Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TextSecure's Private Group Messaging

whispersystems.org

Post reply on HN
Print view View original

21–30 of 109 posts

Re: TextSecure's Private Group Messaging

#21

Post by tptacek »

kaeporan wrote: post #17
tptacek wrote: post #14

Earlier quoted context omitted.

mpOTR sacrifices forward secrecy and provides transcript consistency with limited semantics, which has the side effect of making the "transcript integrity feature" trivial to implement, because the protocol supports only a silly version of it. mpOTR clients can't simply fix this with UI, because these are properties of the protocol. The TextSecure protocol retains forward secrecy at the message layer and provides con…

Thanks for agreeing to turn the discussion in a more constructive direction, Thomas. I agree that mpOTR is a dead end. The initial paper by Goldberg et al describes a protocol that is bulky and largely undefined. I should mention that for those reasons, Cryptocat's group chat effort has been relabelled to "mpCat" instead of "mpOTR" — we're moving on to creating a protocol suitable for synchronous use-cases specifical…

Despite the fact that you've fleshed your responses out from single sentences to whole paragraphs, there is still no technical content in this comment that addresses my comment. It appears that your response is "no, we don't properly do transcript consistency either, but we're working on it". But I had to read between the lines of your name-dropping comment to come to that conclusion.

An uninformed reader of your root comment on this thread would be surprised by that concession. Is my conclusion incorrect, or was your original comment deceptive? (Unintentionally, I'm sure.)

Re: TextSecure's Private Group Messaging

#22

Post by makomk »

tptacek wrote: post #14
kaeporan wrote: post #13

Earlier quoted context omitted.

I'm sorry, but I don't think your approach to this discussion is constructive. I hope TextSecure developers address my initial concern, and that's all for me.

mpOTR sacrifices forward secrecy and provides transcript consistency with limited semantics, which has the side effect of making the "transcript integrity feature" trivial to implement, because the protocol supports only a silly version of it. mpOTR clients can't simply fix this with UI, because these are properties of the protocol. The TextSecure protocol retains forward secrecy at the message layer and provides con…

It doesn't matter what kind of transport integrity the underlying protocol has if that integrity information isn't actually used. What's more, it's not just that they haven't got around to implementing UI for it, the problem is they can't figure out how to meaningfully expose that information in the UI - which, with consistency semantics this complicated, is actually the hardest part of the problem! They don't even really have the outline of a solution, let alone the transcript integrity you're claiming they have. Yet here you are treating their vapourware as though it provides more protection than something that actually exists.

Re: TextSecure's Private Group Messaging

#23

Post by tptacek »

makomk wrote: post #22
tptacek wrote: post #14

Earlier quoted context omitted.

mpOTR sacrifices forward secrecy and provides transcript consistency with limited semantics, which has the side effect of making the "transcript integrity feature" trivial to implement, because the protocol supports only a silly version of it. mpOTR clients can't simply fix this with UI, because these are properties of the protocol. The TextSecure protocol retains forward secrecy at the message layer and provides con…

It doesn't matter what kind of transport integrity the underlying protocol has if that integrity information isn't actually used. What's more, it's not just that they haven't got around to implementing UI for it, the problem is they can't figure out how to meaningfully expose that information in the UI - which, with consistency semantics this complicated, is actually the hardest part of the problem! They don't even r…

The UI for transcript consistency is absolutely not the hardest part of the problem. We are comparing an existing UI on top of a broken transcript consistency feature to a nonexistent UI on a functional, extant transcript consistency protocol. I am objecting to the notion that an extant UI built on a mound of sand somehow trumps a concrete foundation poured for a better UI.

This is apparently so much the case that Nadim has acknowledged jettisoning his existing protocol to come up with a new protocol that will support it.

You could disagree with me, but I don't think you can do so without acknowledging that the comment that introduced this issue to the thread was... let's say "not fully informative".

Re: TextSecure's Private Group Messaging

#24

Post by kaeporan »

tptacek wrote: post #21
kaeporan wrote: post #17

Earlier quoted context omitted.

Thanks for agreeing to turn the discussion in a more constructive direction, Thomas. I agree that mpOTR is a dead end. The initial paper by Goldberg et al describes a protocol that is bulky and largely undefined. I should mention that for those reasons, Cryptocat's group chat effort has been relabelled to "mpCat" instead of "mpOTR" — we're moving on to creating a protocol suitable for synchronous use-cases specifical…

Despite the fact that you've fleshed your responses out from single sentences to whole paragraphs, there is still no technical content in this comment that addresses my comment. It appears that your response is "no, we don't properly do transcript consistency either, but we're working on it". But I had to read between the lines of your name-dropping comment to come to that conclusion. An uninformed reader of your roo…

My original comment was simply to point out a current problem in this protocol design. There are some ways one can deploy to make it more difficult for Alice to send different messages to Bob and Carol without being detected, and they are deployed in Cryptocat (you're welcome to peruse the codebase and documentation.)

Just as a note, I'm sincerely discouraged from attempting to have an informative discussion with you by the fact that you keep assuming bad faith on my part, and generally responding in a needlessly rude and aggressive fashion. Consider that your general approach in this particular discussion might be why information security has a bad name as a poisonous field. If I don't reply to parts of your post, consider that it is because they are phrased in a way that assumes and implies a complete understanding, wrapped in aggression and the assumption of bad faith. I'm not here for that kind of discussion.

Re: TextSecure's Private Group Messaging

#25

Post by tptacek »

kaeporan wrote: post #24
tptacek wrote: post #21

Earlier quoted context omitted.

Despite the fact that you've fleshed your responses out from single sentences to whole paragraphs, there is still no technical content in this comment that addresses my comment. It appears that your response is "no, we don't properly do transcript consistency either, but we're working on it". But I had to read between the lines of your name-dropping comment to come to that conclusion. An uninformed reader of your roo…

My original comment was simply to point out a current problem in this protocol design. There are some ways one can deploy to make it more difficult for Alice to send different messages to Bob and Carol without being detected, and they are deployed in Cryptocat (you're welcome to peruse the codebase and documentation.) Just as a note, I'm sincerely discouraged from attempting to have an informative discussion with you…

Your original comment is right there for readers to see, as is Moxie's post, which covers the issue in depth.

People can decide for themselves whether you meant to "point out a current problem in the protocol design" (a confusing question, given that your objection is about UI). You know what I think already.

Re: TextSecure's Private Group Messaging

#26

Post by nmb »

codelike wrote: post #11

I'm a big fan of TextSecure and recommended it to all my friends, both those in IT and 'normal' people. Usually, I managed to convince them that the open source nature of TextSecure and the crypto experts behind it (e.g. Moxie) make it more secure than Threema/... . However, the more sceptical ones among my friends always asked two questions, which I didn't have a good answer for: 1. What is TextSecure's business mod…

https://twitter.com/moxie/status/437030748965449728

Re: TextSecure's Private Group Messaging

#27

Post by kaeporan »

tptacek wrote: post #23
makomk wrote: post #22

Earlier quoted context omitted.

It doesn't matter what kind of transport integrity the underlying protocol has if that integrity information isn't actually used. What's more, it's not just that they haven't got around to implementing UI for it, the problem is they can't figure out how to meaningfully expose that information in the UI - which, with consistency semantics this complicated, is actually the hardest part of the problem! They don't even r…

The UI for transcript consistency is absolutely not the hardest part of the problem. We are comparing an existing UI on top of a broken transcript consistency feature to a nonexistent UI on a functional, extant transcript consistency protocol. I am objecting to the notion that an extant UI built on a mound of sand somehow trumps a concrete foundation poured for a better UI. This is apparently so much the case that Na…

UI is absolutely a very difficult part of the problem, and here we see an example outlining this. Even a capable protocol still has problems if the UI fails to translate the capabilities into benefits and security increases for users. I speak from experience: Cryptocat has had some serious issues that were due simply to incomplete UI, the most recent of which was related to authentication.

Also, the reason for us moving to a new protocol has more to do with formal security proofs than being able to adopt new properties.

Re: TextSecure's Private Group Messaging

#28

Post by rufo_ »

kaeporan wrote: post #24
tptacek wrote: post #21

Earlier quoted context omitted.

Despite the fact that you've fleshed your responses out from single sentences to whole paragraphs, there is still no technical content in this comment that addresses my comment. It appears that your response is "no, we don't properly do transcript consistency either, but we're working on it". But I had to read between the lines of your name-dropping comment to come to that conclusion. An uninformed reader of your roo…

My original comment was simply to point out a current problem in this protocol design. There are some ways one can deploy to make it more difficult for Alice to send different messages to Bob and Carol without being detected, and they are deployed in Cryptocat (you're welcome to peruse the codebase and documentation.) Just as a note, I'm sincerely discouraged from attempting to have an informative discussion with you…

gj implying on twitter that your followers should upvote your comments lol https://i.imgur.com/FI6IdaO.png

Re: TextSecure's Private Group Messaging

#29

Post by tptacek »

kaeporan wrote: post #27
tptacek wrote: post #23

Earlier quoted context omitted.

The UI for transcript consistency is absolutely not the hardest part of the problem. We are comparing an existing UI on top of a broken transcript consistency feature to a nonexistent UI on a functional, extant transcript consistency protocol. I am objecting to the notion that an extant UI built on a mound of sand somehow trumps a concrete foundation poured for a better UI. This is apparently so much the case that Na…

UI is absolutely a very difficult part of the problem, and here we see an example outlining this. Even a capable protocol still has problems if the UI fails to translate the capabilities into benefits and security increases for users. I speak from experience: Cryptocat has had some serious issues that were due simply to incomplete UI, the most recent of which was related to authentication. Also, the reason for us mov…

This is a comment that appears to endorse mpOTR's broken transcript consistency feature. Also: formal security proofs? Really?

Some context: http://tobtu.com/decryptocat.php

(Yes, we know you addressed these issues; the page I just linked to says that).

Re: TextSecure's Private Group Messaging

#30

Post by tptacek »

rufo_ wrote: post #28
kaeporan wrote: post #24

Earlier quoted context omitted.

My original comment was simply to point out a current problem in this protocol design. There are some ways one can deploy to make it more difficult for Alice to send different messages to Bob and Carol without being detected, and they are deployed in Cryptocat (you're welcome to peruse the codebase and documentation.) Just as a note, I'm sincerely discouraged from attempting to have an informative discussion with you…

gj implying on twitter that your followers should upvote your comments lol https://i.imgur.com/FI6IdaO.png

That is incredibly annoying, because it will probably have the effect of setting off the ring detector and burying the story, which is too bad, because the TextSecure post we're talking about here is excellent. I'll let the mods know. Thanks for catching this.
Post reply on HN