Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CryptoCat iOS Application Penetration Test [pdf]

isecpartners.github.io

Post reply on HN
Print view View original

131–137 of 137 posts

Re: CryptoCat iOS Application Penetration Test [pdf]

#131

Post by fakedavidthiel »

oafitupa wrote: post #58

The good thing about CryptoCat is that everyone wants to trash it, so it's becoming better.

Precisely. I'd also like to reiterate that CryptoCat had no special obligation to release the report, and doing so was remarkably transparent; Nadim was also super open and responsive throughout the whole audit process. Regardless of anyone's opinion of the findings, the issues are out in the open, discussable and resolvable, which can be nothing but beneficial.

Kudos to Nadim and OTF for releasing the info and starting these discussions, as inevitably arduous as they are.

Re: CryptoCat iOS Application Penetration Test [pdf]

#132

Post by fakedavidthiel »

lawnchair_larry wrote: post #33

Huh, this was apparently submitted by Alex Stamos, a co-founder of iSec partners (who did this audit). And he editorialized the title, "Brutal Professional Audit of CryptoCat Published." Your former company did an audit for a customer, then you posted it to HN calling it "Brutal"? Really?

I was certainly not comfortable with that either; however, Alex is his own man now, free to use whatever inflammatory adjectives he chooses. Not much we can do about it, but also not unusual for him to follow the news on a company he put so many years into.

I also do wish that the original post had pointed at CryptoCat's blog post - aside from CryptoCat's context about problems and resolutions, people should also be aware of the separate report by Zooko's team.

Re: CryptoCat iOS Application Penetration Test [pdf]

#133

Post by rancor »

kaeporan wrote: post #129
rancor wrote: post #128

Earlier quoted context omitted.

I read the blog post reacting to this batch of audit results quite carefully, in point of fact. In general, when I read vendor responses to such devastating findings, I'm looking for a concrete plan to improve the threat modeling and development practices deficiencies which are inevitably the root cause of the class of issues uncovered by the iSec and Least Authority audits. Without such changes, saying that you're g…

I disagree; I don't think your summary is accurate. This is an audit of a pre-release prototype. All the bugs were fixed before release, and our blog post at https://blog.crypto.cat/2014/04/recent-audits-and-coming-imp... does not discuss mere band-aids. It discusses, at length, real solutions to complex problems that many encryption apps face. It resolves pitfalls that even companies like Apple commit on a much wide…

I made no criticisms of how you responded to individual issues raised by the audit, and in fact it's encouraging to see many of the long-standing contact authorization issues finally being addressed as well as what I would generally consider an acceptable approach to handling individual security issues. But I don't think either of these points addresses my concerns regarding security conscious development practices.

I appreciate your willingness to continue this discussion, dropped you an email.

Re: CryptoCat iOS Application Penetration Test [pdf]

#134

Post by daira »

tptacek wrote: post #120
daira wrote: post #105

Earlier quoted context omitted.

Actually I strongly suggest reading these in conjunction with iSec's issues 12 through 16, because each team spotted some details that the other missed.

Are you sure that's not because the different teams had different scopes? The iSEC audit was specifically tied to the iOS application.

The scopes had a great deal of overlap; although we (Least Authority) didn't consider the iOS client at all, the rest of iSec's audit has essentially the same scope as ours. The point I was trying to highlight is how easy it is to miss things, and therefore that having independent concurrent audits is actually a really good idea. It would probably be even better if the teams worked mostly independently but were able to exchange draft versions of their reports (before the mitigations necessary for a public release).

Re: CryptoCat iOS Application Penetration Test [pdf]

#135

Post by nathan-at-least »

tptacek wrote: post #49
natdempk wrote: post #47

Earlier quoted context omitted.

I don't believe they've had an independent security audit. I think their team however is comprised of more respected cryptographers like Moxie Marlinspike, who introduced the concept of SSL stripping, one of the issues that was found in the CryptoCat app. I mean no disrespect to CryptoCat, and more eyes can always find something someone overlooked, but I think the Open Whisper Systems (TextSecure) team is stronger an…

TextSecure also has design contributions from Trevor Perrin, who is also amazing.

natdempk and tptacek have both asserted that TextSecure is trustworthy and solid by dint of being implemented and designed by reliable experts. This pretty much boils down to argument by authority.

mandalar12 asks about "the same level of analysis on TextSecure". Since our (Least Authority's) audit and the iSEC audit are public, random people on the internet can know what that level is, without having to know or rely on Least Authority or iSEC to be non-malicious.

With enough eyes all bugs are shallow, but to whom? We need to communicate transparently to achieve this ideal.

Disclaimers: I worked on the Least Authority audit of Cryptocat; I've worked at iSEC in the past; I've met Moxie Marlinspike and Trevor Perrin and greatly respect their expertise and motivations; I also don't know if they've been infected by malicious puppetmaster aliens since I last saw them.

Re: CryptoCat iOS Application Penetration Test [pdf]

#136

Post by daira »

nathan-at-least wrote: post #135
tptacek wrote: post #49

Earlier quoted context omitted.

TextSecure also has design contributions from Trevor Perrin, who is also amazing.

natdempk and tptacek have both asserted that TextSecure is trustworthy and solid by dint of being implemented and designed by reliable experts. This pretty much boils down to argument by authority. mandalar12 asks about "the same level of analysis on TextSecure". Since our (Least Authority's) audit and the iSEC audit are public, random people on the internet can know what that level is , without having to know or rel…

I don't actually see any assertions on this thread by natdempk or tptacek claiming that TextSecure is "trustworthy" and/or "solid". Did I miss something?

My own opinion is that both strong cryptographic and security engineering expertise on the part of designers and implementors, and multiple independent published security audits, are necessary to consider an app trustworthy -- but still not sufficient, given the poor state of platform security and the lack of support most current platforms (operating systems, browsers, etc.) give for isolation between apps.

Disclaimer: I worked on the Least Authority audit of Cryptocat, and in general get paid for similar auditing. I'm also designing a programming language (Noether) that is intended to facilitate security reviews.

Re: CryptoCat iOS Application Penetration Test [pdf]

#137

Post by tptacek »

diminoten wrote: post #130
marshray wrote: post #112

Earlier quoted context omitted.

Go read http://tobtu.com/decryptocat.php and earlier sources before deciding he's being extremist.

I have, and I still believe he's being extremist. No one is in this space unscathed. For no other product have I seen the same level of vitriol and hate being spit at Cryptocat, despite it being absolutely not the only entrant.

> No one is in this space unscathed

That's both not true, and misleading; even comparing it to applications that have had serious published flaws, this one has vulnerabilities of a number and magnitude that distinguish it.

Post reply on HN