I've been wondering the same thing. But would it be so hard to detect? Presumably the information would have to be sent to some server sometime. While I personally don't really monitor outgoing traffic, I think some people do. So they should have noticed something by now?
I feel like you could do this just watching network traffic, and judging by the fact that nobody's done it, I also feel like there's some mechanism preventing this that I'm not knowledgeable enough in the subject to be aware of.
Oh, I'm sure they can easily collect the traffic. I think any secure service needs to be made with that in mind now. But the question is if they can get the data unencrypted.
They could certainly do this, but they would only see which local IP is trying to communicate with Signal (and thus trace the user). The traffic itself is end to end encrypted so they cant read it.
They are allowed to look into the traffic only as much as they need to in order to maintain quality service. They notice stuff like botnets and piracy because both of these activities have the potential to generate abnormal amounts of traffic. Another reason they are likely to notice these things is because a third party will often notify them about the activity. They would have to monitor your connection/activity in a way that's highly unethical and possibly illegal in order to detect anything that isn't overly noisy.
A passive observer that is as big as NSA/GCHQ etc. can correlate traffic to de-anonomise some traffic, some very small amount of the time. It is extremely unlikely that a single ISP would ever have enough information to do that though.
They don't need to. They can infer based on the size and timing of the transfers. Nothing for a while then suddenly a huge download? Probably a picture. If the sizes are unique enough they might even figure out which.
Eh, it might be a bit useful if there's a passive adversary on the server. They can read traffic, but not change anything. Pretty unlikely scenario, so it doesn't really buy you much.
There were several papers over the past few years about using traffic analysis to figure out what's going on behind a NAT. I'm sure that the US government could manage to do this with all of the ISP-level snooping gear.
All the traffic would be tunneled, so unless they're using heuristics or ML to determine "phoney" and "desktop/laptopy" timing in the packets, they can't really tell what's going on.
reply