Discussion about this post

User's avatar
streamfortyseven's avatar

As for the Europeans, they're not entirely lame - Ukraine has forced the Russian Army into a stalemate for over the past three years - and taking back half the territory seized by Russia in their initial invasion, using junk US materiel and munitions, most of it otherwise headed to the junkyard after demilling. And the Ukrainians, using drone warfare, have redefined long range force projection - as witness this: https://mickryan.substack.com/p/ukraine-strikes-back-hard

As for Mike Waltz and our overfunded and incompetent "national security state", he got spoofed by Goldberg, and it was probably pretty simple:

I spoke with a friend who is familiar with Signal, and it turns out that you can change your screen name to anything you want - your phone number stays the same. So Waltz or his staffer accepts Goldberg into the group, thinking that it's someone who is legit - and he or his staffer doesn't check the phone number... So Goldberg spoofed Waltz - if this is the case - and after Goldberg is done with the chat, he can just change his name back to his real name - and he has plausible deniability. Waltz said at one point that one of the people in the group chat didn't receive any of the messages in the chat - and this would confirm the spoofing. And that means that Signal as it stands now is *very* insecure - for anyone who needs to maintain confidentiality - there needs to be some sort of code put in to stop this kind of spoofing.

Just thinking about it a bit more, and an easy means of prevention comes to mind: Create a whitelist of screen names and phone numbers - a dictionary in Python or the equivalent in Rust would do the trick - the screen names would be the keys and the phone numbers would be the values. So you input a screen name and phone number, you pull up the corresponding screen name and number from the dictionary, and compare the numbers. If the numbers match, then it's a go, if not, the number is excluded from the group chat, and then you could do a "whitepages" search on the number and find out who it really belongs to - and take appropriate action. Of course, there's the problem of "call forwarding" or the number could be hijacked in some other way - and you might be able to add code to deal with this, but otherwise, this should fix the spoofing problem. Signal is open source, so a fork could be done, and it's just using Xcode to create the iOS and desktop apps.

The fact that no one in the "national security" establishment thought about this - I figured it out in about 15 minutes after my call with my friend - means that Elon Musk ought to go after these guys with a real vengeance...

Expand full comment

No posts