Mobile security) (@vinoth@infosec.exchange)

This is insane! A few researchers from UCSD and UMCP scanned bunch of satellite links, found much of the traffic is not encrypted, and went on to decode them. It's amazing what came out. - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T...

infosec.exchange

Why worry about quantum cryptography when everyone is sending all this shit unencrypted anyway? (Yes for the all stuff we aren’t but Jesus)

 

[casperes1996]

Vinoth (Mobile security) (@vinoth@infosec.exchange)

This is insane! A few researchers from UCSD and UMCP scanned bunch of satellite links, found much of the traffic is not encrypted, and went on to decode them. It's amazing what came out. - T-Mobile backhaul: Users' SMS, voice call contents and internet traffic content in plain text. - AT&T...

infosec.exchange

Why worry about quantum cryptography when everyone is sending all this shit unencrypted anyway? (Yes for the all stuff we aren’t but Jesus)

I never trusted sms, phone calls or emails. There’s millions of ways to intercept and alter it. And you should always assume http to be untrusted. Never expected my dns over mobile to be secure. Anything where there’s not an explicit point to point encryption stage has never been trustworthy. Frankly also goes for your home net. I almost feel it’s fine this traffic is plainly encoded. It’s outside of the threat model. It would be nice to be more secure but should never be relied upon anyway.

iMessage, signal, FaceTime, https is encrypted regardless. People monitoring the traffic can see you connect to the servers but not the packet contents

 

[dada_dave]

I never trusted sms, phone calls or emails. There’s millions of ways to intercept and alter it. And you should always assume http to be untrusted. Never expected my dns over mobile to be secure. Anything where there’s not an explicit point to point encryption stage has never been trustworthy. Frankly also goes for your home net. I almost feel it’s fine this traffic is plainly encoded. It’s outside of the threat model. It would be nice to be more secure but should never be relied upon anyway.

iMessage, signal, FaceTime, https is encrypted regardless. People monitoring the traffic can see you connect to the servers but not the packet contents

Their survey found sensitive government and corporate data though. Yeah the personal stuff is not great, but they found data that really, really should be encrypted and isn’t being so.

 

[casperes1996]

Their survey found sensitive government and corporate data though. Yeah the personal stuff is not great, but they found data that really, really should be encrypted and isn’t being so.

Absolutely. But I think the blame for that lies with the people sending such data through unsecured channels. Not as much with the channel. In this case at least.

 

[Nycturne]

Agreed. It should be common knowledge that cell networks are akin to shouting into a crowd and just hoping someone can't pick apart the different conversations. SMS has been known to be insecure nearly as long as I've had a cell phone with the feature.

But this does explain why China targeted cellular infrastructure if so much sensitive data is passing through these networks via SMS or other unsecure channels.