How Secure is TextSecure?

>In conclusion, TEXTSECURE only achieves deniability theoretically. Content deniability is provided due to our security proof but we can not prove that no delivery request will be recorded at the TEXTSECURE server.

Re: How Secure is TextSecure?

#6

Post by noja » Wed, Apr 06, 2016, 9:03 PM UTC

https://www.eff.org/secure-messaging-scorecard

Re: How Secure is TextSecure?

#7

Post by jrcii » Wed, Apr 06, 2016, 9:05 PM UTC

I've expended 0 effort to find the answer to this myself, but I wonder if this is based on the OTR protocol, and if not, why not.

Re: How Secure is TextSecure?

#8

Post by baby » Wed, Apr 06, 2016, 9:21 PM UTC

AdmiralAsshat wrote: post #5

Seems pretty good overall. The only primary bullet point to "fail" was here: >In conclusion, TEXTSECURE only achieves deniability theoretically. Content deniability is provided due to our security proof but we can not prove that no delivery request will be recorded at the TEXTSECURE server.

Ah this is a good point, if the server records the exact direction of messages, then deniability goes down the toilet.

Re: How Secure is TextSecure?

#9

Post by baby » Wed, Apr 06, 2016, 9:21 PM UTC

mtgx wrote: post #2

I assume this was posted now because of this: > Date: received 31 Oct 2014, last revised 5 Apr 2016

Also because the protocol discussed, now known as Signal, as been announced to have been implemented in WhatsApp yesterday.

Re: How Secure is TextSecure?

#10

Post by yourcelf » Wed, Apr 06, 2016, 9:22 PM UTC

jrcii wrote: post #7

I've expended 0 effort to find the answer to this myself, but I wonder if this is based on the OTR protocol, and if not, why not.

The TextSecure protocol is now named the "Signal Protocol"; it's developed by Open Whisper Systems. It is the protocol used by the Signal app on Android and iPhone, and as of this week, also used by WhatsApp.

Here is an older post where the authors of the protocol explain why not OTR: https://whispersystems.org/blog/advanced-ratcheting/

The main takeaway: text messaging, unlike traditional instant messaging, is primarily asynchronous with long-lived sessions, where traditional instant messaging is primarily synchronous with short-lived sessions.