Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please Stop Writing Secure Messaging Tools (2015)

dymaxion.org

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Please Stop Writing Secure Messaging Tools (2015)

#31

Post by yayana »

ndesaulniers wrote: post #28
gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

It sounds like you are saying Nexus devices have a hsm separate from their gsm card for hardware protected keys, do all fingerprint enabled Android devices have this?

Re: Please Stop Writing Secure Messaging Tools (2015)

#32

Post by gumby »

ndesaulniers wrote: post #28
gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

First of all, I understand your taking offense (though none was intended) since this is the thing you work on. I feel the same way about stuff I work on! Second, I simply used that as a straightforward example, not to say "Apple good, android bad."

Security is always a risk tradeoff. My house uses special Medeco keys (modified in violation of the Medeco license as it happens) because what I want to defend against is copying when I lend out one of my numbered keys. The house is made of glass so someone could just use a brick to get in. For someone else this is a dumb tradeoff; for me it is appropriate.

And your message includes an example of such a tradeoff:

>This may not be as elegant as doing matching on the sensor, but keep in mind we have to play within the constraints of 2 difference vendors (SoC, Fingerprint Sensor).

>Somehow implying that Android is less somehow less secure in the case of fingerprint is disingenuous.

The channel between the two separate devices is an attack surface (as is the opportunity for offline attack on the encrypted data in the filesystem). The Android team has made the determination that that's an acceptable risk. I won't argue -- perhaps I agree and perhaps I don't, but it is unambiguously less secure than the single, all-encompassing approach. To claim so is hardly disingenuous.

Of course, as with my house, this just changes the class of attack. On either platforms you can consider attacking whatever authentication module talks to the TEE. Both systems use other mechanisms for that.

Finally, in the Android case a vendor is free to do what they want, especially if they don't care about access to branding, google services etc. Google branded devices have a more important brand to defend than, say, Asus (not to pick on Asus), much less, say, DJI's drones, for which the Android branding is utterly irrelevant (conceivably that could rebound on Google though personally I doubt it would even happen. The same obviously can't be said about iOS :-)

Re: Please Stop Writing Secure Messaging Tools (2015)

#33

Post by ndesaulniers »

gumby wrote: post #32
ndesaulniers wrote: post #28

Earlier quoted context omitted.

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

First of all, I understand your taking offense (though none was intended) since this is the thing you work on. I feel the same way about stuff I work on! Second, I simply used that as a straightforward example, not to say "Apple good, android bad." Security is always a risk tradeoff. My house uses special Medeco keys (modified in violation of the Medeco license as it happens) because what I want to defend against is…

Those are all fair points, I don't disagree. Maybe disingenuous was the wrong word?

Re: Please Stop Writing Secure Messaging Tools (2015)

#34

Post by ndesaulniers »

yayana wrote: post #31
ndesaulniers wrote: post #28

Earlier quoted context omitted.

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

It sounds like you are saying Nexus devices have a hsm separate from their gsm card for hardware protected keys, do all fingerprint enabled Android devices have this?

I'm not sure what hsm/gsm stand for. I can only speak for the Android devices I work on.

Re: Please Stop Writing Secure Messaging Tools (2015)

#35

Post by jlgaddis »

ndesaulniers wrote: post #34
yayana wrote: post #31

Earlier quoted context omitted.

It sounds like you are saying Nexus devices have a hsm separate from their gsm card for hardware protected keys, do all fingerprint enabled Android devices have this?

I'm not sure what hsm/gsm stand for. I can only speak for the Android devices I work on.

HSM: https://en.wikipedia.org/wiki/Hardware_security_module

GSM: https://en.wikipedia.org/wiki/GSM

Re: Please Stop Writing Secure Messaging Tools (2015)

#36

Post by criddell »

ndesaulniers wrote: post #28
gumby wrote: post #10

The essay I wish she had written would have said, "we don't need more 'secure messaging systems' -- we should be making all the following tools secure by design" For example, (and whether you love them or hate them) Apple takes this seriously: your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. Compare that to the Android imple…

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

> keep in mind we have to play within the constraints of 2 difference vendors (SoC, Fingerprint Sensor)

Why is that?

Re: Please Stop Writing Secure Messaging Tools (2015)

#38

Post by pdimitar »

deckar01 wrote: post #4
zeta0134 wrote: post #2

Looks like this site is being hugged to death, Google's cache works though: https://webcache.googleusercontent.com/search?q=cache:pwT4ik...

Archive.org cache: https://web.archive.org/web/20161019151428/https://dymaxion....

This link is more recent: https://web.archive.org/web/20171015070908/https://dymaxion....

Re: Please Stop Writing Secure Messaging Tools (2015)

#39

Post by m3rc »

pudo wrote: post #19

That list is pure genius. I'm working with reporters mostly in non-OECD countries, 80% of the stuff on that list are real, largely unmet needs. Signal isn't perfect, but it works fine, thanks. A special place in hell should also be reserved for those in the tech world that mix up security (a real and critical need that people have) and their software politics. If you don't like Microsoft, Google, Adobe, "the Cloud",…

Signal is honestly pretty close. The "failures" are usually design choices that would only affect actual infosec people, which the developers are explicitly not trying to court.

Re: Please Stop Writing Secure Messaging Tools (2015)

#40

Post by ndesaulniers »

criddell wrote: post #36
ndesaulniers wrote: post #28

Earlier quoted context omitted.

I maintain the Fingerprint stack on Google Nexus/Pixel devices. > your fingerprints don't leave the device and are implemented by a piece of hardware in such a way that even Apple doesn't have access to them. This is true for Google, too. > Compare that to the Android implementations which have fingerprints in the filesystem. They're not stored in plaintext. They're encrypted with keys that remain in hardware. You ca…

> keep in mind we have to play within the constraints of 2 difference vendors (SoC, Fingerprint Sensor) Why is that?

We don't make our own SoC or Fingerprint Sensor, and time to market.
Post reply on HN