MEGAChat now includes end-to-end encryption • Hacker News Board

Re: MEGAChat now includes end-to-end encryption

#61

Post by asddubs » Sat, Jan 23, 2016, 7:03 PM UTC

brbsix wrote: post #43

treenyc wrote: post #8

Earlier quoted context omitted.

It is great that Whisper Systems/Signal implement cryptography properly. However, the NEWER versions of Signal requires access to your contact to work. For many users that is a show stopper. Implement a way for user to search by User ID and allow user to find each other by ID in addition to phone number.

Recent updates also show disconcerting "Joe is on Signal!" messages for everyone in your contacts (who is registered with Signal) regardless of whether or not you've had any contact with them. They've stated that this is not a security issue (I don't recall the specifics) but it was pretty disturbing nonetheless. I'll definitely be paying closer attention and consider switching to an alternative if this trend continu…

Why specifically are you worried about that?

Re: MEGAChat now includes end-to-end encryption

#62

Post by e12e » Sat, Jan 23, 2016, 7:08 PM UTC

buu700 wrote: post #36

mike-cardwell wrote: post #33

Earlier quoted context omitted.

I don't know what you mean by, "permanently pinned (TOFU) bootstrap", but the fact that it "validates/executes signed application packages" doesn't sound like it protects the end user from you sending them a "signed application package" which contains something to steal their keys/messages... If you could post a link explaining how this tech works, I would be very interested in reading about it...

It doesn't protect users from that yet (neither does Signal or any other alternative), but we are about to implement reproducible builds to help mitigate that by allowing users to independently verify that the deployed production build matches up with our source code on GitHub. That having been said, my cofounder and I are the only two people with the keys to sign releases (and as long Cyph exists they'll only ever b…

Nice to hear that you say you have nothing up your sleeves. I believe you don't, but if you were an agent for a covert agency you would make the same claims, so they mean nothing.

As for opsec on keys... the only thing making key extraction remotely difficult by a state actor is probably some form of hsm - but recalling the xbox 1 crack, I don't know how well even those stand up in practice. For everything else, I assume you're just a sneak-and-peak warrant and some cameras/listening-devices away from sharing your passphrase.

Don't get me wrong, I think it's great that people are working on secure chat applications. I just think one needs to be very careful making claims that end up on the side of being secure against state actors.

Re: MEGAChat now includes end-to-end encryption

#63

Post by tptacek » Sat, Jan 23, 2016, 7:14 PM UTC

buu700 wrote: post #28

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup…

I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances.

This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco.

It's hard enough building secure messaging in a native application; there are lots of details that are not easy to get right (as Cure53 demonstrated to your team).

Bluntly: I feel that it's irresponsible to add to that portfolio of difficulties the added attack surface of content-controlled Javascript.

The reason people build services like this is that users will prefer them to (more secure) native app alternatives. It's easy to see why. The common response to this observation is: "but users won't install an app". They won't install an app because people keep luring the away with insecure web-page based secure messengers.

Re: MEGAChat now includes end-to-end encryption

#64

Post by eganist » Sat, Jan 23, 2016, 7:26 PM UTC

tptacek wrote: post #63

buu700 wrote: post #28

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup…

I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances. This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco. It's hard enough building secure messaging in a native a…

There are plenty of casual users who want the capability to have one-off conversations without worrying about who might be intercepting and storing the conversations, let alone without having to install anything new and try to convince their friends to use it too. This is made with them in mind.

I see where you're coming from with the added attack surface argument, though I'd counter that browser sandboxing actually makes a web application safer for this use compared to creating a native application on the basis that if the native application is exploited, all user-mode data is now at risk. At least with the containment of the browser, the only things at risk are (potentially) your messages assuming successful XSS.

So long as the proper mitigations are in place, it really makes no difference. The largest future improvement for Cyph in the future would be to incorporate one of the CSP2 changes for more safely allowing inlining, notably hash-src. However, since CSP2 adoption isn't all that widespread quite yet, it's better to hold off until the implementation details between the largest browsers are equalized.

Edit to address your last paragraph: "[Users] won't install an app because people keep luring the away with insecure web-page based secure messengers."

Native encrypted messaging apps have been around for a while and haven't really caught on unless integrated into existing apps a la iMessage. That's where the need for in-browser apps is coming from.

My 2 cents. I'm likely entirely wrong; you've got more experience in general AppSec than I do, so my assumption of risks here might be off-base.

Re: MEGAChat now includes end-to-end encryption

#65

Post by Veratyr » Sat, Jan 23, 2016, 7:29 PM UTC

buu700 wrote: post #28

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup…

Cyph looks great but there are a number of secure applications that only work on desktop or only work on mobile and I'm yet to see one that does both.

Cyph of course runs in a mobile browser but unless I missed something, it doesn't support notifications, which are important. Is there any chance of Cyph supporting push notifications on mobile devices in the future?

Re: MEGAChat now includes end-to-end encryption

#66

Post by buu700 » Sat, Jan 23, 2016, 7:38 PM UTC

tptacek wrote: post #63

buu700 wrote: post #28

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup…

I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances. This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco. It's hard enough building secure messaging in a native a…

Hey Thomas, thanks for the comment; I'd been wanting a chance to get your thoughts on WebSign for ages!

While our audit demonstrates that this scheme shouldn't be expected to be cracked without a critical vulnerability making its way into your browser, it does introduce some odd dependency relationships that certainly introduce new attack vectors not seen in the TOFU property of regular standalone apps.

For example, given that the NSA can be assumed to be indiscriminately passively logging all HTTPS traffic, imagine that one day they gain the capability to break 4096-bit RSA: in a targeted attack scenario, suddenly they can now go back through their traffic logs, find whichever public key is pinned in a particular Cyph user's browser, compute the associated private key, and undo method #2 as descried in the linked reddit comment (the "permanent offline" trick), which gets them half of the way toward completely breaking that user's TOFU.

That having been said, I consider it a perfectly acceptable and pretty neat solution to the problem. Is there something else you're seeing that makes you object to it?

Edit: If your objection isn't to WebSign but to the Web / JS as an execution environment in general, I'll throw in a link to this note on how we're mitigating those traditional risks while also benefitting from the sophisticated sandboxing of modern browsers: https://www.reddit.com/r/encryption/comments/4027ci/how_2_sp...

Re: MEGAChat now includes end-to-end encryption

#67

Post by buu700 » Sat, Jan 23, 2016, 7:54 PM UTC

Veratyr wrote: post #65

buu700 wrote: post #28

Since no one else has explicitly brought this up: https://tonyarcieri.com/whats-wrong-with-webcrypto (also see Matasano's "JavaScript Cryptography Considered Harmful", etc.). There is nothing that a service like this will protect you from that you don't already get while using TLS in just about every insecure/non-E2EE chat service. If you're looking for actually secure communication that runs as a Web app, my startup…

Cyph looks great but there are a number of secure applications that only work on desktop or only work on mobile and I'm yet to see one that does both. Cyph of course runs in a mobile browser but unless I missed something, it doesn't support notifications, which are important. Is there any chance of Cyph supporting push notifications on mobile devices in the future?

Which browser are you using? I'll have to test to confirm in iOS Safari, but the notifications at least work fine for me in Chrome and Firefox on Android.

However, native mobile apps are definitely on the roadmap.

Re: MEGAChat now includes end-to-end encryption

#68

Post by c22 » Sat, Jan 23, 2016, 8:47 PM UTC

zanny wrote: post #54

yaur wrote: post #51

Earlier quoted context omitted.

This can't be overstated. Even if we got the general public to sort of understand PGP and PKI there is going to be a significant number of users that don't understand the difference between a password and a password protected key. The expectation is going to be that when they move to a new computer that their "password still works" and are going to be extremely angry when it doesn't.

Thats why you cannot expect them to understan PGP and PKI. You want a sane default that can secure 99% of people and expose the guts to the last 1% through options menus. The perfect PGP secure email client would be cross platform and provide its own email server. The client has included trusted keys to communicate with upstream, but when you first start it you make your account and that generates you a signing and e…

> The perfect PGP secure email client would be cross platform and provide its own email server. The client has included trusted keys to communicate with upstream, but when you first start it you make your account and that generates you a signing and encryption key based off your password, backs it up on their server (remember, its password protected, they cannot access it despite backing it up) and then whenever you sign in on other device your keys are downloaded and just work.

> This basically turns PGP into username / password, but the only alternative is to use wifi to send your keys between devices when you first start your client of choice - IE, you start it for the first time, it says "do you already have an account? You say yes and it simply asks which PC on the lan has your keys, it communicates with it, you confirm on the other computer to send the keys, and it synchronizes your keys cross-device peer to peer.

Or you could carry your keys around with you on a physical smart device that communicates over usb or nfc. This ux already seems to work well in corporate environments, it's just a matter of convincing consumers it's worthwhile and vendors to bake support into their products.

Re: MEGAChat now includes end-to-end encryption

#69

Post by buu700 » Sat, Jan 23, 2016, 9:06 PM UTC

e12e wrote: post #62

buu700 wrote: post #36

Earlier quoted context omitted.

It doesn't protect users from that yet (neither does Signal or any other alternative), but we are about to implement reproducible builds to help mitigate that by allowing users to independently verify that the deployed production build matches up with our source code on GitHub. That having been said, my cofounder and I are the only two people with the keys to sign releases (and as long Cyph exists they'll only ever b…

Nice to hear that you say you have nothing up your sleeves. I believe you don't, but if you were an agent for a covert agency you would make the same claims, so they mean nothing. As for opsec on keys... the only thing making key extraction remotely difficult by a state actor is probably some form of hsm - but recalling the xbox 1 crack, I don't know how well even those stand up in practice. For everything else, I as…

Definitely agreed re: the meaninglessness of my promises; if someone's threat model were to include that degree of trust in a complete stranger, then there would be no point in that person using encryption to begin with.

Also agreed on all other counts; if all else failed, I have no doubt that a state actor could certainly extract our keys through targeted physical surveillance and/or force, which I don't think there's really a good workaround for short of raising our own army to protect a private bunker for air gapped release signing.

What this first iteration of the air gapped environment is meant to accomplish is to simply make it that much harder. Sure, the CIA can still probably break into my home and set up a surveillance camera to steal the encryption passwords of my keys without my noticing, but what they will no longer be able to do is steal them by tampering with my laptop while my head's turned in broad daylight.

As Cyph continues to grow as a company, we expect to have the resources to implement increasingly sophisticated OpSec measures.

Re: MEGAChat now includes end-to-end encryption

#70

Post by sdevlin » Sat, Jan 23, 2016, 9:45 PM UTC

buu700 wrote: post #66

tptacek wrote: post #63

Earlier quoted context omitted.

I don't think it's a good idea to provide secure messaging services that boot from a web page, under any circumstances. This stuff has to work. The adversary for secure messaging is world governments. If all you're worried about is criminals, Gchat will do a fine job of protecting you. For a vivid example of what I'm talking about, see the Telegram/Iran fiasco. It's hard enough building secure messaging in a native a…

Hey Thomas, thanks for the comment; I'd been wanting a chance to get your thoughts on WebSign for ages! While our audit demonstrates that this scheme shouldn't be expected to be cracked without a critical vulnerability making its way into your browser, it does introduce some odd dependency relationships that certainly introduce new attack vectors not seen in the TOFU property of regular standalone apps. For example,…

Cure53's report details a complete bypass of WebSign as implemented, as well as stern warnings against relying on a non-security feature for security.