Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CryptoCat iOS Application Penetration Test [pdf]

isecpartners.github.io

Post reply on HN
Print view View original

111–120 of 137 posts

Re: CryptoCat iOS Application Penetration Test [pdf]

#111

Post by diminoten »

rancor wrote: post #106
kaeporan wrote: post #93

Earlier quoted context omitted.

Cryptocat has always provided ample warnings that no software can ever be trusted with your life. These warnings appear every time you launch Cryptocat, on the website and in various guides and blog posts.

And I agree, that's a bare minimum warning for all such software. I appreciate your efforts to make strong crypto more accessible to the general public. That being said, you and I both know that people are using Cryptocat in dangerous situations. And having worked on both medical imaging and secure messaging systems, I have a healthy respect for the consequences of implementation failure. As such, I feel that your di…

You lampoon yourself with this extremist attitude.

Re: CryptoCat iOS Application Penetration Test [pdf]

#112

Post by marshray »

diminoten wrote: post #111
rancor wrote: post #106

Earlier quoted context omitted.

And I agree, that's a bare minimum warning for all such software. I appreciate your efforts to make strong crypto more accessible to the general public. That being said, you and I both know that people are using Cryptocat in dangerous situations. And having worked on both medical imaging and secure messaging systems, I have a healthy respect for the consequences of implementation failure. As such, I feel that your di…

You lampoon yourself with this extremist attitude.

Go read http://tobtu.com/decryptocat.php and earlier sources before deciding he's being extremist.

Re: CryptoCat iOS Application Penetration Test [pdf]

#113

Post by epsylon »

kaeporan wrote: post #80
natdempk wrote: post #47

Earlier quoted context omitted.

I don't believe they've had an independent security audit. I think their team however is comprised of more respected cryptographers like Moxie Marlinspike, who introduced the concept of SSL stripping, one of the issues that was found in the CryptoCat app. I mean no disrespect to CryptoCat, and more eyes can always find something someone overlooked, but I think the Open Whisper Systems (TextSecure) team is stronger an…

iSEC also audited TextSecure, but TextSecure chose not to publish the audit.

They didn't choose not to publish.

https://news.ycombinator.com/item?id=7520581

Re: CryptoCat iOS Application Penetration Test [pdf]

#114

Post by _gfrc »

tptacek wrote: post #75
orthecreedence wrote: post #71

Earlier quoted context omitted.

Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned). People could sign up and post their solutions, and others would be able to validate entries of levels below them (so som…

We actually do have a web application we use to track the challenges (the mail is all done through Mailgun). Two things complicate managing the challenges: * We have to actually read the code people send us (if you get things wrong, there's a pretty good chance we'll catch it). We try hard not to move people forward a level until they've gotten the previous challenges right. * We don't dictate any particular format f…

We have a pretty cool submission system in use at my university, that will spin up a VM, compile and run your code and have a set of validators check if the output is correct. That way people can test their submission and immediately get feedback. You would still have to look into the code to make sure it's really valid, but I guess you could filter out lots of invalid submissions. If you are interested, I can hook you up with one of the developers of that system.

Re: CryptoCat iOS Application Penetration Test [pdf]

#115

Post by kaeporan »

rancor wrote: post #106
kaeporan wrote: post #93

Earlier quoted context omitted.

Cryptocat has always provided ample warnings that no software can ever be trusted with your life. These warnings appear every time you launch Cryptocat, on the website and in various guides and blog posts.

And I agree, that's a bare minimum warning for all such software. I appreciate your efforts to make strong crypto more accessible to the general public. That being said, you and I both know that people are using Cryptocat in dangerous situations. And having worked on both medical imaging and secure messaging systems, I have a healthy respect for the consequences of implementation failure. As such, I feel that your di…

It's important to note that this audit was commissioned to evaluate a prototype build before release. It was expected to find bugs, and all bugs were fixed before release. I believe I take my job very seriously when I commission such audits on a bi-annual basis and transparently discuss the results. Independent individuals who find bugs (such as "Decryptocat") are also listened to and rewarded for their effort. I believe that I and my team have been competent, honest and hard-working. If all encryption projects were as transparent as us, you would realize that this kind of issues happens everywhere.

Please make sure to read our blog post and Github discussions to see the kind of open discussion we're hoping to lead so that our software can benefit.

That being said, I suppose comments like yours are why I've been having recurring suicidal thoughts for the past two years. I don't know what else to say at this point.

Re: CryptoCat iOS Application Penetration Test [pdf]

#116

Post by ibmthrowaway218 »

sneak wrote: post #86
kaeporan wrote: post #8

Earlier quoted context omitted.

Thanks for linking to the blog post. This audit concerns a pre-release version of Cryptocat for iPhone. Many of the bugs were due to debugging code and were fixed before release.

Why use donated money to pay for an audit of software that has known bugs and isn't ready yet? That's wasteful. The point of an audit is to find bugs you don't already know about.

It can be a useful technique for testing the quality of the audit.

At a previous company we had to have words with a company that performed a software audit as they failed to find two issues we'd planted to test them. (Of course, they did find several things we didn't know about.)

Re: CryptoCat iOS Application Penetration Test [pdf]

#117

Post by drdaeman »

moxie wrote: post #96
illumen wrote: post #82

Earlier quoted context omitted.

"I just reviewed all open and closed bugs in TextSecure's Issues page and didn't see a single crypto protocol bug. Admittedly, I looked quickly and casually. Could you point us to one?" You could not have reviewed all open and closed bugs in 8 minutes ;) Issue 1073: https://github.com/WhisperSystems/TextSecure/issues/1073 Another one: Just sent an encrypted photo to someone? The photo is stored unencrypted on your ph…

These are bugs, but I'm not sure they are what you think they are. I would be worried if TextSecure indicates a message is going to be sent securely, but it is sent insecurely. This bug, however, is an edge case where TextSecure indicates that it is going to send a message insecurely , and that's what it does. It's also true that until recently we didn't have an encrypted group chat protocol, but at no point in the p…

> encrypted group chat protocol

Sorry to bother, but is there any article/blog post/something to read about that?

As XMPP MUCs don't seem to have E2E encryption, mpOTR seems to be in infancy, and I'm unaware of anything else, this sounds really interesting.

Re: CryptoCat iOS Application Penetration Test [pdf]

#118

Post by fit2rule »

kaeporan wrote: post #104
tptacek wrote: post #101

Earlier quoted context omitted.

They do that now. Dan's OTF post suggests that it wasn't always that straightforward, because the auditors had a proprietary interest in their reports.

Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to…

>What I'm curious about is, why don't other projects such as TextSecure publish their audits as well?

Its embarrassing, duh.

Re: CryptoCat iOS Application Penetration Test [pdf]

#119

Post by tptacek »

fit2rule wrote: post #118
kaeporan wrote: post #104

Earlier quoted context omitted.

Hmm. Cryptocat was actually the first ever OTF project. I believe they've always asked for the publication of audits. What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? I'd certainly appreciate Moxie answering this question. The OTF blog post certainly makes good points for this to happen. I also personally believe that this reticence to publish audits is damaging to…

>What I'm curious about is, why don't other projects such as TextSecure publish their audits as well? Its embarrassing, duh.

For who, TextSecure or the auditors? Both are possibilities, one slightly more likely than the other. Auditors hate having reports published with no major findings.

Re: CryptoCat iOS Application Penetration Test [pdf]

#120

Post by tptacek »

daira wrote: post #105
daira wrote: post #94

Earlier quoted context omitted.

This issue (or one with very similar effect) was also found by the Least Authority audit: https://github.com/cryptocat/cryptocat/issues/607 (The 'issue E' that it references is https://github.com/cryptocat/cryptocat/issues/606 .)

Actually I strongly suggest reading these in conjunction with iSec's issues 12 through 16, because each team spotted some details that the other missed.

Are you sure that's not because the different teams had different scopes? The iSEC audit was specifically tied to the iOS application.
Post reply on HN