Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Surespot app - free and open source encryption for everyone

surespot.me

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Surespot app - free and open source encryption for everyone

#21

Post by dalore »

veidr wrote: post #12

You can delete your message from the receivers phone. That second bullet point set off my BS detector (and is where I stopped reading). No system on earth lets you reliably delete a message sent to another device over the Internet, after the fact. Neither can any such system reliably prevent users from sharing pictures that they can see on their device. This site reads like an add for a perpetual motion engine. Which…

Snapchat which is an app that lets you send a time limited picture deletes it when you view it. You can't view the message without their client.

Of course you can take a screenshot of the image, but they have figured out how to capture that event and it alerts the sender.

Re: Surespot app - free and open source encryption for everyone

#22

Post by bigiain »

nivkovic78 wrote: post #19
bigiain wrote: post #18

Earlier quoted context omitted.

FWIW, that's exactly what happens with Verisign (or DigiNotar) when you connect to your banks SSL website…

Not exactly. With SSL, encrypted communication goes between client and server. In case of this app, encryption is done with user's public keys, no server is involved in encrypting messages. Server role is only in signing public keys to ensure their authenticity. But that alone is bad and insecure practice.

That "Signing public keys to ensure their authenticity" is exactly what (any of the possibly as many as 600) public CA's that your browser and/or OS come pre-configured to "trust".

Who the hell are "Xramp Global CA"? "VRK Gov Root CA"? "UCA Root"? "Trusted Certificate Services"? They're all just random selections from the first page of trusted root certs in this OS X machine's list of System Root keys. Any of them could choose to "authenticate" a public key that claims to be my bank. Apart from the few pinned certificates in Chrome (I think mostly Google certs), I've got no more reason to believe any SSL connection I make is "authenticated" any more than Iranian Gmail users should have had when a DigiNotar root CA cert had signed those rouge Google SSL certs.

Re: Surespot app - free and open source encryption for everyone

#23

Post by bigiain »

XorNot wrote: post #20
bigiain wrote: post #18

Earlier quoted context omitted.

FWIW, that's exactly what happens with Verisign (or DigiNotar) when you connect to your banks SSL website…

That's for communicating with your bank. If you can't trust your legal system for that, then you have much bigger problems.

It also used to "secure" your email communication with Lavabit… And the 8 (alleged) PRISIM participants. From what I read – "trusting the legal system for that" perhaps isn't a particularly prudent idea.

Re: Surespot app - free and open source encryption for everyone

#24

Post by surespot »

ig1 wrote: post #16

First impression: * No details of threat model * No details of crypto protocols used * No discussion of how key exchange problem is solved * Makes misleading security claims "when you delete a sent message it will be removed from the receivers phone" Basically falls into "don't touch with a barge pole" category of crypto software. Crypto software isn't a category where you can make it up as you go along, it has to be…

Perhaps you can get a second impression-

details of threat model- https://www.surespot.me/documents/threat.html

details of how surespot works including crypto- https://www.surespot.me/documents/how_surespot_works.html

you can always review the code on GitHub- https://github.com/surespot/android

Re: Surespot app - free and open source encryption for everyone

#25

Post by surespot »

StavrosK wrote: post #13
meskio wrote: post #4

"Only the person you send the message to can read it. Period." To use this kind of sentences on new software not reviewed by the comunity is dangerous. There is people that risk their lifes using this kind of app. The thing that puzzles me is that sentence: "You can delete your message from the receivers phone." I don't see in the 'how it works' any information about it. Do they do that in a cryptographic way somehow…

> "Only the person you send the message to can read it. Period." > To use this kind of sentences on new software not reviewed by the comunity is dangerous. There is people that risk their lifes using this kind of app. It is also false, since it seems that their threat model also includes the server being able to transparently MITM you and read all your messages. A pretty egregious overstatement, I think.

The threat model also suggests that you verify key fingerprints manually if you are concerned about MITM.

Re: Surespot app - free and open source encryption for everyone

#26

Post by StavrosK »

surespot wrote: post #25
StavrosK wrote: post #13

Earlier quoted context omitted.

> "Only the person you send the message to can read it. Period." > To use this kind of sentences on new software not reviewed by the comunity is dangerous. There is people that risk their lifes using this kind of app. It is also false, since it seems that their threat model also includes the server being able to transparently MITM you and read all your messages. A pretty egregious overstatement, I think.

The threat model also suggests that you verify key fingerprints manually if you are concerned about MITM.

Yeah, I guess verifying the full length of the fingerprint would mitigate that, and not doing that exposes you to a MITM attack anyway. Not much less secure than exchanging the keys directly, then, you are right.

Re: Surespot app - free and open source encryption for everyone

#27

Post by ig1 »

surespot wrote: post #24
ig1 wrote: post #16

First impression: * No details of threat model * No details of crypto protocols used * No discussion of how key exchange problem is solved * Makes misleading security claims "when you delete a sent message it will be removed from the receivers phone" Basically falls into "don't touch with a barge pole" category of crypto software. Crypto software isn't a category where you can make it up as you go along, it has to be…

Perhaps you can get a second impression- details of threat model- https://www.surespot.me/documents/threat.html details of how surespot works including crypto- https://www.surespot.me/documents/how_surespot_works.html you can always review the code on GitHub- https://github.com/surespot/android

You should have a look at:

https://www.owasp.org/index.php/Threat_Risk_Modeling

To understand the standard approaches to threat modelling.

It should be trivial for someone to look at the documentation and quickly answer basic security questions like "Does it defend against replay attacks ?" and "Does it leak message size ?"

Re: Surespot app - free and open source encryption for everyone

#28

Post by beagle3 »

dalore wrote: post #21
veidr wrote: post #12

You can delete your message from the receivers phone. That second bullet point set off my BS detector (and is where I stopped reading). No system on earth lets you reliably delete a message sent to another device over the Internet, after the fact. Neither can any such system reliably prevent users from sharing pictures that they can see on their device. This site reads like an add for a perpetual motion engine. Which…

Snapchat which is an app that lets you send a time limited picture deletes it when you view it. You can't view the message without their client. Of course you can take a screenshot of the image, but they have figured out how to capture that event and it alerts the sender.

What stops me from taking a picture of the screen with another device?

Re: Surespot app - free and open source encryption for everyone

#29

Post by XorNot »

bigiain wrote: post #23
XorNot wrote: post #20

Earlier quoted context omitted.

That's for communicating with your bank. If you can't trust your legal system for that, then you have much bigger problems.

It also used to "secure" your email communication with Lavabit… And the 8 (alleged) PRISIM participants. From what I read – "trusting the legal system for that" perhaps isn't a particularly prudent idea.

If the government doesn't want to recognize the value of your money, they don't need to snoop on your communications with your bank to do it.

Conversely if you're actually interested in protecting your information, then client-side encryption with self-authenticated keys has always been the only solution.

Re: Surespot app - free and open source encryption for everyone

#30

Post by bazzargh »

bazzargh wrote: post #8

BTW, this code would have trouble sending messages between locales. I had a quick look at the encryption code, and found this: public static String sign(PrivateKey privateKey, String data, String derivedPassword) { return sign(privateKey, data.getBytes(), derivedPassword.getBytes()); } ... which of course uses the current platform's character set, not a consistent one across platforms. Definitely not what you want in…

So I raised an issue with Surespot, and it is indeed the case that Android uses UTF-8 everywhere by default, independent of locale (much more sensible than Sun's Java!). The code is correct. Nothing to see here, move along.
Post reply on HN