Live data from Hacker News

Show HN: ZuccNet – Encrypted Facebook Messaging

github.com

11–20 of 43 posts

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#11
post #9
post #5

Facebook Messenger already has Secret Conversations, which is end-to-end encrypted mode based on the Signal protocol. Here's the technical whitepaper: https://about.fb.com/wp-content/uploads/2016/07/messenger-se... Here's some of the academic work on messaging franking that it has driven: https://eprint.iacr.org/2017/664.pdf Here's the instructions how to use it: https://www.facebook.com/help/messenger-app/1084673321…

If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.

> Whatever they say, they have the keys to decrypt it.

This is a baseless assertion.

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#13
This isn't safe to use:

https://github.com/tomquirk/zuccnet/blob/42e351e36b3b5dbaef0...

1. Try encrypting a message larger than 256 characters. Even if you somehow succeed, it will fail to decrypt. (My understanding of JS crypto is that it will throw an error if you try.)

2. It lacks forward secrecy.

A much better design would be to encrypt with an ephemeral (one-time) 256-bit AES key (using CBC+HMAC), then encrypt the key with RSA. (AES-GCM is probably easier, but if you're worried about message commitment, that's not recommended.)

(On sweis's comment about Secret Conversations: I don't trust closed source implementations--and neither do a lot of us on HN, so that's a non-starter. Tell the Facebook team to open source it, with reproducible builds, if you want it to be trusted.)

Recommended reading for the author: https://soatok.blog/2020/11/14/going-bark-a-furrys-guide-to-...

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#14
post #11
post #9

Earlier quoted context omitted.

If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.

> Whatever they say, they have the keys to decrypt it. This is a baseless assertion.

Trust is earned.

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#15
post #11
post #9

Earlier quoted context omitted.

If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.

> Whatever they say, they have the keys to decrypt it. This is a baseless assertion.

but it is a safe assumption

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#16
post #10
post #9

Earlier quoted context omitted.

If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.

Your assertion is false. Please read the whitepaper. Facebook does not have the key to decrypt messages sent with Secret Conversations. It is generated on-device. You can confirm that using simple reverse engineering tools on, say, the Android APK. Yes, Facebook could subvert the binary by pushing an update. That is the risk you are accepting.

This is whitepaper, it is not implementation of closed source application.

Let me explain how this works in PR world. You publish (with all the bells and whistles) that you have end to end encryption and explain protocol that uses asymmetric cryptography (just for the sake of simplicity I will simplify - you have public and private key, you send public key to all chatters with you, they will encrypt randomly generated symmetric key with it (asymmetric crypto is slow, you don't want to use it directly) and send it back (where you decrypt it) and vice versa. Then you use symmetric key that you have safely exchanged for use in block cypher, lets say Rijndael 265635238 bits (as big numbers mean more safety(tm) /s).

You publish white papers of protocol, get all the cryptographers on your side. Fanboys are screaming, public is applauding, girls wants to sleep with you and president is thankful. What you don't tell is that you also encrypt symmetric key with YOUR public key that is embedded into application and send it along as a "status_check" field.

And everyone is happy forever after. /s

> Your speculation is not interesting to me.

This works in both directions. But bottom line, whitepaper is not the application (and even if it would be, have fun reading http://www.underhanded-c.org/ or https://en.wikipedia.org/wiki/Dual_EC_DRBG and who has more motive as the corporation that profits from spying on everyone and everything). It is just as the name says. Whitepaper.

"Timeo Danaos et dona ferentes"

or maybe you will like this one more:

"Trust is built in drops and lost in buckets"

And you dont trust someone as Facebook or Google any more. They have lost trust in ship containers not buckets.

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#17
post #11

Earlier quoted context omitted.

> Whatever they say, they have the keys to decrypt it. This is a baseless assertion.

but it is a safe assumption

It's a falsifiable assumption. Audit the binaries if you want to convince yourself. You will see code to generate and use keys locally, with no mechanism to fetch or share keys from a server.

If you want to go beyond generic concerns, there are plenty of academic papers that have looked at Facebook Secret Conversations, found actual issues, and helped get them fixed: https://link.springer.com/article/10.1007/s00145-020-09360-1 https://link.springer.com/chapter/10.1007/978-3-319-63697-9_... https://link.springer.com/chapter/10.1007/978-3-319-96884-1_...

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#18
post #16
post #10

Earlier quoted context omitted.

Your assertion is false. Please read the whitepaper. Facebook does not have the key to decrypt messages sent with Secret Conversations. It is generated on-device. You can confirm that using simple reverse engineering tools on, say, the Android APK. Yes, Facebook could subvert the binary by pushing an update. That is the risk you are accepting.

This is whitepaper, it is not implementation of closed source application. Let me explain how this works in PR world. You publish (with all the bells and whistles) that you have end to end encryption and explain protocol that uses asymmetric cryptography (just for the sake of simplicity I will simplify - you have public and private key, you send public key to all chatters with you, they will encrypt randomly generate…

Your speculation is not interesting to me.

What is interesting to me are actual bugs and vulnerabilities that credible people have found and gotten fixed: https://link.springer.com/chapter/10.1007/978-3-319-63697-9_...

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#19
post #11
post #9

Earlier quoted context omitted.

If you are trusting facebook in any matter, you are misunderstanding something. Whatever they say, they have the keys to decrypt it. It is like trusting the thief to guard your house. I dislike this "ZuccNet" as the real goal should be abandoning facebook ecosystem but I still think that anything for naive people is better than nothing, so thumbs up.

> Whatever they say, they have the keys to decrypt it. This is a baseless assertion.

In Australia its illegal to encrypt user data with out the ability to decrypt it.

Do they offer this service in Australia? Yes. Then they have the keys.

Re: Show HN: ZuccNet – Encrypted Facebook Messaging

#20
post #11

Earlier quoted context omitted.

> Whatever they say, they have the keys to decrypt it. This is a baseless assertion.

In Australia its illegal to encrypt user data with out the ability to decrypt it. Do they offer this service in Australia? Yes. Then they have the keys.

Facebook isn't doing the encrypting. You are. You have the key on the phone.
Post reply on HN