Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Please do not make it public” (Tencent’s Sogou Input Method)

citizenlab.ca

Post reply on HN
Print view View original

11–20 of 43 posts

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#11

Post by 2OEH8eoCRo0 »

Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

> Why do they elect to do this?

They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#12

Post by jsiepkes »

newaccount74 wrote: post #5
Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

My experience with TLS is that it is not trivial to use. Understanding how to use eg. OpenSSL APIs correctly to ensure that a connection is secure, the certificates are valid, etc. is not trivial. The APIs are poorly documented, hard to use, and many examples you can find are outdated (some OpenSSL APIs return different numbers on success/failure depending on version). The platform native libraries are not much bette…

> I wonder what people say when they find a bug despite you using standard crypto?

Not using TLS doesn't automatically mean you need to "roll your own crypto". They could have used a well documentend library such as Google Tink[1] instead of doing their own crypto.

[1] https://github.com/google/tink

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#13

Post by manuelabeledo »

newaccount74 wrote: post #5
Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

My experience with TLS is that it is not trivial to use. Understanding how to use eg. OpenSSL APIs correctly to ensure that a connection is secure, the certificates are valid, etc. is not trivial. The APIs are poorly documented, hard to use, and many examples you can find are outdated (some OpenSSL APIs return different numbers on success/failure depending on version). The platform native libraries are not much bette…

It may not be trivial to use, but I fail to understand how a solution to a very hard problem is better if tailored. For example, Open/LibreSSL are widespread, have large communities of both maintainers and developers, which necessarily subjects them to continuous audits over time.

> Also, your code is always a ticking time bomb, because TLS algorithms are deprecated, certificates expire, etc. So you are always at the risk of your client code to stop working at some point.

Certificate expiration should be handled as part of the configuration management lifecycle. Same goes for TLS algos. If you are hardcoding either of these, you are definitely doing something wrong.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#15

Post by manuelabeledo »

2OEH8eoCRo0 wrote: post #11
Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

> Why do they elect to do this? They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional.

> They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional.

They could have deployed TLS with some cipher of Chinese origin, not like Chinese companies haven't done this before [0]

[0] https://ciphersuite.info/cs/TLS_SM4_GCM_SM3/

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#16

Post by pm2222 »

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” So generally speaking established standard are scrutinized more and thus more trustworthy, right? I can think of all those WiFi encryption methods we’ve been through and they are all vulnerable, sooner or later.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#17

Post by JohnFen »

Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

It's pretty common for devs who are inexperienced with cryptography to succumb to the temptation to roll their own, especially if they start studying cryptography algorithms.

It's always a mistake, though. This is something I had to cover with younger devs quite a bit back when I worked for a company that made heavy use of cryptography.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#18

Post by JohnFen »

pm2222 wrote: post #16

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” So generally speaking established standard are scrutinized more and thus more trustworthy, right? I can think of all those WiFi encryption methods we’ve been through and they are all vulnerable, sooner or later.

> So generally speaking established standard are scrutinized more and thus more trustworthy, right?

Yes, in large part.

Also, implementing good cryptography requires specialist mathematical skills on par with dev skills. It's very easy to make a really trivial mistake such that it looks like the crypto is solid, when it's in fact very weak.

The ability to make a trivial mistake that's hard to spot, combined with the high stakes involved, makes cryptography something that's better left to the experts.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#19

Post by est31 »

newaccount74 wrote: post #5
Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

My experience with TLS is that it is not trivial to use. Understanding how to use eg. OpenSSL APIs correctly to ensure that a connection is secure, the certificates are valid, etc. is not trivial. The APIs are poorly documented, hard to use, and many examples you can find are outdated (some OpenSSL APIs return different numbers on success/failure depending on version). The platform native libraries are not much bette…

For the deprecated TLS algorithms, just use a bunch of reverse proxies at the front using the latest Debian, CentOS, or Ubuntu LTS, with mostly default settings.

For OpenSSL, app developers don't need it. There is OS builtin libraries to do http requests (which is what was done here).

As for certificates, there is plenty of solutions allowing for auto-renewal. It's very easy to set up using automation.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#20

Post by paxys »

Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

The article says that they use both HTTP and HTTPS endpoints, and the exchanges using HTTPS are secure (as expected). My guess is they had to build their own encryption scheme paired with plain HTTP for older devices or those that for some reason weren't compatible with the latest TLS standards (which are a lot of them).
Post reply on HN