Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp's Signal Protocol integration is now complete

whispersystems.org

Post reply on HN
Print view View original

251–260 of 386 posts

Re: WhatsApp's Signal Protocol integration is now complete

#251

Post by patcon »

mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

My hope is that the next step for WhatsApp is to add editing of arbitrary received messages in the client app. While the protocol provides plausible deniability of messages in the cryptographic sense, it's hard for someone who sent an incrimination message to argue that their layperson recipient someone modified the message when the app doesn't allow this to happen easily

Re: WhatsApp's Signal Protocol integration is now complete

#252

Post by drdaeman »

envy2 wrote: post #15
mike_hearn wrote: post #14

This is really excellent. A few thoughts: 1) They seem to have replaced TLS/SSL between client and server with "Noise Pipes". Based on a couple of minutes Googling this seems to be a brand new one-man protocol from Trevor Perrin (the same guy who did Axoltl on which Signal is based). At least, I'd never heard of it. I wonder if this is the first inkling of a post-TLS future? http://noiseprotocol.org/noise.html 2) It'…

> 2) It's a shame to see key words be killed off by internationalisation concerns. 12 words seems so much more friendly, at least to English speakers, than a 50 digit number. In practice I doubt any non-trivial numbers of people will ever compare codes by reading out such a number. I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways (perhaps with icons…

A wild idea: a string of distinctive emojis (distinctive: I mean, not allowing emojis that are too close, like too similar face expressions where only smaller details differ)

They're unified, they're mostly language-agnostic, and there is shitload of them so the representation would be much more compact than hexadecimal or base64-encoded string.

Re: WhatsApp's Signal Protocol integration is now complete

#254

Post by garrettr_ »

tptacek wrote: post #154
aw3c2 wrote: post #131

Earlier quoted context omitted.

Why? "Axolotl" at least has seriously pronunciation issues so I am glad it is not used "user-side".

For my part: because "Axolotl" is one of the most widely name-dropped terms in hipster cryptography, and because it's been adopted by other projects, and because it's distinctive, and because they basically own the term. In a stroke, everyone doing secure key ratchets would have been using their product . It's also just a cool name.

I always liked "Axolotol" because axolotols are a type of salamander with the amazing ability to regenerate parts of their bodies (including their brains!), and the Axolotol protocol, like OTR, is "self-healing", meaning it's capable of recovering from a compromised session key (https://whispersystems.org/blog/advanced-ratcheting/).

Re: WhatsApp's Signal Protocol integration is now complete

#255

Post by tptacek »

skybrian wrote: post #75
zeveb wrote: post #39

Earlier quoted context omitted.

Noise is really interesting. I'd hoped from the name that it might incorporate some of the ideas behind Dust[1], which attempts to hide even that there is a Dust session going on, and what the public and private keys of the recipients are. No such luck — still, it looks very interesting. [1] http://freehaven.net/anonbib/cache/wileydust.pdf

What's interesting about Noise?

It's an expert-authored modern framework for designing fast cryptographic transport protocols that have (depending on the options you select) forward secrecy, peer authentication, and resistance to key compromise.

The notion of a cryptographic protocol framework, rather than a complicated negotiation scheme for a kitchen-sink protocol, is also somewhat novel.

Re: WhatsApp's Signal Protocol integration is now complete

#256

Post by thaumasiotes »

jacobolus wrote: post #191
aw3c2 wrote: post #131

Earlier quoted context omitted.

Why? "Axolotl" at least has seriously pronunciation issues so I am glad it is not used "user-side".

Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.) See more from https://en.wikipedia.org/wiki/List_of_English_words_from_ind... They’re distinctively spelled, don’t collide with existing search terms, often have available domains, etc. Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;) Finally, just look at this guy: https://uploa…

> Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.)

> Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;)

But those words (coyote, mesquite, tomato, and avocado, unless I seriously miss my guess) all end in a vowel.

Re: WhatsApp's Signal Protocol integration is now complete

#257

Post by thaumasiotes »

derefr wrote: post #196
jacobolus wrote: post #191

Earlier quoted context omitted.

Because words coming from Nahuatl are cool! (coyotl, mesquitl, tomatl, ahuacatl, etc.) See more from https://en.wikipedia.org/wiki/List_of_English_words_from_ind... They’re distinctively spelled, don’t collide with existing search terms, often have available domains, etc. Most importantly, they anticipated the web 2.0 trend of ending words with two consonants in a row. ;) Finally, just look at this guy: https://uploa…

Linguistic tangent: the common suffix on those words is interesting. Is it required for Nahuatl nouns, like the Latin -t suffix? I notice that not all the other example words on the linked page-section have it, but a large majority do.

> Is it required for Nahuatl nouns, like the Latin -t suffix?

I don't understand what you're thinking of here? Here are some Latin nouns, all in nominative case:

    nauta   (first declension)
    puer    (second)
    gladius (second)
    malum   (second)
    lex     (third)
    limen   (third)
    tempus  (third)
    virtus  (third)
    civitas (third)
    cornu   (fourth)
    manus   (fourth)
    res     (fifth)
I gave the nominative case, but in fact none of those nouns has any form ending in -t. The only -t suffix I know of in Latin is for third-person singular verbs.

Re: WhatsApp's Signal Protocol integration is now complete

#258

Post by jsmthrowaway »

drdaeman wrote: post #252
envy2 wrote: post #15

Earlier quoted context omitted.

> 2) It's a shame to see key words be killed off by internationalisation concerns. 12 words seems so much more friendly, at least to English speakers, than a 50 digit number. In practice I doubt any non-trivial numbers of people will ever compare codes by reading out such a number. I hope further research here can develop better replacements for encoding short binary strings in i18n friendly ways (perhaps with icons…

A wild idea: a string of distinctive emojis (distinctive: I mean, not allowing emojis that are too close, like too similar face expressions where only smaller details differ) They're unified, they're mostly language-agnostic, and there is shitload of them so the representation would be much more compact than hexadecimal or base64-encoded string.

Cryptography software built with emojis would probably the final straw to me burning down my career, destroying every computing device I own, buying a shrimp boat, and living out my days at sea with a Lieutenant Dan stand-in by my side, wistfully remembering the good times when the computing world made sense as Bud Light finds its way down my jaded, cynical throat.

Put it on a .io domain for bonus points.

Re: WhatsApp's Signal Protocol integration is now complete

#259

Post by wyager »

tptacek wrote: post #63
wyager wrote: post #60

Earlier quoted context omitted.

You don't need the source, but it makes it a hell of a lot easier.

Only if builds are fully reproducible, which is rarely true. Otherwise, the source can make it harder, by lying to you.

Don't tell me that it's easier to RE an entire multi-megabyte messenger app than it is to real the source code. Assembly can lie to you as well. There are all sorts of ways to trick IDA and friends.

Re: WhatsApp's Signal Protocol integration is now complete

#260

Post by tptacek »

mc32 wrote: post #241
aw3c2 wrote: post #131

Earlier quoted context omitted.

Why? "Axolotl" at least has seriously pronunciation issues so I am glad it is not used "user-side".

Kids would love that name because they know it as that cool looking salamander with gills (or whatever they are).

Confirming this: my daughter was thrilled that there was something in my field actually called "axolotl".
Post reply on HN