Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Here come the encryption apps

blog.cryptographyengineering.com

Post reply on HN
Print view View original

1–10 of 58 posts

Re: Here come the encryption apps

#4

Post by dmix »

chrisballinger wrote: post #2

Looks like they skipped over two open source XMPP+OTR clients for iPhone/Android: ChatSecure ( https://chatsecure.org ) and Gibberbot https://guardianproject.info/apps/gibber/ Disclosure: I am the original author of ChatSecure.

I've tried using Gibberbot with some friends. It is pretty unreliable sometimes. I think it may be an issue with OTR in general.

I feel like IM encryption still isn't a problem that has been fully solved yet on android.

(Haven't checked out ChatSecure, looks good.)

Re: Here come the encryption apps

#5

Post by moxie »

I work on two of the apps Matthew reviews here (RedPhone and TextSecure).

What I didn't expect when I started working on these types of projects is that the cryptography is the easy part. I'm really honored to hear that my code has the ability to make Matthew Green drool, but that ZRTP stack was a two or three day project three years ago, and hasn't changed much since. The bulk of the work over the intervening period has been almost exclusively about improving call quality and user experience.

I think this increased emphasis on the user might be what distinguishes the "new wave" of crypto apps from the last. There seems to be a real consensus between those working in the space that this is what's important now.

The things that I'm most proud of about RedPhone are typically unrelated to the crypto, and are instead things like using push notifications for signaling instead of persistent connections, using a lightweight mobile-oriented signaling protocol instead of SIP, and building a low-latency calling network: http://www.whispersystems.org/blog/low-latency-switching/

I think we're all starting to realize that our "competition" is the "insecure" versions of what we're building, and security isn't an effective point of comparison. We have to build better products, which just happen to incidentally be really secure.

Re: Here come the encryption apps

#6

Post by tshtf »

dmix wrote: post #4
chrisballinger wrote: post #2

Looks like they skipped over two open source XMPP+OTR clients for iPhone/Android: ChatSecure ( https://chatsecure.org ) and Gibberbot https://guardianproject.info/apps/gibber/ Disclosure: I am the original author of ChatSecure.

I've tried using Gibberbot with some friends. It is pretty unreliable sometimes. I think it may be an issue with OTR in general. I feel like IM encryption still isn't a problem that has been fully solved yet on android. (Haven't checked out ChatSecure, looks good.)

What problems have you had with Gibberbot? It's been rock solid for me with a decent XMPP server, and even works reasonably well when proxied through Tor (Orbot). I've had no issues with OTR either.

Re: Here come the encryption apps

#7

Post by dmix »

tshtf wrote: post #6
dmix wrote: post #4

Earlier quoted context omitted.

I've tried using Gibberbot with some friends. It is pretty unreliable sometimes. I think it may be an issue with OTR in general. I feel like IM encryption still isn't a problem that has been fully solved yet on android. (Haven't checked out ChatSecure, looks good.)

What problems have you had with Gibberbot? It's been rock solid for me with a decent XMPP server, and even works reasonably well when proxied through Tor (Orbot). I've had no issues with OTR either.

Both sides occasionally got scrambled messages. Sometimes messages wouldn't show up at all and had to be resent.

I googled the issues a few times and there seems to be a lot of similar complaints from other users of all OTR apps (like PigdinOTR).

I may have been some mistakenly from another gtalk app running or older android phones.

One big UX issue is making sure both people are using it always.

Re: Here come the encryption apps

#8

Post by tshtf »

dmix wrote: post #7
tshtf wrote: post #6

Earlier quoted context omitted.

What problems have you had with Gibberbot? It's been rock solid for me with a decent XMPP server, and even works reasonably well when proxied through Tor (Orbot). I've had no issues with OTR either.

Both sides occasionally got scrambled messages. Sometimes messages wouldn't show up at all and had to be resent. I googled the issues a few times and there seems to be a lot of similar complaints from other users of all OTR apps (like PigdinOTR). I may have been some mistakenly from another gtalk app running or older android phones. One big UX issue is making sure both people are using it always.

Ah, there's big issues with OTR with users who are logged in more than one location. OTRv2 didn't work well with that, but I think OTRv3 may have fixes...

Re: Here come the encryption apps

#9

Post by tptacek »

I don't understand how Matthew can write a comparative review of encrypted chat clients and include one for which he has no technical information, not even a binary; particularly when it mixes number theoretic and conventional block crypto, thus exposing itself to a maximal subset of possible implementation errors.

I'd also be interested in the kinds of flaws his class was able to generate for in-class discussion, in other projects. Assigning your class a code review of Moxie's code is somewhat sadistic, and, more importantly, doesn't really give us much of a benchmark.

Re: Here come the encryption apps

#10

Post by tptacek »

moxie wrote: post #5

I work on two of the apps Matthew reviews here (RedPhone and TextSecure). What I didn't expect when I started working on these types of projects is that the cryptography is the easy part. I'm really honored to hear that my code has the ability to make Matthew Green drool, but that ZRTP stack was a two or three day project three years ago, and hasn't changed much since. The bulk of the work over the intervening period…

I don't understand why you'd concede security to your competition; it is a genuine distinction. Most security people I know, and all the crypto people I know would choose your designs over those of the other designers in this review, not because of the quality of your application but because you're clearly a capable designer.

I worry about the message we send with this "the competition is insecure apps" stuff. Some of the tools in this review appear sound now, but started off in a state of profound unsoundness. Yours didn't. There's a reason for that which speaks to the underlying quality of your design.

Post reply on HN